--- title: What Is a Reverse Proxy? Reverse vs Forward Proxy description: Learn what is a reverse proxy, how it works, and the difference between a reverse proxy vs forward proxy and proxy types. image: https://blog.blazingcdn.com/hubfs/Gemini-Blog/image-Nov-01-2026-05-20-39-5216-PM.jpeg --- [![BlazingCDN](https://blog.blazingcdn.com/hubfs/Logo/blog-logo-w.png)](https://blog.blazingcdn.com?hsLang=en-us) [๐Ÿ“˜Learn โ–พ](https://blog.blazingcdn.com/cdn-learn?hsLang=en-us) [CDN Fundamentals](https://blog.blazingcdn.com/cdn-fundamentals?hsLang=en-us) [By Content Type](https://blog.blazingcdn.com/by-content-type?hsLang=en-us) [Advanced Concepts](https://blog.blazingcdn.com/advanced-concepts?hsLang=en-us) [Glossary](https://blog.blazingcdn.com/glossary?hsLang=en-us) [โšก Web Performance](https://blog.blazingcdn.com/web-performance?hsLang=en-us) [๐ŸŽฌVideo & Streaming โ–พ](https://blog.blazingcdn.com/video-streaming-cdn?hsLang=en-us) [๐Ÿ”ด Live Streaming](https://blog.blazingcdn.com/live-streaming?hsLang=en-us) [๐Ÿ“บ VOD & OTT](https://blog.blazingcdn.com/vod-ott?hsLang=en-us) [๐Ÿ’ฐ Bandwidth & Costs](https://blog.blazingcdn.com/bandwidth-costs?hsLang=en-us) [๐Ÿญ Other Industries โ–พ](https://blog.blazingcdn.com/cdn-industry-insights?hsLang=en-us) [๐Ÿ“บ Media & Broadcasting](https://blog.blazingcdn.com/media-broadcasting?hsLang=en-us) [๐Ÿ’พ Software & SaaS](https://blog.blazingcdn.com/software-saas?hsLang=en-us) [๐Ÿ—๏ธ DevOps & Cloud Infra](https://blog.blazingcdn.com/devops-cloud-infra?hsLang=en-us) [๐Ÿ“š AdTech & Advertising](https://blog.blazingcdn.com/adtech-advertising?hsLang=en-us) [๐ŸŽฎ Gaming & Esports](https://blog.blazingcdn.com/gaming-esports?hsLang=en-us) [๐Ÿ“ฑ Mobile Apps & Developers](https://blog.blazingcdn.com/mobile-apps-developers?hsLang=en-us) [๐Ÿค– AI & Machine Learning](https://blog.blazingcdn.com/ai-machine-learning?hsLang=en-us) [๐Ÿ›๏ธ Enterprise & Corporate](https://blog.blazingcdn.com/enterprise-corporate?hsLang=en-us) [๐Ÿ“š E-Learning & EdTech](https://blog.blazingcdn.com/e-learning-edtech?hsLang=en-us) [๐ŸŸ๏ธ Sports & Live Events](https://blog.blazingcdn.com/sports-live-events?hsLang=en-us) [๐Ÿ’ฐ Pricing & Costs โ–พ](https://blog.blazingcdn.com/cdn-pricing-and-cdn-costs?hsLang=en-us) [Provider Pricing](https://blog.blazingcdn.com/provider-pricing?hsLang=en-us) [Cost Optimization](https://blog.blazingcdn.com/cost-optimization?hsLang=en-us) [Decision Support](https://blog.blazingcdn.com/decision-support?hsLang=en-us) [โšกCompare โ–พ](https://blog.blazingcdn.com/cdn-comparison?hsLang=en-us) [Provider Comparisons](https://blog.blazingcdn.com/provider-comparisons?hsLang=en-us) [Strategy Comparisons](https://blog.blazingcdn.com/strategy-comparisons?hsLang=en-us) [Ratings & Benchmarks](https://blog.blazingcdn.com/cdn-ratings-and-benchmarks?hsLang=en-us) [๐Ÿ“Š Benchmarks](https://blog.blazingcdn.com/cdn-ratings-and-benchmarks?hsLang=en-us) [๐Ÿ”’ Security โ–พ](https://blog.blazingcdn.com/cdn-security?hsLang=en-us) [Attack Protection](https://blog.blazingcdn.com/attack-protection?hsLang=en-us) [Encryption & Access](https://blog.blazingcdn.com/encryption-access?hsLang=en-us) [Video & DRM Security](https://blog.blazingcdn.com/video-drm-security?hsLang=en-us) [๐Ÿ“ Case Studies](https://blog.blazingcdn.com/case-studies?hsLang=en-us) [๐Ÿ”Œ Integrations](https://blog.blazingcdn.com/integrations?hsLang=en-us) [๐Ÿ› ๏ธ Tools](https://blog.blazingcdn.com/cdn-tools?hsLang=en-us) [Get Started](https://blazingcdn.com/sign-up-contact-form/) [Learn](https://blog.blazingcdn.com/en-us/tag/learn) [Learn - CDN Fundamentals](https://blog.blazingcdn.com/en-us/tag/learn-cdn-fundamentals) # What Is a Reverse Proxy? Reverse vs Forward Proxy Vadym Borovskyi Nov 1, 2026, 6:22:17โ€ฏPM ![](https://blog.blazingcdn.com/hubfs/Gemini-Blog/image-Nov-01-2026-05-20-39-5216-PM.jpeg) A **reverse proxy** is a server that sits in front of one or more origin servers, accepts client connections on their behalf, and forwards each request inward over a separate connection. Clients see one address. The origin sees only the proxy. Every request therefore crosses two independent connections, and the proxy controls routing, caching, TLS termination and header rewriting between them. HTTP Semantics (RFC 9110, published 2022) formally calls a reverse proxy a "gateway": an intermediary that acts as the origin server for the client while forwarding requests to one or more servers behind it. A forward proxy is the mirror image. It acts for the client, and the server sees the proxy. As of 2026, CDNs, load balancers, API gateways and HTTP caches all work as reverse proxies. ## **How a reverse proxy handles a request, step by step** A reverse proxy completes the client's connection and TLS handshake itself, decides what to do with the request, and opens or reuses a separate upstream connection only when it needs the origin. Because the two legs are independent, the proxy can serve from cache, retry, or reroute without the client ever seeing the backend topology. 1. **Resolve and connect.** DNS for the public hostname points at the proxy, often through Anycast or GeoDNS. The client opens TCP or QUIC to the proxy, not to the origin. 2. **Terminate TLS.** The proxy holds the certificate and private key for the public name, completes the handshake, and reads the decrypted HTTP request. 3. **Route.** The proxy matches host, path, headers or cookies against its rules and selects an upstream pool. A load-balancing algorithm (round robin, least connections, consistent hashing) picks one member. 4. **Check the cache.** If caching is enabled and a fresh object exists under the computed cache key, the proxy answers immediately. The origin never sees the request. 5. **Forward upstream.** On a miss, the proxy rewrites headers (Host, Forwarded or X-Forwarded-For, X-Forwarded-Proto) and sends the request over a pooled, kept-alive upstream connection, often re-encrypted with a separate certificate. 6. **Return and store.** The response streams back to the client. If Cache-Control allows it, the proxy stores a copy and stamps an Age header on later hits. The state that matters lives in three places: the client connection table, the upstream connection pool, and the cache index. Most production incidents involving a reverse proxy trace back to one of them, through exhausted upstream keepalives, a cache key that varies on the wrong header, or a health check that marks every pool member down at once. ## **Reverse proxy vs forward proxy: who the proxy works for** The difference between a forward proxy and a reverse proxy is whose interests the proxy represents. A forward proxy is configured by or for the client and hides clients from servers. A reverse proxy is deployed by the site operator and hides servers from clients. The software can be identical. Only the deployment position and trust model differ. | Dimension | Forward proxy | Reverse proxy | | --- | --- | --- | | Operated by | Client side (corporate IT, ISP, user) | Server side (site operator, CDN) | | Client awareness | Explicitly configured, or intercepted transparently | Invisible; the client believes it reached the origin | | Destinations | Any host on the internet | A fixed set of upstreams it fronts | | HTTPS handling | CONNECT tunnel, or TLS interception with a private CA trusted by clients | Terminates TLS with the site's own public certificate | | Typical jobs | Egress filtering, auditing, shared caching for a user population | Load balancing, caching, TLS offload, origin shielding, rate limiting | The decisive test is the certificate: a reverse proxy presents the site's own public certificate, while a forward proxy either tunnels the client's TLS untouched or needs a private CA installed on every client. ## **Why CDNs, load balancers and caches are all reverse proxies** Strip away the product names and a load balancer, a cache and a CDN edge node perform the same act: terminate the client connection, then decide whether and where to forward. They differ only in which decision they optimize. A load balancer optimizes the choice of upstream, a cache optimizes avoiding the upstream entirely, and a CDN distributes that cache geographically and stacks it in tiers. Stacking is where the reverse proxy model pays off, and the arithmetic is worth doing. Take 10,000 requests per second at the edge with a 95% hit ratio: 500 requests per second miss. Without a second tier, all 500 reach the origin. Put an origin shield (a mid-tier reverse proxy) between edge and origin, and if that shield hits 80% of edge misses, origin load drops to 100 requests per second, a 100x reduction from the edge rate. Request coalescing tightens it further. When a popular object expires on 50 edge nodes at once, an uncoalesced setup can send up to 50 simultaneous fills, while a shield with coalescing sends one and holds the other 49 until it returns. The [**BlazingCDN Anycast CDN**](https://blazingcdn.com/anycast-cdn/) is a pull-caching reverse proxy of this shape, with origin shield and request coalescing included on every plan rather than added as a separate tier. ## **Reverse proxy vs load balancer, API gateway and CDN** **Reverse proxy vs. load balancer:** Every Layer 7 load balancer is a reverse proxy, but not every reverse proxy balances load. A Layer 4 load balancer that forwards packets without terminating the connection (direct server return, IPVS) is not a reverse proxy in the HTTP sense, because the backend still owns the client's TCP session. **Reverse proxy vs. API gateway:** An API gateway is a reverse proxy specialized for API traffic. It adds authentication, per-consumer quotas, request transformation and versioned routing. The forwarding core is the same, and most gateways are built on general-purpose proxies such as Envoy or nginx. **Reverse proxy vs. CDN:** A CDN is a geographically distributed fleet of caching reverse proxies run as a service, usually arranged in edge and shield tiers. A single nginx in front of your app is a reverse proxy. Hundreds of them close to users, sharing cache hierarchy and routing, form a CDN. ## **A minimal reverse proxy configuration, explained** In nginx, a working caching reverse proxy needs five decisions, each a single directive. First, an upstream block names the backend servers and enables keepalive so the proxy reuses connections instead of opening one per request. Second, a location block uses proxy\_pass to point at that upstream. Third, proxy\_set\_header rewrites Host to the name the origin expects, and sets X-Forwarded-For from nginx's built-in proxy\_add\_x\_forwarded\_for variable so the origin can still log the real client address. Fourth, proxy\_http\_version must be set to 1.1 with the Connection header cleared, or upstream keepalive silently stays off. Fifth, proxy\_cache\_path and proxy\_cache define the on-disk cache and its key. The standardized alternative to X-Forwarded-For is the Forwarded header from RFC 7239. A typical value reads: for=203.0.113.7;proto=https;by=edge-fra-01. On the origin side, configure an explicit list of trusted proxy addresses and only read client identity from entries those proxies appended. ## **Common reverse proxy misconceptions** - **"A reverse proxy hides the origin."** Only if the origin firewall accepts traffic exclusively from the proxy's address ranges. Historical DNS records and certificate transparency logs often expose the real IP. - **"X-Forwarded-For tells you the client IP."** Clients can send their own value. Only the entries appended by proxies you control are trustworthy, read from the right. - **"An extra hop always adds latency."** Terminating TLS 1.3 near the user moves the setup round trips onto a short path. At 80 ms to a distant origin versus 10 ms to a nearby proxy, two setup round trips cost 160 ms direct and about 20 ms at the edge, before any cache hit. - **"Forward proxy and reverse proxy are different products."** Squid, nginx, HAProxy and Envoy can each run as either. The role comes from deployment, not the binary. ## **FAQ: reverse proxy basics and the proxy vs reverse proxy question** ### What is a reverse proxy used for? A reverse proxy is used to load balance traffic across backends, cache responses, terminate TLS, and shield origin servers from direct client traffic. Operators also use it for rate limiting, header normalization, compression and gradual rollouts, because every request passes through one controllable point before reaching the application, which makes policy changes possible without touching backend code. ### Is a CDN a reverse proxy? Yes, a CDN is a distributed network of caching reverse proxies. Each edge node terminates the client connection, serves cached objects when it can, and forwards misses to a shield tier or the origin. The CDN presents the site's own certificate and hostname, so clients never connect to the origin directly unless the operator allows it. ### Is a load balancer the same as a reverse proxy? A Layer 7 load balancer is a reverse proxy, but a Layer 4 load balancer usually is not. Layer 7 devices terminate HTTP and make routing decisions on request content. Layer 4 devices forward connections or packets based on addresses and ports, leaving the TCP session and TLS handshake to the backend server, so they cannot cache or rewrite headers. ### What is the main difference between a proxy and reverse proxy? A forward proxy acts for clients and hides them from servers, while a reverse proxy acts for servers and hides them from clients. In practice the forward proxy is configured on the client side for egress control, and the reverse proxy is deployed by the site operator in front of its origins with the site's public certificate. ## **Audit your reverse proxy layer this week** Pull one hour of logs and compute the ratio of requests at your outermost reverse proxy to requests that reached the origin. If that ratio is below 20:1 for static content, inspect the cache key for stray Vary headers, cookies or query strings first. Then confirm two security basics: the origin firewall rejects anything not from your proxy ranges, and your application reads client identity only from entries added by trusted proxies. Finally, check the Age header on a few hot objects to confirm hits really come from cache. If your heavy static traffic would benefit from an outer caching tier, the [**BlazingCDN feature list**](https://blazingcdn.com/features/) shows what is included on every plan, from origin shield and request coalescing to purge, signed URLs and Prometheus metrics. Share: [f](https://www.facebook.com/sharer/sharer.php?u=https://blog.blazingcdn.com/en-us/what-is-a-reverse-proxy-reverse-vs-forward-proxy) [in](https://www.linkedin.com/sharing/share-offsite/?url=https://blog.blazingcdn.com/en-us/what-is-a-reverse-proxy-reverse-vs-forward-proxy) [๐•](https://twitter.com/intent/tweet?url=https://blog.blazingcdn.com/en-us/what-is-a-reverse-proxy-reverse-vs-forward-proxy&text=) [โœ‰](mailto:?subject=%3Cspan%20id="hs_cos_wrapper_name"%20class="hs_cos_wrapper%20hs_cos_wrapper_meta_field%20hs_cos_wrapper_type_text"%20style=""%20data-hs-cos-general-type="meta_field"%20data-hs-cos-type="text"%20%3EWhat%20Is%20a%20Reverse%20Proxy?%20Reverse%20vs%20Forward%20Proxy%3C/span%3E&body=https://blog.blazingcdn.com/en-us/what-is-a-reverse-proxy-reverse-vs-forward-proxy) ![BlazingCDN](https://blog.blazingcdn.com/hs-fs/hubfs/Logo/blog-logo-w.png?height=24&name=blog-logo-w.png) *Heavy traffic.* Light bill. The CDN for video and large traffic Their monthly bill vs ours - 20 TBFastly $2,087**$92.50** - 50 TBCDN77 $990**$215** - 200 TBCloudFront $11,965**$765** Published list prices, Aug 2026 [Calculate your cost](https://blazingcdn.com/cdn-cost-calculator/?utm_source=blog&utm_medium=sidebar&utm_campaign=blog_sidebar&utm_content=compare_calc) ## Related posts [![](https://blog.blazingcdn.com/hubfs/Gemini-Blog/image-Nov-01-2026-04-55-14-9690-PM.jpeg)](https://blog.blazingcdn.com/en-us/amazon-cloudfront-cdn-walkthrough-cache-invalidation-waf-rules?hsLang=en-us) Learn ### [CloudFront Cache Invalidation: Paths, Wildcards and Costs](https://blog.blazingcdn.com/en-us/amazon-cloudfront-cdn-walkthrough-cache-invalidation-waf-rules?hsLang=en-us) A CloudFront invalidation removes cached objects from every Amazon CloudFront cache layer before their TTL expires. As ... Nov 1, 2026, 5:58:23โ€ฏPM [Read more](https://blog.blazingcdn.com/en-us/amazon-cloudfront-cdn-walkthrough-cache-invalidation-waf-rules?hsLang=en-us) [![](https://blog.blazingcdn.com/hubfs/Gemini-Blog/image-Nov-01-2026-04-25-12-2357-PM.jpeg)](https://blog.blazingcdn.com/en-us/how-youtube-cdn-works?hsLang=en-us) Learn ### [How YouTube's CDN Works: Google Global Cache and Video Delivery](https://blog.blazingcdn.com/en-us/how-youtube-cdn-works?hsLang=en-us) The YouTube CDN is Google's own delivery network, and its most important tier sits inside other companies' networks. ... Nov 1, 2026, 5:27:18โ€ฏPM [Read more](https://blog.blazingcdn.com/en-us/how-youtube-cdn-works?hsLang=en-us) [![BlazingCDN](https://blog.blazingcdn.com/hubfs/Logo/blog-logo-w.png)](https://blog.blazingcdn.com?hsLang=en-us) [๐Ÿ“˜ Learn](https://blog.blazingcdn.com/cdn-learn?hsLang=en-us) [๐Ÿ“Š Benchmarks](https://blog.blazingcdn.com/cdn-ratings-and-benchmarks?hsLang=en-us) [๐ŸŽฌ Video & Streaming](https://blog.blazingcdn.com/video-streaming-cdn?hsLang=en-us) [๐Ÿญ Industries](https://blog.blazingcdn.com/cdn-industry-insights?hsLang=en-us) [๐Ÿ’ฐ Pricing & Costs](https://blog.blazingcdn.com/cdn-pricing-and-cdn-costs?hsLang=en-us) [โšก Compare](https://blog.blazingcdn.com/cdn-comparison?hsLang=en-us) [๐Ÿ”’ Security](https://blog.blazingcdn.com/cdn-security?hsLang=en-us) [๐Ÿ› ๏ธ Tools](https://blog.blazingcdn.com/cdn-tools?hsLang=en-us) [โœ๏ธ Publish with us](https://blog.blazingcdn.com/publish-with-us?hsLang=en-us) in f ๐• โœ‰ Copyright ยฉ BlazingCDN |. All rights reserved. ```json { "@context" : "https://schema.org", "@id" : "https://blazingcdn.com/#organization", "@type" : "Organization", "description" : "High-volume CDN for video, live streaming, OTT/IPTV, software, games, SaaS and large-file delivery.", "logo" : { "@id" : "https://blazingcdn.com/#logo", "@type" : "ImageObject", "height" : 560, "url" : "https://blazingcdn.com/wp-content/uploads/2024/08/logo-560-560.png", "width" : 560 }, "name" : "BlazingCDN", "sameAs" : [ "https://www.linkedin.com/company/blazingcdn", "https://x.com/BlazingCdn", "https://www.reddit.com/r/BlazingCDN/", "https://www.wikidata.org/wiki/Q141711074" ], "url" : "https://blazingcdn.com/" } ``` ```json { "@context" : "https://schema.org", "@id" : "https://blog.blazingcdn.com/#website", "@type" : "WebSite", "inLanguage" : "en-US", "name" : "BlazingCDN Blog", "publisher" : { "@id" : "https://blazingcdn.com/#organization" }, "url" : "https://blog.blazingcdn.com/" } ``` ```json { "@context" : "https://schema.org", "@id" : "https://blog.blazingcdn.com/en-us/what-is-a-reverse-proxy-reverse-vs-forward-proxy#article", "@type" : "BlogPosting", "author" : { "@id" : "https://blog.blazingcdn.com/en-us/author/blazingcdn#person", "@type" : "Person", "description" : "Vadym Borovskyi is Chief Product and Marketing Officer at BlazingCDN, where he has led product strategy and growth since 2021. He has more than 11 years of experience in IT product management and B2B marketing. On this blog he writes about CDN pricing and egress costs, video and software delivery, cache configuration, and how teams evaluate and switch CDN providers. He is based in Warsaw, Poland.", "image" : "https://143144902.fs1.hubspotusercontent-eu1.net/hubfs/143144902/vadym-borovskyi.jpg", "jobTitle" : "Chief Product and Marketing Officer", "knowsAbout" : [ "Content Delivery Networks (CDN)", "CDN pricing", "Video streaming delivery", "Software and game distribution", "Cache optimization", "Product Management", "B2B Marketing", "Digital Marketing", "Pay Per Click Marketing (PPC)", "Google Ads", "Search Engine Marketing (SEM)", "Marketing Strategy", "Artificial Intelligence (AI)", "Cloud Management", "SaaS Development", "IT Consulting", "Computer Networking", "Project Management", "Startups" ], "name" : "Vadym Borovskyi", "sameAs" : [ "https://www.linkedin.com/in/axelt/" ], "url" : "https://blog.blazingcdn.com/en-us/author/blazingcdn", "worksFor" : { "@id" : "https://blazingcdn.com/#organization" } }, "dateModified" : "2026-11-01T17:22:17Z", "datePublished" : "2026-11-01T17:22:17Z", "description" : "Learn what is a reverse proxy, how it works, and the difference between a reverse proxy vs forward proxy and proxy types.", "headline" : "What Is a Reverse Proxy? Reverse vs Forward Proxy", "image" : "https://143144902.fs1.hubspotusercontent-eu1.net/hubfs/143144902/Gemini-Blog/image-Nov-01-2026-05-20-39-5216-PM.jpeg", "inLanguage" : "en-us", "isPartOf" : { "@id" : "https://blog.blazingcdn.com/#website" }, "mainEntityOfPage" : { "@id" : "https://blog.blazingcdn.com/en-us/what-is-a-reverse-proxy-reverse-vs-forward-proxy", "@type" : "WebPage" }, "publisher" : { "@id" : "https://blazingcdn.com/#organization" }, "wordCount" : 1733 } ``` ```json { "@context" : "https://schema.org", "@id" : "https://blog.blazingcdn.com/en-us/what-is-a-reverse-proxy-reverse-vs-forward-proxy#breadcrumb", "@type" : "BreadcrumbList", "itemListElement" : [ { "@type" : "ListItem", "item" : "https://blog.blazingcdn.com/en-us", "name" : "Blog", "position" : 1 }, { "@type" : "ListItem", "item" : "https://blog.blazingcdn.com/en-us/what-is-a-reverse-proxy-reverse-vs-forward-proxy", "name" : "What Is a Reverse Proxy? Reverse vs Forward Proxy", "position" : 2 } ] } ``` ```json { "@context" : "https://schema.org", "@id" : "https://blog.blazingcdn.com/en-us/what-is-a-reverse-proxy-reverse-vs-forward-proxy#faq", "@type" : "FAQPage", "mainEntity" : [ { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "A reverse proxy is used to load balance traffic across backends, cache responses, terminate TLS, and shield origin servers from direct client traffic. Operators also use it for rate limiting, header normalization, compression and gradual rollouts, because every request passes through one controllable point before reaching the application, which makes policy changes possible without touching backend code." }, "name" : "What is a reverse proxy used for?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Yes, a CDN is a distributed network of caching reverse proxies. Each edge node terminates the client connection, serves cached objects when it can, and forwards misses to a shield tier or the origin. The CDN presents the site's own certificate and hostname, so clients never connect to the origin directly unless the operator allows it." }, "name" : "Is a CDN a reverse proxy?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "A Layer 7 load balancer is a reverse proxy, but a Layer 4 load balancer usually is not. Layer 7 devices terminate HTTP and make routing decisions on request content. Layer 4 devices forward connections or packets based on addresses and ports, leaving the TCP session and TLS handshake to the backend server, so they cannot cache or rewrite headers." }, "name" : "Is a load balancer the same as a reverse proxy?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "A forward proxy acts for clients and hides them from servers, while a reverse proxy acts for servers and hides them from clients. In practice the forward proxy is configured on the client side for egress control, and the reverse proxy is deployed by the site operator in front of its origins with the site's public certificate." }, "name" : "What is the main difference between a proxy and reverse proxy?" } ] } ```