Open Source For Geeks: 01/20/18

Saturday, 20 January 2018

Difference between a forward proxy and a reverse proxy server

Background

Most of the companies out there have a proxy in between their corporate traffic and internet. This could be for multiple reasons - network security being one of them. In my previous post I showed how to set up a squid proxy -

How to set up a squid Proxy with basic username and password authentication in Ubuntu

That was basically a forward proxy. There are other type of proxies called reverse proxies. In this post we will see difference between them and how they work.

Proxy in lay man terms mean someone acting on behalf of someone else. This is the main principle behind forward and reverse proxy.

Forward Proxy :

Working :

Forward proxy sits between client machines and an origin server. Client machines make a request to the forward proxy with target as the origin server. Forward proxy then makes a request to the origin server, gets the response and sends it back to the clients. Clients in this case need to be explicitly configured to use this kind of forward proxy.

So to summarize a forward proxy retrieves data from another website (origin server) on behalf of the clients.

Example :

Consider three computers - A, B and C. Now A want to request a website hosted on computer C. In normal case it would directly be

A -> C

where computer A directly asks C for the website. However in case of Forward proxy there is an intermediate computer B. Computer A makes request to this computer B instead of directly making request to C. Computer B now makes a request to C gets the website and returns it back to the A. So the path would be

A -> B -> C.

When :

There can be multiple cases in which a forward proxy might be useful. Some are -

Client machines (Computer A in above case) are behind some firewall and have no access to internet and thereby no access to origin server.
A company wants to block some of the malicious sites. They do this on the forward proxy and make sure all client make request via this proxy.
A forward proxy also has feature to cache requests so that the response time is minimum.

Reverse Proxy :

Working :

Forward proxy was used to shield the client machines where as a reverse proxy is used to shield a origin server. So client machines make call to the reverse proxy as if they are the origin servers. Reverse proxy now makes a call to the actual origin server and returns the response back to the client.

Example :
Let's consider a similar example of 3 computers - A,B and C. Again in a normal scenario A would directly request website from C.

A -> C

In case of reverse proxy there is a computer B which hides C behind it. A makes call to B instead and B fetches the website from C and returns it back to A. So the path is again -

A -> B -> C

When:

Provide internet users access to a server that is behind the firewall.
Load balance backend servers.
Typical CDN deployment. Proxy server would tell the client the nearest CDN server.

Difference between a proxy and a reverse proxy server

If you see the example above in case of both forward and reverse proxy path is always -

A -> B -> C

In case of forward proxy B shields machine A by fetching content by C itself and sending back to A. Where as in case of reverse proxy B shields C by fetching the data from C and sending it back to A.

In case of forward proxy, C would think that B is the machine sending it request where there could be multiple A's behind B. Similarly in case of reverse proxy A would think that it is sending request to C but it would actually be a request to B and B would in turn talk to multiple C and send back the request to A.

NOTE: It's just nomenclature. As you take a basic reverse proxy setup and start bolting on more pieces like authentication, rate limiting, dynamic config updates, and service discovery, people are more likely to call that an API gateway (https://www.nginx.com/blog/building-microservices-using-an-api-gateway/).