What Is a Proxy Server? Types and How They Work

What is a proxy server? A proxy server is an intermediary that accepts a client's request, applies policy, and then either answers from its own state or forwards the request to the destination over a second, separate connection. Client and server never share a TCP session, so the proxy can read, rewrite, cache, log or block what passes between them.

As of 2026, proxy behavior on the web is governed by RFC 9110 (published 2022). It defines the CONNECT method that tunnels HTTPS through a forward proxy and the 407 Proxy Authentication Required status a proxy returns when credentials are missing. The four working types are forward, reverse, transparent and caching proxies, and a CDN is a reverse caching proxy deployed in hundreds of locations at once.

How a proxy server works: two connections and one policy point

A proxy server works by splitting one logical exchange into two connections. The client connects to the proxy, either because it was configured to or because the network intercepted it. The proxy parses the request, checks policy (authentication, access lists, cache), and on a miss sends the request upstream over its own connection before streaming the response back.

The interesting parts are state and timing. A production proxy keeps a pool of warm upstream connections, so a client paying a fresh TCP and TLS handshake to the proxy does not force a fresh handshake to the origin. A caching proxy also keeps objects keyed on method, URI and any request headers named in Vary. It judges freshness from Cache-Control max-age or s-maxage and reports an object's time in cache through the Age header.

Proxies also leave fingerprints. They append themselves to the Via header and record the client address in X-Forwarded-For, or in the standardized Forwarded header defined by RFC 7239. Each proxy that touches the request adds an entry. Counting those entries in origin logs is the quickest way to learn how many layers sit in front of you.

HTTPS changes what a proxy can see. A forward proxy receives a CONNECT request naming a host and port 443, replies 200, and then relays opaque bytes: it sees the hostname and byte counts, not URLs or content. Inspecting traffic requires TLS interception with a root certificate installed on every client. A reverse proxy holds the site's own certificate, so it sees plaintext by design.

Types of proxy servers: forward, reverse, transparent and caching

Forward proxy

A forward proxy acts on behalf of clients. Corporate egress gateways, school filters and outbound allow-lists for build servers are forward proxies. Clients find them through explicit settings, environment variables or a proxy auto-config (PAC) file, and the proxy enforces who may reach which destinations.

Reverse proxy

A reverse proxy acts on behalf of servers. Clients believe they are talking to the origin, while the proxy terminates TLS, routes by host and path, balances load, compresses responses and absorbs connection churn. nginx, HAProxy, Envoy and Varnish are the common software choices.

Transparent proxy

A transparent proxy intercepts traffic without client configuration, typically through policy routing or the Linux TPROXY feature. ISPs and captive portals use it. Because clients are unaware, it cannot request authentication with a 407, and for HTTPS it sees only the Server Name Indication (SNI) unless it breaks TLS.

Caching proxy

A caching proxy stores responses and serves repeats locally. Caching is a function rather than a deployment position: Squid is a classic forward caching proxy, while Varnish and every CDN edge are reverse caching proxies.

The deciding property is who holds the TLS keys, because only a proxy that terminates TLS can cache, rewrite or inspect HTTPS content.

How a CDN acts as a global reverse proxy

A CDN is a reverse caching proxy replicated across many locations. Anycast or DNS steering sends each user to a nearby edge, which terminates TLS, serves cached objects and forwards misses toward the origin. To the browser, the edge is the website. To the origin, the CDN is a small set of well-behaved clients.

Two pieces of arithmetic explain why this works. First, origin load scales with the miss ratio, not the hit ratio: moving from a 90% to a 96% hit ratio drops origin requests from 10 to 4 per 100, a 60% cut. Second, a TLS 1.3 handshake plus first request costs about 2 round trips. At 150 ms to a distant origin that is roughly 300 ms; at 20 ms to an edge it is about 40 ms, and misses travel over the edge's already-warm upstream connection.

Origin shield and request coalescing stack a second proxy tier on top: misses from all edges funnel through one shield, and concurrent misses for the same object collapse into a single upstream fetch. BlazingCDN's Anycast CDN, for example, runs as this kind of pull-caching reverse proxy with origin shield and request coalescing included on every plan.

Proxy server vs. VPN, load balancer and NAT gateway

Proxy server vs. VPN: a VPN tunnels all IP traffic from a device at the network layer, while a proxy handles specific application protocols and understands their semantics. A proxy can cache an HTTP response or return a 407; a VPN only moves packets.

Proxy server vs. load balancer: a layer 7 load balancer is a reverse proxy whose main job is distributing requests across backends. A layer 4 load balancer forwards TCP or UDP flows without parsing HTTP, so it cannot cache or route by path.

Proxy server vs. NAT gateway: NAT rewrites packet addresses within a single connection, while a proxy terminates the connection and opens a new one. That split is why a proxy can inject headers and a NAT gateway cannot.

Example: an nginx reverse caching proxy, directive by directive

A minimal production reverse caching proxy in nginx needs seven directives. They are described here in words; each is a real nginx directive.

• proxy_cache_path declares the on-disk cache, a shared memory zone for keys, a max_size and an inactive timeout.
• proxy_pass points the location at an upstream group of origin servers.
• proxy_cache_valid set to cache 200 responses for 10 minutes when the origin sends no Cache-Control.
• proxy_cache_lock set to on, so concurrent misses for one key wait for a single upstream fetch (request coalescing).
• proxy_cache_use_stale with error, timeout and updating, so the proxy serves stale objects during origin trouble.
• proxy_set_header passing X-Forwarded-For and the original Host to the origin.
• add_header exposing the built-in upstream_cache_status variable, which reports HIT, MISS, EXPIRED or STALE for each response.

The cache status header is the one to keep: without it you cannot measure hit ratio per path.

Common proxy server misconceptions

"A proxy makes you anonymous." Many forward proxies append your address to X-Forwarded-For, and destinations log it. Anonymity depends on the proxy stripping those headers and on the operator's logging, not on the proxy existing.

"A reverse proxy always adds latency." It adds one hop, but the handshake arithmetic above shows a nearby proxy usually removes more round trips than it adds.

"A transparent proxy can cache HTTPS." Without breaking TLS it sees only SNI, so it cannot cache, filter by URL or read content.

FAQ: what is a proxy server and which type do you need

What is the difference between a forward proxy server and a reverse proxy server?

A forward proxy server acts for clients and controls what they can reach; a reverse proxy server acts for servers and controls how they are reached. Clients configure forward proxies explicitly, while reverse proxies are invisible and present the site's own hostname and certificate. Corporate egress gateways are forward proxies, and CDN edges are reverse proxies.

Can a proxy server see HTTPS traffic?

A proxy server sees HTTPS content only if it terminates TLS. A reverse proxy holds the site certificate and sees plaintext. A forward proxy handling a CONNECT tunnel sees only the hostname, port and byte counts, unless it performs TLS interception with a root certificate installed on every client device, which many applications with certificate pinning reject outright.

Is a reverse proxy server the same as a load balancer?

A layer 7 load balancer is a type of reverse proxy server specialized in spreading requests across backends. Reverse proxies also terminate TLS, cache, compress and rewrite headers. A layer 4 load balancer is different: it forwards TCP or UDP flows without parsing HTTP, so it cannot cache responses or route by URL path.

Does a proxy server hide my IP address?

A proxy server hides your IP address from the destination only if it does not forward it. Many proxies add the client address to X-Forwarded-For or the Forwarded header defined in RFC 7239, and destinations log those values. A proxy configured to strip identifying headers changes the visible source address, but the proxy operator still sees everything.

Audit the proxy hops in front of your origin this week

Pick one popular asset and request it twice with your usual HTTP client, comparing Via, Age and the cache status header between the two responses. Then sample an hour of origin logs and count entries in X-Forwarded-For: each extra entry is a proxy layer, and requests with a single entry are bypassing your cache tier. Compute miss ratio per path, since that number, not hit ratio, sets origin load and egress.

If that audit shows heavy static files reaching the origin, the BlazingCDN features page lists the reverse proxy controls included on every plan, from origin shield and request coalescing to purge and Prometheus metrics.