“Proxy” describes a position, not a product: something that sits in the middle of a connection and passes traffic along. Our glossary entry on what a proxy server is covers the basic idea. This article goes one level deeper into the two shapes you meet most often, the forward proxy and the reverse proxy, which use the same mechanics but work for opposite sides of the connection.
The confusion is understandable. Both receive a request, both pass it on, and both hide something. The difference is whose side they are on. A forward proxy acts for the client, which is how residential proxies work. A reverse proxy acts for the server, which is what Nginx or a CDN does in front of a website. Once you know which side a proxy serves, the rest follows.
The difference in one sentence each
- A forward proxy sits in front of clients. The client chooses to send its traffic through it, and the website sees the proxy’s IP address instead of the client’s.
- A reverse proxy sits in front of servers. Clients connect to it believing it is the website, and it decides which backend server answers.
So a forward proxy hides the client from the server, and a reverse proxy hides the servers from the client.
How a forward proxy works
A forward proxy is configured on the client side. You enter its address in a browser, an operating system setting, a script or a scraping tool, and from then on your requests go to the proxy first.
- Your client connects to the proxy and, for most commercial services, authenticates with a username and password.
- For an HTTPS site, the client asks the proxy to open a tunnel to the destination. The proxy connects out and relays the encrypted bytes without reading them.
- The destination sees the connection arriving from the proxy’s IP address, so it applies its location, reputation and rate limits to that address, not to yours.
Companies have run forward proxies for decades to filter and log what employees reach on the web. The commercial proxy market is also forward proxies: a residential or ISP proxy service gives you exit IP addresses in the places you need, and the websites you visit see those addresses. Many providers put a single gateway in front of a large pool and pick the exit for you on each request, which is the backconnect model. People sometimes search for that as a “reverse rotating proxy”, but it is still a forward proxy: it acts for you, the client.
How a reverse proxy works
A reverse proxy is configured on the server side, and clients usually never know it is there. The website’s DNS record points at the reverse proxy, so every visitor connects to it.
- The visitor’s browser connects to what it believes is the website.
- The reverse proxy usually terminates TLS, reads the request and decides where it should go: which backend server, which service, or straight from its cache.
- It forwards the request to the chosen backend, often adding a header such as
X-Forwarded-Forso the application still knows the visitor’s real IP address. - It returns the backend’s response to the visitor as if it had produced it itself.
Nginx, HAProxy, Envoy and Traefik are common reverse proxies, and CDNs and DDoS protection services work the same way at global scale. The reasons to run one are load balancing across servers, a single place to manage TLS certificates, caching, compression, and a protective layer that can absorb attacks and block bad traffic before it reaches the application.
Side by side
| Forward proxy | Reverse proxy | |
|---|---|---|
| Acts on behalf of | The client | The server |
| Who configures it | The user or their company | The website operator |
| Who knows it is there | The client | The operator; visitors usually do not |
| What the other side sees | The proxy’s IP instead of the client’s | The proxy instead of the real servers |
| Typical software or service | Squid, corporate gateways, residential and ISP proxy services | Nginx, HAProxy, Envoy, CDNs, web application firewalls |
| Typical jobs | Location testing, data collection, access control, privacy from the destination | Load balancing, TLS, caching, attack protection |
A third type, the transparent proxy, intercepts traffic without the client configuring anything, for example on a hotel or school network. It acts for the network operator rather than for you, and it does not change the forward or reverse picture above.
When you need a forward proxy
You need a forward proxy when the question is how your own outgoing traffic appears to other websites:
- You need to see a site from another country or city. Prices, search results, ads and content change by location, and only an IP address in that place shows you the local version.
- You collect public web data at volume. Spreading requests across many residential IP addresses keeps any single address under the rate limits that sites apply per IP.
- You manage accounts that should keep one location. Here the ISP proxies model fits: each proxy stays in the city and on the ISP you choose for the whole billing period, while you keep the same username.
- Your company controls outbound access. A corporate forward proxy enforces policy and keeps a log of what leaves the network.
Choosing between protocols is a separate question from choosing a proxy type; our guide to HTTP vs SOCKS5 proxies covers it.
When you need a reverse proxy
You need a reverse proxy when the question is how incoming traffic reaches your own servers:
- You run more than one backend server and need to spread load and survive one going down.
- You want one place to handle TLS, redirects, compression and caching.
- You want protection from floods and abusive bots before requests reach your application.
- You want to expose several internal services under one domain, for example
/apiand/app.
If you only run a website, you need a reverse proxy, not a forward proxy, and your hosting provider or CDN often runs it for you.
When you need both
Plenty of companies run both, for different directions of traffic. A price intelligence team, for example, sends its outgoing collection through forward proxies in the markets it watches, and puts a reverse proxy in front of the dashboard and API its customers use.
The two also meet on every request you send through a forward proxy. Most large websites sit behind a reverse proxy or CDN that inspects visitors before the application sees them. That edge layer is what judges your forward proxy: the reputation and type of its IP address, how many requests arrive from it, and whether the connection looks like a real browser. This is why the exit IP matters more than the proxy software, and why requests from datacenter ranges are challenged far more often than requests from home connections.
FAQ
Is a VPN a forward proxy?
It plays a similar role, because it acts for the client and hides its IP address from websites. A VPN usually carries all traffic from the device at the network level, while a forward proxy is set per application or per request.
Is a load balancer a reverse proxy?
Most load balancers that work at the HTTP level are reverse proxies: they accept the client’s connection and choose a backend to forward it to. Some balancers work at a lower level and only route packets, which makes them a different kind of tool.
Can one server act as both a forward and a reverse proxy?
Yes. Software such as Nginx or Squid can be configured either way, and some setups do both. The role depends on configuration and on whose traffic the proxy handles, not on the software.
Are residential proxies forward or reverse proxies?
Forward. You configure them in your client, they act on your behalf, and the websites you visit see the residential exit IP address instead of yours.
The bottom line
Ask whose side the proxy is on. If it represents you to the websites you visit, it is a forward proxy, and the IP addresses it gives you are what matter. If it represents a website to its visitors, it is a reverse proxy, and it is about load, security and speed. Most teams that collect data from the web need the first, and most teams that run a website already have the second. Shifter’s forward proxies come with a free trial at shifter.io/order, so you can test them on the sites you care about before choosing a plan.