Is a load balancer different from a reverse proxy?

Short answer

The two concepts overlap but are not the same. A reverse proxy stands in front of the servers, accepts the client's connection on their behalf and forwards the request to the server behind it over its own connection; there may also be a single server behind it. A load balancer, on the other hand, distributes traffic across multiple servers. A load balancer that works by terminating the connection is also a reverse proxy; a load balancer that forwards packets without terminating the connection is not a proxy. In TR7, HTTP and L7 TCP vServices work as a reverse proxy and balance load, while Network vServices distribute without terminating the connection.

Background

The HTTP standard (RFC 9110 §3.7 Intermediaries) divides the intermediaries between the client and the server into three: a proxy is an intermediary that the client selects with its own configuration; a gateway (also known as a reverse proxy) acts as the origin server toward the client and forwards the requests it receives to one or more servers behind it; a tunnel carries data between two connections without touching the messages. A load balancer is not a separate type in this classification; it is the distribution task undertaken by a reverse proxy or by a network device that works without terminating the connection.

How Does It Work?

Reverse proxy (HTTP, L7 TCP)

Client ⇄ TR7 (1st connection)
TR7 ⇄ Backend Service (2nd connection)

TR7 terminates the connection, processes the request and forwards it over its own connection.

Without terminating the connection (Network)

Client ⇄ Backend Service (single connection)
TR7 routes the packets

The connection is not terminated; the content is not read.

• As a reverse proxy, TR7 terminates the connection itself and opens its own connection to the Backend Service (in HTTP, it can also reuse an open connection). Since it can read the request, it can perform TLS termination, content-based routing, header editing, caching and security inspection.
• When working without terminating the connection, TR7 selects the destination on the first packet of the connection and forwards the packets of the same connection to that Backend Service. Since it does not look at the content, latency is at the lowest level, but L7 features are not available.

Comparison

	Reverse proxy	Load balancer
Core task	Standing in front of the servers and accepting requests on their behalf	Distributing traffic across multiple servers
Number of servers behind it	One or more	Multiple
Does it terminate the connection?	Yes	Yes at L7 and when working as a TCP proxy; at L3/L4 it can also distribute without terminating the connection
Prominent functions	TLS termination, cache, compression, header editing	Distribution algorithm, health check, persistence
Client-side setting	Not required; the domain name points to the reverse proxy's address	Not required; the client connects to the load balancer's virtual address
In TR7	HTTP and L7 TCP vService	HTTP, L7 TCP and Network vService

In TR7

vService type	Mode of operation	Terminates the connection	Source IP seen by the Backend Service
HTTP	Reverse proxy + load balancing	Yes	TR7's IP by default; the client's IP is passed with the X-Forwarded-For header or with SNAT → Use Client IP
L7 TCP	Reverse proxy (TCP) + load balancing	Yes	TR7's IP by default; the client's IP is passed with SNAT → Use Client IP or, if the Backend Service supports it, with Proxy (Proxy Protocol)
Network	Load balancing without terminating the connection	No	Depending on the LB Mode: the client's IP in Direct Server Return and Route Mode, the selected SNAT IP in SNAT

With the default SNAT setting (Default), the source address that TR7 uses when connecting to the Backend Service is the Interface IP of the interface that goes to the server in the Backend Service's route table, located in the same subnet as the server (or as the gateway, if the server is reached through a gateway); in a cluster, each device uses its own Interface IP.

Common Misconceptions

• "Every load balancer is a reverse proxy." A load balancer that works without terminating the connection (the Network vService in TR7) is not a proxy; it routes packets.
• "A reverse proxy is used only when there are multiple servers." A reverse proxy also works in front of a single server; functions such as TLS termination and security inspection also apply with a single server.
• "The server behind TR7 already sees the client's IP." In HTTP and L7 TCP vServices, since TR7 establishes the connection, the server sees TR7's IP by default: Why do my backend servers see all requests as coming from TR7's IP?
• "A reverse proxy and a forward proxy are the same thing." A forward proxy stands in front of the clients, a reverse proxy in front of the servers: What is the difference between a Proxy and a Reverse Proxy?

How it is done in the documentation

• vService · How Does It Work?
• vService · Feature / Capability Comparison
• Network vService · LB Mode
• HTTP vService · X-Forwarded-For

Related questions

• What is the difference between a Proxy and a Reverse Proxy?
• What is the difference between L7 TCP and Network (TCP - L4); aren't they both TCP?
• I only have one server; would I benefit from using TR7 Load Balancer?
• Why do my backend servers see all requests as coming from TR7's IP?