Forward Proxy

A forward proxy acts for the client side. Instead of your browser opening a connection straight to example.com, it opens a connection to the proxy, and the proxy makes the request to example.com for you. The website's logs show the proxy's IP, not yours.

The word forward matters because it distinguishes it from a reverse proxy. A forward proxy knows about and represents the clients, and the origin servers are anonymous to it. A reverse proxy (like Nginx in front of a web app) represents the servers, and the clients are anonymous to it. Same machine type, opposite direction.

Clients usually have to be configured to use a forward proxy. You set a proxy address and port in the browser, the operating system, or an environment variable like HTTP_PROXY, and from then on traffic is routed through it. This is different from a transparent proxy, which intercepts traffic at the network level without the client knowing.

For plain HTTP, the client sends the full request to the proxy, the proxy reads the destination from the request line or Host header, opens its own connection to that server, fetches the response, and relays it back. The proxy can read, log, cache, or rewrite the request because the traffic is in the clear.

For HTTPS, the proxy cannot read the encrypted payload by default. The client sends a CONNECT request naming the target host and port, and the proxy opens a raw TCP tunnel and blindly pipes encrypted bytes in both directions. If an organization wants to inspect HTTPS, it runs a man-in-the-middle proxy that terminates TLS, decrypts, inspects, then re-encrypts, which requires installing the proxy's root certificate on every client.

A common extra job is caching. If two users request the same large file, the proxy can serve the second request from its local store instead of going out to the internet again. Squid, one of the oldest forward proxies, was built largely for this in the days of expensive bandwidth.

Use a forward proxy when you need a single chokepoint for outbound traffic. Corporate networks route all employee browsing through one so they can block categories of sites, scan for malware, enforce data-loss policies, and keep an audit log. Schools and libraries use them to filter content. Web scrapers route through pools of proxies so a target site does not see thousands of requests from one IP.

The cost is that the proxy becomes a single point of failure and a bottleneck. Every request now makes an extra hop, adding latency, and if the proxy goes down the whole network loses internet access. It also concentrates trust, since an inspecting proxy can see everything users do.

There are limits to anonymity too. A basic proxy hides your IP from the destination but the proxy operator still sees you, and many proxies add headers like X-Forwarded-For that reveal the original client. A VPN encrypts the whole network path; a forward proxy typically only handles specific application traffic such as HTTP.

Picture a 5,000-person company. IT sets up Squid as a forward proxy and pushes a configuration so every laptop sends web traffic to proxy.corp.internal on port 3128. An employee opens a banned gambling site; the request hits Squid, Squid checks its blocklist, returns a denied page, and nothing ever leaves the building. The same employee downloads a 200 MB installer that a colleague grabbed an hour earlier, and Squid serves it from cache in seconds.

Now flip to scraping. A data team needs to collect prices from a retailer that rate-limits per IP. They send requests through a rotating residential proxy service like Bright Data, so each request appears to come from a different home connection and the retailer never sees a flood from one address. That rotating service is a forward proxy operating at scale.