Definition
- Forward proxy – on the client's side; clients send outbound traffic through it; the destination sees the proxy's IP, not the client's. Used for egress filtering, corporate access control, anonymity, and caching outbound requests.
- Reverse proxy – on the server's side; deployed in front of backends; clients connect to it believing it is the server. Used for TLS termination, load balancing, caching, compression, and routing.
- Key difference – a forward proxy hides clients from servers; a reverse proxy hides servers from clients.
- Nginx/API Gateway – when placed in front of your services, they act as reverse proxies.
A forward proxy is the corporate mailroom at National Bank of India: every employee's outgoing letter goes through it, the outside world only sees the mailroom. A reverse proxy is the public reception desk: customers talk only to reception, which routes them to the right department while hiding the back offices. One protects the people going out; the other protects the servers receiving visitors.
Understanding the Concepts
What is a forward proxy?
A forward proxy is on the client's side. Clients send outbound traffic through it, and the destination server sees the proxy's IP, not the client's.
Forward Proxy
┌────────┐ ┌──────────────┐ ┌──────────────┐
│Employee│ ──────► │ Forward │ ──────► │ External │
│Browser │ │ Proxy │ │ Server │
└────────┘ │ (corp proxy) │ │ sees proxy IP│
└──────────────┘ └──────────────┘
Client is aware of the proxy; server is not aware of the client.
Uses: egress filtering (block disallowed sites), corporate VPN, anonymity, caching outbound requests.
What is a reverse proxy?
A reverse proxy is on the server's side. Clients connect to it believing it is the server. It forwards requests to backends and hides them.
Reverse Proxy
┌────────┐ ┌──────────────┐ ┌──────────────┐
│Customer│ ──────► │ Reverse │ ──────► │ Backend │
│Browser │ │ Proxy (Nginx)│ │ Service │
└────────┘ │ TLS, routing │ │ (hidden) │
└──────────────┘ └──────────────┘
Client is unaware of the backends; server operator deployed the proxy.
Uses: TLS termination, load balancing, caching responses, compression, routing.
How do they compare?
| Aspect | Forward Proxy | Reverse Proxy |
|---|---|---|
| Position | In front of clients | In front of servers |
| Hides | Clients from servers | Servers from clients |
| Configured by | Client (or IT admin) | Server operator |
| Destination awareness | Can reach any server | Fronts a known set of backends |
| Examples | Squid, corporate proxy | Nginx, HAProxy, Envoy |
| API Gateway | Not a forward proxy | Always a reverse proxy |
Which one is Nginx or an API gateway?
When placed in front of your backend services, they are reverse proxies. An API gateway is always a specialized reverse proxy because its entire purpose is to front and protect your backend APIs.
// Nginx as reverse proxy in Spring Cloud Gateway
// Client calls: https://bank.example.com/api/transfers
// Gateway routes to: http://transfer-service:8080/transfers
// Client never sees transfer-service:8080
Can the same software be both?
Yes. Nginx can be configured as a forward proxy too, but that is a different deployment. The role is defined by position and purpose, not by the product name.
What are common mistakes?
// WRONG: confusing the two because both are "proxies"
// A forward proxy controls what clients can reach (egress).
// A reverse proxy controls how clients reach servers (ingress).
// CORRECT: ask "whose side is the proxy on, and who does it hide?"
What should a senior engineer know?
- The same physical software can serve either role depending on configuration.
- The question to ask is always: is it fronting clients going out (forward) or servers receiving traffic (reverse)?
- An API gateway is always a reverse proxy because its purpose is to front APIs.
- In banking, the forward proxy fronts employees for compliance logging; the reverse proxy fronts services for security.
When would you use a forward proxy in a microservices context?
In microservices, a forward proxy is used for egress control: your services make outbound calls to third-party APIs (credit bureaus, payment gateways, SWIFT), and you route those calls through a forward proxy for logging, allow-listing, and rate limiting outbound traffic.
package com.bank.proxy;
public class ForwardProxyUseCase {
public static void main(String[] args) {
System.out.println("Forward proxy in microservices:");
System.out.println(" 1. Egress allow-list: services can only call approved APIs");
System.out.println(" 2. Audit logging: every outbound call to third parties logged");
System.out.println(" 3. Rate limiting outbound: respect SWIFT API rate limits");
System.out.println(" 4. TLS inspection: verify certificates on outbound calls");
System.out.println();
System.out.println("Example: Transfer service -> forward proxy -> SWIFT API");
System.out.println("Proxy ensures: only SWIFT endpoint is reachable, calls are logged");
}
}
Expected output:
Forward proxy in microservices:
1. Egress allow-list: services can only call approved APIs
2. Audit logging: every outbound call to third parties logged
3. Rate limiting outbound: respect SWIFT API rate limits
4. TLS inspection: verify certificates on outbound calls
Example: Transfer service -> forward proxy -> SWIFT API
Proxy ensures: only SWIFT endpoint is reachable, calls are logged
Visual Overview
Forward Proxy vs Reverse Proxy Forward Proxy (client-side) ┌────────────┐ ┌────────────┐ ┌────────────┐ │ Employee A │─┐ │ Forward │ │ External │ │ Employee B │─┼──►│ Proxy │────►│ Server │ │ Employee C │─┘ │ (egress) │ │ sees proxy │ └────────────┘ └────────────┘ └────────────┘ Hides CLIENTS from servers Reverse Proxy (server-side) ┌────────────┐ ┌────────────┐ ┌────────────┐ │ Customer │────►│ Reverse │─┬──►│ Service A │ │ (sees only │ │ Proxy │ │ │ (hidden) │ │ proxy) │ │ (ingress) │ └──►│ Service B │ └────────────┘ └────────────┘ └────────────┘ Hides SERVERS from clients
Key Takeaway
A forward proxy and a reverse proxy are mirror images. A forward proxy is on the client's side: clients send outbound traffic through it, and the destination server sees the proxy's IP, not the client's. It is used for egress filtering, corporate access control, and anonymity. A reverse proxy is on the server's side: it sits in front of backends, and clients connect to it believing it is the server. It handles TLS termination, load balancing, caching, and routing while hiding the backends entirely.
The cleanest way to tell them apart is to ask whose side the proxy is on and who it hides. A forward proxy hides clients from servers; a reverse proxy hides servers from clients. At National Bank of India, the forward proxy fronted employees for compliance logging, and the reverse proxy fronted the internal services to terminate TLS and route by path.
Nginx or an API gateway placed in front of your services is acting as a reverse proxy. An API gateway is always a specialized reverse proxy because its whole purpose is to front and protect backend APIs. The same software can play either role depending on configuration; the role is defined by position and purpose, not by the product name.
Remember one sentence: a forward proxy fronts clients and hides them from servers for egress control, a reverse proxy fronts servers and hides them from clients for TLS and routing, and Nginx or an API gateway in front of your services is a reverse proxy.
---