Reverse Proxy Server

A proxy server creates an in-between, in between a user and a server. Largely what it does is help protect those end users by doing maybe some sort of web filtering, or perhaps it's doing some sort of malware filtering, or there are other services that it provides. But we can also use it on the server side, and that's what we're going to talk about here: a reverse proxy server.

The forward proxy

If I wanted to set up some sort of web filtering, then maybe I would set up a proxy server. I would block all other web traffic from going through the firewall unless it's coming from the proxy server. Now users on my network have to go through the proxy server in order to get out to the outside world, and then I can do web filtering on this proxy server. It's just one example of how we can protect our network and our infrastructure and our organizations.

In this scenario, what's happening is that the client is actually connecting to the proxy server, and the proxy server is creating a connection to the web server. So now what the web server sees is just the information coming from the proxy server. They don't see the client — it obfuscates the client on the back end. So not only are we doing web filtering, but we're protecting this client. This would be what we call just a forward proxy server.

The reverse proxy

But there are reverse proxy servers as well. That's where the proxy server is sitting out in front of the server. So now, as an organization, we do see the end client here and we're communicating with the end client, but the end client doesn't see the server on the back end. It's just a different perspective of this. It's still sitting between the client and the server, but it's working to protect the servers on the back end, not necessarily protecting the client on the front end.

Here would be a common reverse proxy setup. We have our server right here that's set up in front — this is the proxy server. End users would then be connecting, maybe, if this is a web server, to port 443 on this front end, and then this is making a connection to other back-end servers.

Why you would put a proxy in front

There are many reasons why we would want to set up a proxy server in front of this bank of servers that we have.

• Maybe we're using it for a content delivery network, so that it can be cached at other locations.
• Maybe we're doing it for some sort of load balancing, so we can load balance between many servers on the back end.
• Maybe it's doing some sort of caching, like a CDN would do caching. Maybe it's just doing some caching on the front end, offloading some of the duties that these web servers have onto some front-end server.
• It could be doing something like compression or encryption, so the web servers don't have to handle it. It can be handled on the proxy server instead, as it makes a connection to those end users.
• Maybe it's doing some sort of application firewall, a web application firewall up front.
• Or maybe it's doing some sort of A/B testing. Each one of these servers could actually be hosting a different website, and we could test which one is actually producing the best results. That's what A/B testing is.
• And then maybe it's doing some sort of authentication.

There are lots of things that we could offload to this proxy server. Whatever the case may be, a lot of this is just offloading some sort of aspect. For instance, these servers may be overtaxed and have a lot going on on them, and so instead of sending clients directly to these machines, this might offload some of those aspects, like doing the encryption or compression or those types of duties.