Reverse Proxy Fundamentals
A reverse proxy is a server that accepts requests on behalf of one or more backend servers, chooses where each request goes, and returns the backend response. It gives clients one public endpoint while keeping backend addresses and traffic rules behind that boundary.
itWeb servers, proxies, and traffic management | OpenSkills.info
Course pathWalk it in order
Look it upDip in anytime
Go furtherLeaves this page
Intro
Reverse Proxy Fundamentals
A reverse proxy is an intermediary between clients and backend servers. The client connects to the reverse proxy as if it were the origin server. The reverse proxy accepts the request, selects a backend, forwards the request, and relays the response.
This extra hop creates a useful boundary. Clients can use one stable address while backend addresses, ports, and server counts change behind it. The same boundary can terminate TLS, route requests, distribute load, cache eligible responses, and record traffic.
A reverse proxy is not invisible plumbing. It handles a client-facing connection and a separate backend-facing connection. Its configuration can change request meaning, expose the wrong backend, or make every application behind it unavailable.
Follow one request
Start with the smallest mental model:
client → reverse proxy → backend
The client resolves a public name and connects to the reverse proxy. The reverse proxy matches the request against routing rules. A rule may examine the requested host or path. The proxy then selects a healthy backend, creates or reuses a connection to it, and forwards the request.
The backend sends its response to the proxy. The proxy may buffer, cache, or transform that response according to explicit policy. It then sends a client-facing response.
Continue the course
This section is part of the paid course.
See pricing to subscribe, or log in if you already have access.
Where this skill leads
Relevant careers
See how this topic contributes to broader role-level skill maps.
Sources
- https://www.rfc-editor.org/rfc/rfc9110.html
Supports
- Reverse proxy, forward proxy, gateway, tunnel, upstream, downstream, inbound, and outbound definitions
- HTTP method semantics, intermediary behavior, connection handling, field processing, and safe retry considerations
- https://www.rfc-editor.org/rfc/rfc7239.html
Supports
- Forwarded field parameters for client-facing node, proxy interface, host, and protocol
- Proxy-chain ordering, field integrity limits, privacy risks, and trusted-proxy requirements
- https://www.rfc-editor.org/rfc/rfc9111.html
Supports
- Shared-cache behavior, cache keys, freshness, validation, invalidation, and authenticated-response constraints
- https://www.rfc-editor.org/rfc/rfc9209.html
Supports
- Standard proxy error types, generated-by identification, diagnostic parameters, and security considerations
- https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/Proxy_servers_and_tunneling
Supports
- Learner-oriented comparison of forward proxies, reverse proxies, and tunnels
- https://nginx.org/en/docs/http/ngx_http_proxy_module.html
Supports
- Backend selection, request URI mapping, request field defaults, buffering, timeouts, caching, and protocol upgrade configuration
- https://nginx.org/en/docs/http/request_processing.html
Supports
- Listener and server-name selection, default servers, and rejecting undefined host names
- https://docs.nginx.com/nginx/admin-guide/monitoring/logging/
Supports
- Access and error logging, upstream timing variables, conditional logging, and runtime diagnostics
- https://www.haproxy.com/documentation/haproxy-configuration-tutorials/proxying-essentials/configuration-basics/
Supports
- Client-facing frontends, backend server pools, combined listeners, and proxy configuration structure
- https://www.haproxy.com/documentation/haproxy-configuration-tutorials/proxying-essentials/configuration-basics/frontends/
Supports
- Layer four and layer seven modes, bind addresses, default backends, and conditional host routing
- https://www.haproxy.com/documentation/haproxy-configuration-tutorials/reliability/health-checks/
Supports
- Active and passive health checks, backend eligibility, probe configuration, status, and diagnostics
- https://github.com/sindresorhus/awesome
Supports
- Required discovery starting point for curated awesome lists
- https://github.com/awesome-foss/awesome-sysadmin
Supports
- Discovery path from the sysadmin list to the current Web Servers and Reverse Proxies catalog
- https://awesome-selfhosted.net/tags/web-servers.html
Supports
- Current curated listing of Caddy, HAProxy, Traefik, Pomerium, and other web-server or reverse-proxy projects
- https://caddyserver.com/docs/quick-starts/reverse-proxy
Supports
- Command-line and Caddyfile proxy setup, client HTTPS, backend HTTPS, trust, and host behavior
- https://www.haproxy.com/documentation/haproxy-configuration-tutorials/
Supports
- HAProxy learning path for configuration, proxying, protocols, health, security, reliability, performance, and monitoring
- https://doc.traefik.io/traefik/v3.2/routing/overview/
Supports
- Traefik entry points, routers, middleware, services, providers, and HTTP or TCP routing
- https://www.pomerium.com/docs
Supports
- Pomerium identity-aware proxy role, request routing, identity checks, context checks, deployment models, and protected services
