Reverse Proxy
A reverse proxy sits in front of backend servers, accepting client connections and forwarding requests to appropriate backends. Unlike a forward proxy (client-side), a reverse proxy is server-side and invisible to clients. Provides TLS termination, caching, compression, rate limiting, and security filtering. Nginx, Caddy, and Envoy are common reverse proxies.
Definition
A reverse proxy receives all client requests and forwards them to one or more backend servers. The client communicates only with the proxy – it never knows the backend server's IP or port. This provides: TLS termination (handle certificates at one point), request routing (path-based routing to different services), caching (serve static content without hitting backends), compression (gzip/brotli at the proxy level), security (WAF rules, rate limiting, IP blocking), and connection management (keep-alive multiplexing to backends). In microservice architectures, the reverse proxy (or API gateway) is the single entry point that routes /users to the user service, /orders to the order service, etc. Nginx handles 40%+ of internet traffic as a reverse proxy. Caddy provides automatic HTTPS. Envoy powers service meshes (Istio). HAProxy excels at high-connection-count TCP proxying.
Examples
- –Nginx: location /api { proxy_pass http://backend:8080; }
- –Caddy: reverse_proxy /api/* localhost:8080
- –Envoy: route_config with weighted_clusters for canary deploys
Related Protocols
Related Terms
TLS Termination
TLS termination is the practice of decrypting TLS traffic at a load balancer or reverse proxy rather than at the application server. The proxy handles certificate management, cipher negotiation, and CPU-intensive cryptographic operations. Backend traffic between proxy and application runs over HTTP (or re-encrypted with a simpler internal cert).
Load Balancer
A load balancer distributes incoming traffic across multiple backend servers to prevent any single server from becoming overwhelmed. Layer 4 (TCP) load balancers route by IP/port. Layer 7 (HTTP) load balancers can route by URL path, headers, or cookies. Health checks remove failed backends automatically.
Forward Proxy
A forward proxy sits between clients and the internet, making requests on behalf of clients. Corporate proxies (Squid, Zscaler) filter outbound traffic, enforce policies, and cache content. Clients must be configured to use the proxy. Forward proxies provide anonymity, content filtering, and bandwidth savings.