We use analytics cookies.We use cookies to analyze site traffic and improve your experience.
Loading...
System Design and AI Engineering, by Roni Das. 984 interactive lessons.
Start LearningFoundation · Load Balancing & Proxies
An intermediary server that sits between the client and the destination server. Forward proxies act on behalf of clients; reverse proxies act on behalf of servers.
In short
A proxy is an intermediary server that sits between a client and a destination server, forwarding requests and responses on behalf of one side or the other. A forward proxy acts for the client and hides who is making the request; a reverse proxy acts for the server and hides which backend actually handles it.
In short
A proxy is an intermediary server that sits between a client and a destination server, forwarding requests and responses on behalf of one side or the other. A forward proxy acts for the client and hides who is making the request; a reverse proxy acts for the server and hides which backend actually handles it.
Learn it in the course
This page is the free part.
₹1,111 in India$25 everywhere elseonce, for the whole course
The System Design course covers Proxy across a run of lessons, not one page. These 4 alone are about 122 minutes of step-by-step reading, every one with a quiz.
What a forward proxy is, what changes on the wire, and why companies run one. Also compares forward and reverse proxies and tests the anonymity claim.
An intermediary that receives requests on behalf of servers, for TLS, routing, balancing, caching and protection.
A specialized sidecar that handles outbound connectivity, connection pooling, retries, and protocol translation for external services.
Path-based routing for microservices request routing, tested on real nginx, Envoy and HAProxy: nginx location order, ALB path rules, Ingress, path vs host.
all part of
System Design Masterclass
770 lessons · about 287 hours · 18 free to read
₹1,111in India, by UPI
$25everywhere else, by PayPal
It is really nice and good Please join the course
You own this course
Continue with Forward Proxypay once,
yours for life
A proxy is a server that relays traffic between two endpoints instead of letting them talk directly. The client sends its request to the proxy, the proxy decides what to do with it, and then it talks to the real destination. The response comes back the same way, in reverse.
There are two flavors, and the difference is whose side the proxy is on. A forward proxy sits in front of clients. When 5,000 employees in an office browse the web through one proxy, the websites they visit only see the proxy's IP address, not each employee's machine. A reverse proxy sits in front of servers. When you load a large website, you are almost always hitting a reverse proxy first, and it routes your request to one of many backend servers behind it.
The key idea is indirection. Because every request flows through one controlled point, the proxy can inspect, cache, block, rewrite, encrypt, or count traffic before passing it along. Neither the client nor the server has to know the other one exists directly.
At the network level, a proxy terminates the incoming connection and opens a new one to the target. For HTTP, a reverse proxy reads the request line and headers, looks at fields like Host and the URL path, and uses rules to pick a backend. Nginx, for example, matches the request against location blocks and forwards it to an upstream group, often round-robin across several servers.
Forward proxies often work through explicit client configuration. Your browser or operating system is told to send all traffic to proxy.example.com on port 3128, and it uses the HTTP CONNECT method to tunnel HTTPS traffic. The proxy can then allow or deny destinations by domain.
Reverse proxies add real work on the request path: they terminate TLS so backends do not each need certificates, they cache responses so identical requests never reach the origin, they compress responses with gzip or brotli, and they add headers like X-Forwarded-For so the backend still knows the original client IP. Because the proxy is the single front door, it is also the natural place to enforce rate limits and block bad requests.
Use a forward proxy when you need to control or anonymize outbound traffic: corporate filtering, content blocking, hiding client identity, or caching shared downloads for a whole office. Use a reverse proxy when you run servers and want a single, controllable entry point for TLS termination, load distribution, caching, and security filtering.
The cost is that a proxy is one more hop, so it adds a little latency, and if it goes down without a backup it takes everything with it. That is why production reverse proxies run in pairs or pools behind a health check or a load balancer.
People often confuse a reverse proxy with a load balancer. They overlap: a load balancer's main job is spreading traffic across servers, while a reverse proxy's broader job includes caching, TLS, header rewriting, and routing by URL. Many tools like Nginx and HAProxy do both, which is why the line is blurry.
Imagine an online store running on ten identical application servers. You put Nginx in front as a reverse proxy on port 443. A shopper's browser connects to the store, Nginx terminates the HTTPS connection, and then forwards the plain HTTP request to one of the app servers.
If the request is for the homepage image or a product photo, Nginx serves it straight from its own cache and the app servers never see it. If it is a checkout request, Nginx adds X-Forwarded-For so the app knows the real customer IP, applies a rate limit so one bot cannot hammer checkout, and passes it through.
From the shopper's side there is one address and one certificate. Behind the proxy you can add, remove, or restart app servers at any time, and the shopper never notices. That single point of control is the entire reason proxies are everywhere in modern infrastructure.
Nginx
Used as a reverse proxy in front of application servers for TLS termination, caching, and load distribution across backends.
Cloudflare
Acts as a global reverse proxy in front of millions of sites, caching content and filtering attacks before requests reach the origin.
HAProxy
A high-performance reverse proxy and load balancer used by companies like GitHub and Reddit to route and balance HTTP and TCP traffic.
Squid
A classic forward proxy used in corporate and ISP networks to cache web content and filter or control outbound browsing.
A forward proxy sits in front of clients and acts on their behalf, hiding who is making the request from the destination. A reverse proxy sits in front of servers and acts on their behalf, hiding which backend actually handled the request from the client.
Not exactly. A load balancer's main job is spreading traffic across multiple servers. A reverse proxy does that too but also handles TLS termination, caching, compression, and routing by URL. Tools like Nginx and HAProxy do both, which is why the terms get mixed up.
It adds one extra network hop, so there is a small latency cost. In practice a reverse proxy often makes things faster overall by caching responses, reusing connections to backends, and offloading TLS work, which outweighs the extra hop.
They are related but not identical. A proxy usually routes one application or protocol, like web traffic, and works at the HTTP or TCP level. A VPN encrypts and routes all traffic from your device at the network level. A VPN gives broader, lower-level tunneling than a typical proxy.
The proxy adds a header, most commonly X-Forwarded-For, that carries the original client IP. The backend reads that header instead of the proxy's own connection address. You must trust only your own proxies for this, since clients can forge the header.
Reverse Proxy
An intermediary that receives requests on behalf of servers, for TLS, routing, balancing, caching and protection
Ambassador Container Pattern
A specialized sidecar that handles outbound connectivity, connection pooling, retries, and protocol translation for external services
Path-Based Routing for Microservices: How a Proxy Picks a Service by URL Path
Path-based routing for microservices request routing, tested on real nginx, Envoy and HAProxy: nginx location order, ALB path rules, Ingress, path vs host.
Proxy Pattern
Control access to an object by placing a surrogate in front of it, caching, security, and lazy loading in one pattern
Server-Side Caching
Caching the finished response removes all the work, and one personalised element removes all the benefit
Reverse Proxy
A server in front of your web servers that receives every request first, passes it to one of them and returns the answer. It handles TLS, load balancing, caching and routing, and hides the servers behind it.
Load Balancer
Distributes incoming traffic across multiple servers so no single server gets overwhelmed. Like a traffic cop directing cars to different lanes.
API Gateway
A single entry point for all client requests that routes them to the appropriate microservice. Handles auth, rate limiting, and request transformation.
DNS
The phonebook of the internet. Translates human-readable domain names (google.com) into IP addresses that computers understand.
DNS Record Types
Different types of DNS records map domains to resources: A records point to IPs, CNAME aliases one domain to another, MX routes email, TXT stores verification data.
Forward Proxy
A proxy that sits in front of clients and forwards their requests to the internet. Used for anonymity, content filtering, and bypassing geo-restrictions.
This page explains the idea. The "Forward Proxy" lesson builds it up step by step, with diagrams. It is part of the System Design Masterclass course, which has 770 lessons. 18 of them are free to read. You pay once and keep it for life, with no subscription.
Open the Forward Proxy lessoncourse 1
From absolute beginner to principal engineer, drawn step by step.
Asked about Proxy in an interview?
Each question has why it is asked, a full answer, what the interviewer listens for, the follow-ups, the common mistakes and a diagram (268 diagrams in all). A PDF you keep, junior to staff level.
India: UPI, cards or netbanking through Razorpay. Elsewhere: card or PayPal. Download at once from My packs.
