What is a reverse proxy?
A reverse proxy is an intermediary that clients connect to instead of the real servers. It receives each request, decides which back-end server should handle it, opens its own connection to that server and returns the response as though it had produced it. Clients see only the proxy's name and address, while the application servers behind it stay off the internet. Common examples include NGINX, HAProxy, Apache HTTP Server with its proxy modules, cloud load balancers, and content delivery networks (CDNs), which are reverse proxies spread across many locations.
What a reverse proxy does
- TLS termination: it holds the site's certificate and private key, decrypts incoming HTTPS and can re-encrypt toward the back end. Certificates are managed in one place, and inspection tools get to see the plaintext.
- Load balancing and health checks: it spreads requests across servers and stops sending traffic to one that fails.
- Web application firewall: WAF rules often run on the reverse proxy, filtering requests before they reach the application.
- Rate limiting: it can cap requests per client and absorb bursts aimed at the application.
- Caching and compression: it answers repeated requests for the same content itself, reducing load on the servers.
- Hiding the back end: internal host names, addresses and server software stay out of view, and only the proxy needs a public address.
Example: publishing an internal app
A company wants partners to reach a ticketing application that runs on two internal servers. Rather than give either server a public address, it places an NGINX reverse proxy in the screened subnet with the public certificate for support.example.com and a forwarding block such as:
location / { proxy_pass https://ticket_backend; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; }
The perimeter firewall allows TCP 443 from the internet to the proxy only, and allows the proxy, and nothing else in the screened subnet, to reach the two back-end servers. Because the servers now see every connection arriving from the proxy, the proxy passes the original client address in the X-Forwarded-For header so the application's logs still show who connected. The application should trust that header only when it arrives from the proxy, since any client can send one of its own.
Reverse proxy vs. forward proxy
| Forward proxy | Reverse proxy | |
|---|---|---|
| Works for | Internal clients going out | Servers receiving requests |
| How traffic reaches it | Browser settings, a PAC file or transparent redirection | DNS points the site's name at the proxy |
| Hides | Users' addresses from websites | Servers from clients |
| Typical jobs | URL filtering, logging by user, caching | TLS termination, load balancing, WAF, caching |
The direction is the whole difference. A forward proxy acts on behalf of the clients that use it, while a reverse proxy acts on behalf of the servers behind it. An attacker going after the site meets the reverse proxy first, which is why it sits in the screened subnet and is hardened like any other internet-facing system.
Reverse proxy on the CompTIA Security+ exam
Proxies are taught with content filtering and web application firewalls among the mitigating controls in SY0-801 objective 4.1, and where a reverse proxy belongs in the network comes up with device placement under objective 3.2. Wording such as hide the internal web servers, terminate TLS for a server farm or publish an internal application without exposing the servers points to a reverse proxy, while filter and log employees' web browsing points to a forward proxy. Other distractors include a VPN, which gives remote users network access rather than publishing one application, and a port forward on the firewall, which exposes the server itself without terminating or inspecting the traffic.