Whose side it stands on
| Type | Represents | Typical use |
|---|---|---|
| Forward | Client | Exit via firewall, egress from intranet, cache |
| Reverse | Server | Load balance, TLS termination, hide backends |
Forward proxy
The client is configured to send all outbound requests to it first; the proxy then fetches the resource. The user knows a proxy is in use, often to reach restricted content or unify egress.
Reverse proxy
It sits in front of the server: one public address that dispatches to several backends. Users never see the backends. Nginx, API gateways and CDN edges are reverse proxies.
What it also does
- TLS termination: decrypt at the proxy so backends talk plaintext internally and save CPU;
- Load balance: spread traffic across instances;
- Security headers and rate limits: handled centrally at the edge.