Short answers
What is the difference between a forward proxy and a reverse proxy?
A forward proxy is chosen by the client and forwards the client’s requests to any site. A reverse proxy is chosen by the site’s operator and receives requests on behalf of that site’s servers. RFC 9110 calls the first a proxy and the second a gateway, also known as a reverse proxy.
What is a forward proxy?
An intermediary that a client is configured to use, through browser or system settings, an environment variable such as HTTPS_PROXY, a PAC file or a network policy. It makes requests to websites on the client’s behalf. For HTTPS it usually opens a CONNECT tunnel, so encryption still runs from the client to the site.
What is a transparent proxy?
A proxy the client did not choose: the network redirects traffic to it, as on some public Wi-Fi and company networks. RFC 9110 calls it an interception proxy. For HTTPS it cannot read the content unless the device trusts a certificate the proxy presents.
Is a CDN a reverse proxy?
For the sites it serves, in practice yes. The site’s hostname points at the CDN, whose edge servers answer visitors and fetch from the origin when they need to. RFC 9110 describes content delivery networks as using gateway caching, its term for reverse-proxy caching.
Why is nginx called a reverse proxy?
nginx is web server software. With a directive such as proxy_pass it forwards the requests it receives to application servers behind it, which is the reverse-proxy role. The same software can also serve files itself, cache responses, balance load and terminate TLS.
Is a VPN a forward proxy?
Not in the HTTP sense. A VPN carries a device’s network traffic through an encrypted tunnel at the IP layer, usually for all applications. A forward proxy handles the connections of applications configured to use it, over HTTP or SOCKS5. Both change the address a website sees.
Two intermediaries, two sides
RFC 9110 defines a proxy as “a message-forwarding agent that is chosen by the client, usually via local configuration rules”. It defines a gateway, “a.k.a. reverse proxy”, as an intermediary that “acts as an origin server for the outbound connection” and forwards requests inbound to other servers. RFC 9110, section 3.7.
A third term matters for HTTPS. A tunnel is a blind relay between two connections. When a forward proxy receives a CONNECT request for an HTTPS site, it normally opens such a tunnel and relays the encrypted bytes without reading them. That is why a forward proxy can carry HTTPS without holding the site’s certificate, while a reverse proxy for that site usually holds it.
Forward proxy vs reverse proxy at a glance
| Question | Forward proxy | Reverse proxy |
|---|---|---|
| Acts for | The client: a person, an application or an organisation’s network | The website or API: its operator and servers |
| Who configures it | The client side: browser or system settings, HTTPS_PROXY, a PAC file or a network administrator | The site operator: the site’s DNS name points at it |
| Does the client know it is there? | Yes for an explicit proxy; not for an interception (transparent) proxy | Usually not: to the client it is the website |
| What the site’s server sees | The proxy’s address, or the exit address it uses, instead of the client’s | Back-end servers see the reverse proxy’s address; visitors see only the reverse proxy |
| Headers it may add | On plain HTTP requests, Via and possibly a forwarding header; none inside an HTTPS tunnel | X-Forwarded-For or Forwarded, so the back end can log the visitor’s address, and often Via |
| HTTPS | A CONNECT tunnel: TLS runs from the client to the site, and the proxy sees only the host and port | Usually terminates TLS with the site’s certificate, then forwards the request |
| Typical examples | An office egress proxy, a proxy gateway for geo-testing, HTTPS_PROXY for command-line tools | nginx in front of an application, a load balancer, a CDN edge server |
| RFC 9110 term | Proxy | Gateway, a.k.a. reverse proxy |
RFC 9110 requires a proxy to add its entry to the Via header field of each message it forwards, and a gateway to do the same on the requests it passes inward. RFC 7239 standardises Forwarded, which carries details such as the original client address; X-Forwarded-For is the older, informal form. A site should trust these headers only from its own front end, because any client can send them.
Transparent and explicit proxies
An explicit proxy is one the client is configured to use, so the client knows it is there and can sign in to it. A transparent proxy, which RFC 9110 calls an interception proxy, is not chosen by the client: the network redirects traffic to it. RFC 9110 notes that these are common on public network access points, to require sign-in before Internet access, and inside company firewalls to enforce usage policy.
On plain HTTP, an interception proxy can read and change requests. On HTTPS it sees the destination name and an encrypted connection, not the content, unless the device trusts a certificate the proxy presents, as some managed company devices do. If certificate warnings appear on one network only, ask its administrator rather than turning verification off.
Older specifications used the word differently. In RFC 2616, a transparent proxy was one that does not modify requests or responses beyond authentication and identification; RFC 9110 calls that a non-transforming proxy. When someone says transparent proxy today, they almost always mean interception.
Where a proxy gateway like Portproof fits
Portproof’s gateway is an explicit forward proxy. Your client is configured with the gateway host and port and signs in with a username and password: HTTP on port 7000, where HTTPS sites use CONNECT, or SOCKS5 on port 7001. Behind the gateway, the connection leaves through a device in the mobile or residential pool, so the destination sees that device’s public address rather than yours or the gateway’s.
The backconnect proxy guide explains how the gateway chooses that exit, and HTTP vs SOCKS5 compares the two protocols. The gateway is not a reverse proxy and sits in front of no website. A request through it reaches a site’s public front end like any other visitor’s, and the site’s terms and rate limits still apply.
Use a forward proxy from a client
A forward proxy is a client setting, so the client names it; in curl that is -x. This command prints two numbers: the proxy’s answer to CONNECT and the site’s answer inside the tunnel.
proxy.example.net:3128 is a placeholder. Replace it with your proxy’s host and port, and add --proxy-user if the proxy needs a sign-in. proxy=200 site=200 means the proxy opened the tunnel and the site answered.
curl --disable -sS -o /dev/null \
-w 'proxy=%{http_connect} site=%{response_code}\n' \
-x http://proxy.example.net:3128 \
https://example.com/With Portproof, use http://gw.portproof.org:7000 and your generated username, as in the curl proxy guide. A reverse proxy needs no client setting: you request the site’s normal address and the operator’s front end receives it.
Typical uses of each
Forward proxy
- Office and school networks that route outbound web traffic through one egress point and apply their policy there.
- QA and geo-testing: checking how a page, price or advert appears from another country or network type.
- Price monitoring and market research that read public pages within each site’s terms.
- Command-line tools, data pipelines and AI agents that need a set route, configured with
HTTPS_PROXYor a client option.
Reverse proxy
- Spreading requests across several application servers, also called load balancing.
- Terminating TLS so the site’s certificate is managed in one place.
- Caching and compressing responses close to visitors, as CDN edge servers do.
- Routing paths to different services and applying rate limits or request filtering in front of them.
Some software can play either role, and RFC 9110 notes that one intermediary can switch between acting as a proxy, gateway or tunnel depending on the request. If you need a forward proxy for authorised testing or monitoring, Portproof sells shared mobile and residential proxy traffic by the GB.
What is not allowed
Use a forward proxy for lawful work such as QA, price monitoring, ad verification and market research, within each site’s terms and rate limits. A proxy does not grant permission to access a website. See the acceptable-use policy.
Read next
Buy mobile and residential proxy GB
Choose your GB or reserve a mobile device.