ARTICLE · Systems
Forward and reverse proxies
A proxy changes who speaks directly to whom. That single distinction explains the difference between a gateway for users and a gateway for servers.
Forward and reverse proxies
YouTube stays disconnected until you choose to load this player. Loading connects to Google/YouTube, which receives your IP address and may use cookies or browser storage.
Imagine two doors in the same city. At one, travelers ask a representative to fetch things on their behalf. At the other, visitors approach a public reception desk that forwards requests to the appropriate office. Both involve an intermediary, but the intermediary represents a different side.
A forward proxy sits on the client's side of the relationship. A reverse proxy fronts the server side. That distinction is more durable than memorizing a diagram, because it tells you whose routing, access, or availability problem the proxy is helping solve.
One public address, several private jobs#
The guild hall might publish a single HTTPS address while its application runs on an internal port. A reverse proxy can terminate TLS, serve static files, and forward API requests. Later it might distribute requests among several application instances.
Each new hop also adds something to inspect. A healthy application can be unreachable through a misconfigured proxy. A proxy can answer successfully while forwarding the wrong path. Trace the request across both boundaries instead of assuming the public response came directly from your program.
The Gatekeeper makes this concrete with Nginx. Draw the browser, proxy, and application as three boxes. Label each connection with its address and port. If you can explain both arrows, configuration stops looking like a collection of magic incantations.
See also