What Is a Reverse Proxy?
A reverse proxy stands in front of servers: clients connect to it, and it forwards requests to the right backend. A forward proxy represents clients; a reverse proxy represents servers — that direction flip is the whole distinction.
What a reverse proxy actually does
- Load balancing — spreads requests across multiple backends (how balancing works).
- TLS termination — holds the certificate and decrypts HTTPS once, so backends speak plain HTTP internally.
- Caching & compression — serves repeated content without touching backends.
- Shielding — backends are never directly exposed; the proxy is the single hardened entry point, often adding WAF rules and rate limits.
Forward vs reverse in one table
| Forward proxy | Reverse proxy | |
|---|---|---|
| Sits in front of | Clients | Servers |
| Hides | Client identity from servers | Server topology from clients |
| Typical use | Corporate egress filtering | Load balancing, TLS, caching |
| Example | Squid | nginx, HAProxy, cloud LBs |
A minimal nginx example
server {
listen 443 ssl;
server_name app.example.com;
location / {
proxy_pass http://10.0.0.21:8080; # the backend
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $remote_addr;
}
}The X-Forwarded-For header matters: since backends see the proxy as the client, this header carries the real client IP for logs and ACL decisions.
Where you meet them
Practically every serious web deployment: CDNs are giant reverse proxies, Kubernetes Ingress is one, and API gateways are reverse proxies with policy. If a site has one public IP but many servers behind it — that is a reverse proxy at work.
Frequently asked questions
What is the difference between a forward and reverse proxy?
A forward proxy sits in front of clients and represents them to servers (egress filtering, IP masking). A reverse proxy sits in front of servers and receives client traffic on their behalf (load balancing, TLS, caching).
Why use a reverse proxy?
To load-balance across backends, terminate TLS in one place, cache content, and shield servers behind a single hardened entry point — often with WAF and rate limiting.
What is TLS termination?
The reverse proxy holds the certificate and decrypts HTTPS, forwarding plain HTTP to backends internally — centralising certificate management and offloading crypto work.
What is X-Forwarded-For?
An HTTP header the proxy adds to carry the original client IP, since backends otherwise see every request as coming from the proxy itself.
Related articles
Want hands-on training?
Learn this on real Cisco lab devices with placement support at Attila Technologies, Ahmedabad.