Reverse Proxy
What is a reverse proxy?
A reverse proxy is an intermediary server that sits between clients (devices and applications) and internal resources, such as servers and databases, managing inbound traffic. It strengthens security by concealing the IP addresses of internal resources and controlling which clients can access them.
How does a reverse proxy work?
A typical inbound access request passes through a reverse proxy in five steps.
-
A client sends an access request for an internal resource, such as a server or database, to the reverse proxy instead of connecting directly.
-
The proxy evaluates the request against access and routing policies.
-
If permitted, the proxy routes the request to the appropriate internal resource.
-
The internal resource responds through the proxy, which returns the response to the client.
-
Administrators can configure internal resources to accept requests only from the reverse proxy.
What is a reverse proxy used for?
Common uses for a reverse proxy include:
-
Backend masking and request routing: Reduces the attack surface by concealing backend server IP addresses and network topology while routing requests to the appropriate server.
-
Centralized access control: Simplifies administration and strengthens security by applying access policies consistently across multiple internal resources.
-
Backend server management: Allows administrators to add, remove or replace servers without requiring clients to change how they connect.
-
Simplified onboarding and offboarding: Enables administrators to grant and revoke access centrally, reducing manual effort and configuration errors.
-
Load balancing: Improves performance by distributing traffic across multiple backend servers.
-
High availability: Reduces service interruptions by redirecting traffic to an available server when a backend server fails.
What are the benefits of a reverse proxy?
A reverse proxy strengthens security by concealing backend server IP addresses and network topology, improves performance and availability by distributing traffic across servers and redirecting requests when one fails, and reduces operations costs and complexity by centralizing access control and backend server management.
What is the difference between a forward proxy and a reverse proxy?
A forward proxy processes outbound internet requests on behalf of clients on an internal network. A reverse proxy processes inbound access requests on behalf of internal resources, such as servers and databases. Both act as intermediaries, but they manage traffic moving toward different destinations and serve different purposes.
| Forward proxy | Reverse proxy | |
| Serves | Clients on an internal network | Internal resources, such as servers and databases |
| Traffic Direction | From the internal network to the internet | From clients to internal resources |
| Purpose | Manage, secure and monitor outbound internet traffic | Manage, secure and route inbound traffic to internal resources |
| What is concealed | Clients’ IP addresses | Backend server IP addresses and network topology |
More resources:
Blogs
Identity-Aware Proxy: Secure access for cloud & on-premises applications
SSH proxies vs. jump hosts—how to save time and spend less
Definitions
Privileged account and session management (PASM)
Products