Forward proxy vs reverse proxy

9 November 2026

A forward proxy works for the user: you choose it, and websites see its address instead of yours. A reverse proxy works for the website: the site's owner puts it in front of their servers, and visitors believe they are talking to the site itself. The technology is much the same; what differs is whom the intermediary represents.

The definition in the standard

RFC 9110, section 3.7 draws the line clearly. A proxy is a message-forwarding agent chosen by the client, usually through local configuration.

A gateway, also known as a reverse proxy, acts as the origin server toward the client. It then passes requests on to other servers behind it.

The specification also describes a third kind, the interception proxy, commonly called a transparent proxy. It sits where a forward proxy would, but the client never chose it: the network put it in the path.

Forward proxies

A forward proxy sits between the user and the internet. The user or a network administrator configures it in the browser, the operating system or a program. The specification notes that organisations use one to group their staff's requests through a common point for security, annotation and shared caching.

Other common uses:

• Exiting from another country or network to see content as people there see it.
• Keeping the device's own address from websites.
• Collecting public data with scripts, spreading requests across different exit addresses.
• Logging or filtering outgoing traffic inside a company.

It is usually set in browser settings, through a PAC file, or with the HTTP_PROXY and HTTPS_PROXY environment variables that many command-line tools read. The protocol types are explained in What is a proxy.

Reverse proxies

A reverse proxy sits in front of a site's server or group of servers. The visitor configures nothing: the site's own name points to the reverse proxy's address. This is what happens when you open a site that runs behind one:

1. Your browser looks up the site's name in DNS and gets the reverse proxy's address, not the origin server's.
2. The browser negotiates TLS with the reverse proxy, which holds the site's certificate and key.
3. The proxy decrypts and reads the request. It then answers from its cache, blocks the request, or passes it to one of the servers behind it.
4. When it passes the request on, it opens a connection to the origin server and may add headers carrying your real address.
5. The response comes back through the proxy to your browser, possibly compressed or cached on the way.

Typical uses: spreading load over several servers, terminating TLS in one place, caching, protecting applications with a web application firewall, and hiding the origin server's address. A content delivery network (CDN) is, at its core, a large network of reverse proxies.

What the origin server sees

The TCP connection that reaches the origin server comes from the reverse proxy, not the visitor. Server logs therefore record proxy addresses, unless the server is set up to read the visitor's address from somewhere else.

That source is either a header the proxy adds to the HTTP request, covered in the next section, or the PROXY protocol from the HAProxy developers. The latter adds a line at the start of the TCP connection carrying the visitor's address, so it also works for protocols other than HTTP.

Side by side

Headers that intermediaries add

When an intermediary forwards an HTTP request it can read, it may add headers describing the path. A reverse proxy can always do this, since it reads requests after decrypting them. A forward proxy can only do it for unencrypted http:// requests.

• Via: RFC 9110, section 7.6.3 requires proxies to add it, and allows a pseudonym in place of the real host name. The standard's example is Via: 1.0 fred, 1.1 p.example.net.
• X-Forwarded-For: a widely used but non-standard header carrying the client's address followed by the proxies the request passed through.
• Forwarded: the standard replacement, defined in RFC 7239, which carries client, protocol and host in one header.

Here is the example from RFC 7239 of a request that went through two proxies:

Forwarded: for=192.0.2.43, for=198.51.100.17;by=203.0.113.60;proto=http;host=example.com

The standard treats the client address in the for parameter as sensitive, since it can reveal the user, their provider and their rough location. It therefore recommends that the header be off by default, and that a proxy not add it when the user has asked for privacy.

A known security mistake behind reverse proxies

A client can write an X-Forwarded-For header itself. If the application behind the proxy trusts the first address in it, any visitor can claim any address. That lets them slip past rate limits or block lists.

The rule: trust only addresses your own proxies added. Read the header from the end, skip the addresses of your known proxies, and take the first one you do not recognise. Also close direct access to the origin server, so nobody can bypass the proxy entirely.

How to see what is in your path

To find out whether the forward proxy you use reveals your address, open the My IP tool through it. It shows the headers that arrived. If Via, X-Forwarded-For or Forwarded appear with your address in them, the proxy is passing it on to websites.

To find out whether a site sits behind a reverse proxy, ask for its headers:

curl -sI https://example.com/

Look for Server, Via, and cache headers such as Age. Then look up the site's address in the IP lookup tool. If the network (ASN) belongs to a content delivery network, you are talking to a reverse proxy, not to the origin server.

General advice

• For users: a forward proxy that adds your address to a header does not hide it. Test it before relying on it, and use https so it cannot add anything.
• For site owners: list your trusted proxies in the application's settings, and never read the visitor's address from a header the visitor can write.
• For both: any proxy, forward or reverse, sees whatever is not encrypted end to end. A reverse proxy sees even what is, because it holds the site's key.

At syriaproxy

Our service is a forward proxy. You choose it in your program or on your device.

Websites see a mobile address on the Syriatel network inside Syria, shared by many subscribers behind the carrier's NAT. How such an address differs from a server address is covered in Mobile IP vs data center IP.

FAQ

See the headers your browser sends with the free HTTP headers tool, with and without the proxy.