17.2 Reverse Proxy

Overview

A reverse proxy is a server that sits in front of one or more backend servers and receives client requests on their behalf. Instead of clients connecting directly to a web server or application server, they connect to the reverse proxy. The reverse proxy then decides where to send the request, forwards it to the chosen backend, receives the response, and finally returns that response to the client.

From the client’s perspective, the reverse proxy appears to be the actual server. The client usually does not know that another server is sitting behind it. This is the opposite of a forward proxy, which represents clients when they access servers on the internet.

A reverse proxy is very common in modern networks, especially in web hosting, content delivery, and microservices environments.

How Reverse Proxy Differs from Forward Proxy

A forward proxy works on behalf of clients. Internal clients send traffic to the proxy, and the proxy then connects out to external servers on the internet. The external servers typically only see the proxy, not the original clients. Forward proxies are often used for content filtering, caching for a group of users, or hiding client identities.

A reverse proxy works on behalf of servers. External clients send traffic to the reverse proxy, and the proxy connects internally to one or more backend servers. The clients typically only see the reverse proxy’s address and certificate, not the actual backend.

This simple comparison helps:

Where Reverse Proxies Sit in the Network

In a typical network, the reverse proxy is placed at the edge of the server environment. It often has a public-facing IP address reachable from the internet, while most backend servers only have private IP addresses.

The traffic path looks like this:

User’s device on the internet connects to the reverse proxy’s public IP and port. The reverse proxy checks its configuration to decide which backend server should handle the request, forwards the request over the internal network, and receives the backend’s reply. The reverse proxy then sends the reply back to the user.

This placement allows the reverse proxy to act as a single, central gateway for many internal services, which simplifies security, routing, and management.

Core Functions of a Reverse Proxy

Although implementations differ, most reverse proxies provide several core functions.

Central Entry Point

The reverse proxy gives you a single, well known address and port, such as https://example.com, that users connect to. Behind that address you can have many separate backend applications or services. The reverse proxy decides which backend to use based on the requested hostname, URL path, port, or other criteria.

For example, requests for https://example.com/api/ might go to an application server, while https://example.com/static/ might go to a server that only hosts static content.

Load Balancing

A key feature of many reverse proxies is load balancing. Instead of sending all traffic to a single backend, the proxy can distribute requests across several backend servers. This improves performance and reliability, because no single server has to handle all requests.

There are different strategies for deciding which backend receives each request. These strategies are called load balancing algorithms.

Load balancing is usually configured per application or per URL path. The reverse proxy monitors health of the backends and, when configured to do so, avoids sending traffic to servers that are not responding.

SSL/TLS Termination

Reverse proxies are often used as TLS termination points. In this role, the proxy handles the encryption and decryption of HTTPS traffic from clients. The connection between client and reverse proxy uses HTTPS, but the connection between reverse proxy and backend can be HTTP or HTTPS, depending on security requirements.

This provides several advantages:

Only the reverse proxy needs to store and manage certificates, which simplifies certificate deployment and renewal. Backend servers can focus on application logic, and may run on plain HTTP in a protected internal network. The reverse proxy can enforce consistent TLS versions and cipher suites for all services exposed to the internet.

When SSL/TLS termination is used, the reverse proxy also usually adds headers that tell the backend that the original client connected over HTTPS, even if the proxy to backend connection is HTTP.

Caching of Responses

Reverse proxies can cache responses from backend servers and then serve those cached responses directly to future clients without contacting the backend again. This is very useful for static resources, such as images, stylesheets, or files that rarely change.

By caching, the reverse proxy reduces the load on backend servers and improves response times for users. Caching behavior is usually controlled by HTTP headers from the backend, or by rules on the reverse proxy.

Security and Access Control

Because all external traffic flows through the reverse proxy, it becomes a natural point to apply security controls. Common security related functions include:

Filtering requests based on IP addresses, HTTP methods, or URL patterns. Enforcing authentication, such as requiring login before allowing access to certain paths. Hiding details about internal server addresses and structure from the public.

Some reverse proxies include web application firewall features, which can help detect and block common web attacks before they reach the backend.

Header and Request Manipulation

Reverse proxies frequently rewrite parts of the incoming request or outgoing response. They might:

Add or remove HTTP headers, such as X-Forwarded-For to record the original client IP. Rewrite URL paths, so incoming URLs map cleanly to internal application paths. Adjust cookies or other attributes so that applications work correctly behind the proxy.

These changes allow legacy applications to be published under different URLs or domains without modifying their code.

Common Reverse Proxy Technologies

Several widely used software products act as reverse proxies. They are often used both in traditional data centers and in cloud environments.

Although details differ, the overall behavior is similar. Each product listens for client connections, inspects requests, chooses backends, and forwards traffic.

Basic Reverse Proxy Flow

To understand what a reverse proxy actually does for each request, consider a simplified HTTP example.

1. A client on the internet looks up www.example.com in DNS and obtains an IP address that belongs to the reverse proxy.
2. The client opens a TCP connection to that IP on port 443 and starts an HTTPS request.
3. The reverse proxy terminates the TLS connection, reads the HTTP request, and checks its configuration.
4. Based on the hostname and URL path, the proxy selects a backend server, such as 10.0.1.20:8080.
5. The proxy either reuses an existing connection to that backend or opens a new one, then forwards the HTTP request.
6. The backend processes the request and sends back an HTTP response.
7. The reverse proxy may cache the response, modify headers, or compress the body, then sends the response back over the original client connection.

From the client’s point of view, the response comes from www.example.com and the client does not see the internal IP or port of the backend.

Reverse Proxy and Microservices

In microservices architectures many small services run separately and communicate over the network. Exposing each service directly to the internet would be complex and risky. A reverse proxy solves this problem by acting as a gateway.

All external traffic first hits the reverse proxy, which then routes each request to the correct service based on API path or hostname. Different services can be implemented in different languages, reside in different containers, or even run on different hosts, yet appear under one consistent external domain.

This idea is sometimes called an API gateway role, although API gateways usually provide additional features such as rate limiting and request transformation. The fundamental routing function is still reverse proxying.

Benefits and Trade-offs

Reverse proxies bring a range of benefits, but they also introduce trade-offs.

Key benefits include simplified public exposure of multiple services under one address, centralized SSL/TLS, easier scaling through load balancing, performance improvements from caching and compression, and a single point where security policies can be enforced.

At the same time, a reverse proxy becomes a critical component. If it fails, access to all protected services may be affected. It also adds some processing overhead and configuration complexity. For these reasons, reverse proxies in production environments are usually deployed with redundancy and careful monitoring.

Understanding these roles and behaviors prepares you to see how reverse proxies are used together with load balancers, web servers, and other network services in larger designs.