What Is Reverse Proxy?

• Reverse Proxy Definition

  Reverse Proxy Definition

  A reverse proxy is an intermediary client-server architecture that protects the origin server's identity from the clients by masking its IP address. All the incoming connection requests pass through it before reaching the origin server; thereby, it acts as a gateway with built-in security tools. It also helps enhance the network performance with intelligent data compression, caching, and load balancing.
• How does reverse proxy server work?

  How does reverse proxy server work?

  The reverse proxy server typically sits between your corporate firewall and back-end servers and receives all the incoming HTTP requests. After receiving the connection requests at the network perimeter, it completes a three-way TCP handshake with clients and terminates the initial connections immediately. It then forwards those inward requests to the origin server, collects the server responses, and sends them back to the clients. Preventing illicit users or unauthorized traffic from reaching the origin server is the primary motive of intermediary servers.

  Compared to the forward proxy, reverse proxies secure the origin server with traffic scrubbing and preventing direct server interactions. On the other hand, forward proxy hides the client computers' identity by interacting with web servers on behalf of them. In short, forward proxy sits in front of client computers, whereas its counterpart is positioned before web or application servers. Nevertheless, both operate at the network edge and help optimize network security, efficiency, and performance.
• Why use a reverse proxy?

  Why use a reverse proxy?

  Load balancing: This is one of the primary functions of reverse proxies or intermediary servers, allowing it to distribute incoming traffic to multiple back-end servers to prevent website unresponsiveness or slowdown due to server overload. It’s especially beneficial for a high-traffic website running on multiple servers. In addition, intermediary servers can perform global server load balancing (GSLB) by routing the incoming traffic to servers geographically closest to end-users to reduce the website load times. They rely on load balancing algorithms, such as weighted round-robin and least connection, to help divert the traffic to the appropriate back-end server.

  Cyberattack prevention: Setting up an intermediary server makes it extremely difficult for attackers to launch a DDoS attack or exfiltrate valuable data from origin servers due to layered protection. Masking origin servers' IP addresses and intercepting every client request directed to back-end servers makes it an ideal solution for tightening network security controls. Further, it can enable basic HTTP access authentication for web servers. Security teams can install a web application firewall in reverse proxies to prevent malicious data packets from reaching back-end servers.

  Secure file transfer: Modern FTP servers leverage reverse proxies or gateways, enabling organizations to exchange files internally and externally in a safe, compliant, and automated way. Such gateways help security teams create a demilitarized zone (DMZ) to handle the connection requests from FTP clients outside the corporate firewall without exposing internal systems. In addition, gateways help ensure DMZ segments don’t contain sensitive data and reject all inbound connections to corporate LAN. This helps organizations stay compliant with PCI DSS and other data security standards.

  Web acceleration: Intermediary servers can eliminate website performance bottlenecks by offloading processor-intensive SSL encryption and decryption tasks from the origin server. They can decrypt inward data packets and encrypt outward messages for secure client-server communication. Similarly, they can use intelligent data compression to reduce the network bandwidth requirements of a web server, resulting in faster response times and improved user experiences.

  Content caching: This enables the reverse proxies to store the replica versions of frequently requested website content for rapid delivery. Compressing and caching content by an intermediary or local server takes the load off from origin servers and improves the website’s performance and availability.
• Reverse proxy vs. load balancer

  Reverse proxy vs. load balancer

  Both reverse proxies and load balancers serve as intermediaries to ensure seamless client-server communication and perform activities to enhance network efficiency. Both intercept the client HTTP requests before routing them to back-end servers. Organizations often find it difficult to distinguish both due to their similar characteristics.

  A load balancer adequately distributes incoming traffic across multiple servers, enabling organizations to host websites in multi-server environments. It can be a physical device or software application that organizations typically deploy in web farms. It relies on various algorithms, such as round-robin, least traffic, and least connection, for intelligent traffic distribution and optimal utilization of each server's capacity. Load balancers also monitor web servers' health by frequently detecting error responses to regular client requests. If a server is unavailable to handle a request, it automatically diverts the client requests to other servers in the web farm to prevent downtime. Additionally, load balancers provide session stickiness or persistence capability by routing all incoming requests from a client to a particular back-end server to enhance the end-user experience.

  In contrast, a reverse proxy server  is a more powerful intermediary than a load balancer with advanced features such as SSL encryption and data compression. Unlike load balancers, organizations can employ a reverse proxy server with a single web server for traffic routing and network security. It can obfuscate the back-end server to prevent direct connections. Implementing configuration changes or scaling resources in the back-end environment also becomes straightforward with reverse proxies. It creates a secure client-server communication channel by encrypting the inward and outward messages. This frees up valuable resources on origin servers from SSL encryption tasks. Further, it can compress and cache web server responses to optimize website performance and response times. Reverse proxies can also provide load balancing capabilities, preventing single-point failure in modern web architectures.