Forward proxy vs. reverse proxy: What's the difference?

What are forward proxies and reverse proxies?

Professional businesses, such as banks and insurance companies, and government agencies often put office computers used by company employees on a single, isolated private network. This isolation protects corporate computers from outside attacks. It also restricts the ability for users to nefariously move data and files out of the protected subnet.

However, it's nearly impossible for employees in a modern workplace to perform their jobs without some level of access to the internet. This is where the forward proxy comes in.

A forward proxy accepts connections from computers on a private network and forwards those requests to the public internet. It is the single point of exit for subnet users who want to access resources outside of their private network.

As the name implies, a reverse proxy is the opposite of a forward proxy. The reverse proxy acts as a single point of entry for external systems to access resources on a private subnet.

In an enterprise architecture, a reverse proxy acts as the public access point for users to access data and information that is stored on servers that reside in a private, isolated subnet.

For example, if users want to check their bank balance, the bank's login page is served up by a web server that acts as a reverse proxy. When users submit their username and password, the request again goes to the web server, which acts as a reverse proxy and sends the request through authentication servers, application servers and database servers that reside behind various firewalls on isolated private networks. The reverse proxy then crafts a response based on the data returned from the servers that reside on the private subnet and sends that response back to the client on the public internet.

Reverse and forward proxy similarities

The biggest similarity between a forward and reverse proxy is that they both protect devices connected to a private network against threats from the internet and other external networks.

Both forward and reverse proxies can limit the types and sizes of files that pass through them and disallow users who have not authenticated to send requests through them.

Both forward and reverse proxies can perform port and protocol switching, which can further disguise the access patterns used to access resources hidden behind them.

It's also possible to use the same software to configure both a forward and a reverse proxy.

For example, Nginx and the Apache web server are both commonly used as a reverse proxy in enterprise architectures. These two pieces of software can be configured to act as a forward proxy as well.

Reverse and forward proxy differences

Despite the many similarities, how an organization implements a forward versus a reverse proxy differs significantly.

A forward proxy is typically configured on the laptop or desktop of an office worker to provide secure access to the public internet, whether at work on-site or remotely logged in to the private network. Also, the forward proxy must be configured manually. Each computer that wants to access resources outside of the workplace's private subnet must be configured with the IP address and port number of the network's forward proxy.

In contrast to the forward proxy, a reverse proxy does not require pre-configured clients. The reverse proxy server is publicly accessible.

A reverse proxy and forward proxy both serve a common mission in enterprise architectures: to facilitate requests for resources between private networks and the public internet. However, they perform drastically different functions and serve decidedly different clients.

Forward proxies help users on a private subnet access the public internet. A reverse proxy enables requests that come from the public internet to access resources that reside on an otherwise private subnet.