Explaining Forward VS Reverse Proxy

The aim of this page📝 is to explain the difference between the concepts of a forward an a reverse proxy.

4 min readNov 24, 2023

Proxies are application-layer types of networking software dealing with various, mainly HTTP, protocols (not only, of course).
They sit somewhere between the client, the internet, and the server.
Forward proxy is on the client’s side of the internet. It is generally used to anonymize the client to bypass restrictions such as firewalls or to enforce restrictions like the content policies of your company.
A reverse proxy is on the server’s side of the internet. It is generally used to distribute the load from incoming requests to several servers (there are other use-cases of course)

In a forward proxy, the client knows it’s communicating with a proxy.
The proxy forwards requests to the server on behalf of the client.
In a standard (or forward) proxy setup, the client knows it’s communicating with a proxy.
The proxy forwards requests to a specific server on behalf of the client.
The client initiates the connection.
The forward proxy server can be installed on a separate server in the client’s network.
It sits between the user’s device network and the internet.
If any sensitive data is detected, the forward proxy server can either prevent access or apply acceptable use and corporate security policies.
If the data that is being sent from the user is approved by the forward proxy server, it is sent through to its destination¹. So, while the forward proxy software can be configured on the client’s device, it’s more common for it to be installed on a separate server within the client’s network.
This allows the forward proxy to handle requests from multiple devices within the network.

In a reverse proxy, the client thinks it’s communicating directly with the server.
The term “reverse” in “reverse proxy” refers to the direction of the connection initiation.
In a reverse proxy setup, the client thinks it’s communicating directly with the server.
The server initiates the connection to the reverse proxy.
Reverse proxy is commonly used for load balancing, SSL encryption, or caching.
My brother uses a reverse proxy so that he has a single public IP address mapped to multiple A records and reverse proxy is in front of his network and bidirectionally routes the requests between websites running on VMs and clients accessing websites
He’s using a reverse proxy to distribute incoming requests made to various domains that have an DNS A record to a single public ip different websites running on VMs.

The reverse proxy accepts these requests and forwards them to the appropriate VM based on the requested website.
This is a typical use case for a reverse proxy, as it allows for load balancing and increased security at the application layer.

A NAT gateway, on the other hand, is more about enabling instances in a private network to connect to the Internet or other services, while preventing the internet from initiating connections with those instances.
It doesn’t have the ability to distribute requests based on application-level information like the requested website or URL path.
Instead, it operates at the network layer, translating IP addresses for outbound and inbound traffic.
So while both a reverse proxy and a NAT gateway can be used to manage network traffic, they do so in different ways and for different reasons.

Yes, it’s possible to have both a forward and a reverse proxy in the same network.
A common use case for this setup is an enterprise network where the forward proxy is used to control outbound traffic (i.e., internet access from internal clients), and the reverse proxy is used to control inbound traffic to the company’s public-facing applications.
An employee in the company wants to access an external website.
Their request is sent to the forward proxy.
The forward proxy evaluates the request based on the company’s usage policies.
If the request is allowed, the forward proxy retrieves the content on behalf of the employee.
An external user wants to access the company’s public application.
Their request is sent to the reverse proxy.
The reverse proxy forwards the request to the appropriate server within the company’s network.