Skip to main content

Proxy Servers

Proxies act as intermediaries in network communication, providing security, performance, and functionality benefits.

Proxy Types​

Forward Proxy​

"A forward proxy hides the client's identity."

Position: Sits in front of clients Purpose: Control or anonymize client access Use Cases:

  • Corporate internet access control
  • Content filtering
  • Anonymization services
  • Bypassing geo-restrictions

How it works:

Client -> Forward Proxy -> Internet

Reverse Proxy​

"A reverse proxy hides the servers' identity."

Position: Sits in front of servers Purpose: Load balancing and security Use Cases:

  • Load balancing
  • SSL termination
  • Caching
  • Compression
  • Security filtering

How it works:

Client -> Reverse Proxy -> Backend Servers

Forward Proxy Applications​

Corporate Networks​

  • Access control: Block inappropriate content
  • Bandwidth management: Limit non-business traffic
  • Security scanning: Scan outgoing traffic
  • Logging: Monitor internet usage

Privacy Services​

  • Anonymization: Hide client IP addresses
  • Location spoofing: Appear from different regions
  • Censorship bypass: Access restricted content

Reverse Proxy Applications​

Load Balancing​

  • Traffic distribution: Spread requests across servers
  • Health checking: Monitor server availability
  • Failover: Redirect traffic from failed servers

SSL Termination​

  • Encryption offloading: Handle SSL/TLS processing
  • Certificate management: Centralized certificate handling
  • Performance optimization: Reduce server CPU load

Caching​

  • Static content: Cache images, CSS, JavaScript
  • API responses: Cache frequently requested data
  • Compression: Reduce bandwidth usage

Security​

  • Web Application Firewall (WAF): Filter malicious requests
  • Rate limiting: Prevent abuse and DDoS attacks
  • Access control: Implement authentication rules

NGINX​

Strengths:

  • High performance
  • Rich feature set
  • Excellent documentation
  • Wide adoption

Common Uses:

  • Reverse proxy
  • Load balancer
  • Web server
  • Content cache

HAProxy​

Strengths:

  • Reliable and stable
  • Advanced load balancing algorithms
  • Detailed statistics
  • Configuration flexibility

Common Uses:

  • Load balancer
  • Reverse proxy
  • SSL termination

Apache HTTP Server​

Strengths:

  • Modular architecture
  • Wide feature support
  • Mature ecosystem
  • Easy configuration

Common Uses:

  • Reverse proxy
  • Web server
  • Application gateway

Envoy Proxy​

Strengths:

  • Cloud-native design
  • Advanced observability
  • Dynamic configuration
  • Microservices focus

Common Uses:

  • Service mesh
  • API gateway
  • Load balancer

Configuration Examples​

NGINX Reverse Proxy​

server {
    listen 80;
    server_name example.com;
    
    location / {
        proxy_pass http://backend_servers;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
    
    location /api/ {
        proxy_pass http://api_servers;
        proxy_cache api_cache;
        proxy_cache_valid 200 5m;
    }
}

upstream backend_servers {
    server backend1.example.com;
    server backend2.example.com;
    server backend3.example.com;
}

HAProxy Load Balancer​

frontend http_frontend
    bind *:80
    default_backend http_servers
    
backend http_servers
    balance roundrobin
    server web1 192.168.1.10:80 check
    server web2 192.168.1.11:80 check
    server web3 192.168.1.12:80 check
    
    option httpchk GET /health
    option forwardfor

Advanced Features​

Health Checks​

  • TCP checks: Basic connectivity verification
  • HTTP checks: Application-level health verification
  • Custom scripts: Complex health validation
  • Graceful shutdown: Drain connections during maintenance

Session Persistence​

  • Cookie-based: Use cookies to track sessions
  • Source IP: Use client IP for routing
  • Consistent hashing: Distribute sessions evenly

Rate Limiting​

  • Request limiting: Control request rates
  • Connection limiting: Limit concurrent connections
  • Bandwidth limiting: Control data transfer rates

Security Features​

  • WAF integration: Block malicious requests
  • DDoS protection: Absorb traffic spikes
  • Authentication: Implement access control
  • Encryption: SSL/TLS termination

Best Practices​

Performance Optimization​

  • Connection pooling: Reuse backend connections
  • HTTP/2 support: Enable multiplexing
  • Compression: Reduce bandwidth usage
  • Caching: Store frequently accessed content

Security Hardening​

  • Hide headers: Remove server information
  • Rate limiting: Prevent abuse
  • Security headers: Add security-related HTTP headers
  • Regular updates: Keep software current

Monitoring and Logging​

  • Access logs: Record all requests
  • Error logs: Track issues and failures
  • Performance metrics: Monitor response times
  • Health status: Track server availability

Use Case Examples​

E-commerce Platform​

# Product pages - cache static content
location /products/ {
    proxy_cache product_cache;
    proxy_cache_valid 200 1h;
    proxy_pass http://product_servers;
}

# Shopping cart - no caching
location /cart/ {
    proxy_pass http://cart_servers;
    proxy_set_header Cookie $http_cookie;
}

# Checkout - secure and no caching
location /checkout/ {
    proxy_pass https://secure_servers;
    proxy_set_header X-Forwarded-Proto https;
}

API Gateway​

# Public API - rate limited
location /api/v1/public/ {
    limit_req zone=api_limit burst=10 nodelay;
    proxy_pass http://api_servers;
}

# Internal API - no rate limiting
location /api/v1/internal/ {
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://api_servers;
}

Key Takeaway: Proxies are essential components in modern architectures, providing security, performance, and functionality benefits that enable scalable and resilient systems.