A proxy server receives a connection from one system and makes another connection on its behalf. A forward proxy represents clients when they access external services; a reverse proxy represents servers when clients connect to an application. Proxies can improve control, caching, privacy, security, and availability, but their effect depends on where they are placed and how they are configured.
What does a proxy server do?
The client connects to the proxy, the proxy opens or reuses a separate connection to the destination, and the response returns through the proxy. Depending on its type and configuration, it can hide one side’s direct address, cache content, authenticate users, enforce policy, balance traffic, or add logging. It does not automatically encrypt the client-to-proxy connection or make activity anonymous.
Forward and reverse proxies
| Type | Represents | Common uses |
|---|---|---|
| Forward proxy | Users or client devices | Outbound access policy, privacy, filtering, caching, and egress control. |
| Reverse proxy | Web servers or applications | TLS termination, load balancing, routing, caching, rate limiting, and hiding origin addresses. |
| Transparent/intercepting proxy | Traffic redirected without ordinary application configuration | Network enforcement, caching, or filtering; HTTPS handling requires careful design. |
| Application proxy | A specific protocol or application | Protocol validation, authentication, logging, and policy. |
How an HTTP proxy works
For ordinary HTTP, the proxy can receive the complete request, apply policy, and make a new request to the destination. For HTTPS through the CONNECT method, a basic proxy creates a tunnel and normally sees the destination host and connection metadata but not the encrypted page content.
A managed security proxy can perform TLS inspection by creating separate encrypted sessions. That requires a trusted organization certificate on clients and introduces sensitive-data, certificate, legal, and operational responsibilities.
Proxy versus VPN
- A proxy may handle only configured applications or protocols.
- A VPN normally creates an encrypted network tunnel for selected or all device traffic to a VPN endpoint.
- Both the proxy or VPN operator can learn metadata and may see unencrypted traffic after termination.
- Neither technology proves that the destination is safe or makes an account anonymous.
Security and privacy risks
- An unknown free proxy can log credentials, destinations, or content that is not end-to-end encrypted.
- A malicious proxy configuration can redirect traffic or insert untrusted certificates.
- An open proxy can be abused by outsiders and create legal, reputation, and resource problems.
- Forwarded client headers can be trusted incorrectly by a reverse-proxied application.
- Administrative panels, logs, caches, and TLS private keys can expose sensitive data.
Safe configuration
- Use a trusted operator and authenticated access.
- Limit listening addresses and firewall exposure; never create an unintended open proxy.
- Keep proxy software and TLS libraries updated.
- Validate destination certificates correctly and protect inspection keys.
- Restrict management access with MFA and least privilege.
- Define log fields and retention; avoid storing unnecessary URLs, credentials, or content.
- For reverse proxies, configure trusted proxy ranges before accepting forwarded IP or protocol headers.
Troubleshooting
- 407 Proxy Authentication Required: check credentials, account policy, and the application's proxy support.
- Certificate warning: stop and verify the intended inspection certificate; do not install a certificate from an unknown proxy.
- Only some applications fail: compare system and application-specific proxy settings and protocol support.
- Wrong client IP: review forwarded headers and trusted proxy configuration.
- Slow connections: measure DNS, proxy queueing, TLS inspection, upstream latency, and content scanning separately.
When a secure web gateway is different
A proxy is a traffic-relay architecture. A secure web gateway is a security control that may use proxy technology along with identity, URL categorization, malware analysis, data policy, browser isolation, and incident integration.