Forward proxy
A proxy that acts for the client. It sits between you and the internet and hides your address from destinations.
A forward proxy acts on behalf of the client. It sits between a user and the wider internet, receives outbound requests, and reissues them from its own address. This is what people normally mean by “a proxy”.
#The direction that defines it
The distinction is whose side the intermediary is on. A forward proxy is deployed by, or for, the party making the request. The destination server usually has no relationship with it and often cannot tell it is there.
#Typical uses
- Concealing the client’s address from the destination.
- Enforcing an outbound policy on a corporate network.
- Distributing requests across many addresses in a pool so that no single address is used enough to be blocked.
- Reaching content that is restricted by region, via geo-targeting.
#Commonly confused with
A reverse proxy faces the opposite way: it is deployed by the owner of a server, and clients connect to it believing it is the origin. If you are hiding the client, it is forward. If you are fronting the server, it is reverse.
#Forward and reverse, side by side
| Forward proxy | Reverse proxy | |
|---|---|---|
| Deployed by | The client, or the client’s network | The owner of the server |
| Configured in | The client | DNS, so clients need no setup |
| Hides | The client from the server | The server from the client |
| Knows the destination | From the request | From its own routing rules |
Read the table by asking one question: whose identity does the intermediary protect? That answer names the type every time.
#How a client is pointed at one
Three mechanisms are common, and they differ in how widely they apply.
- Per-request configuration in code. The narrowest and the most predictable.
- Environment variables such as
http_proxy. Process-wide and inherited by children, which is convenient and easy to over-apply. The behaviour differs between clients. - System or PAC configuration. Browsers and native Windows stacks read this rather than the environment.
A transparent proxy is a fourth case. The network redirects traffic to it with no client configuration at all, so the client may not know it exists.