What is the difference between a Proxy and a Reverse Proxy?

Short answer

Both are an intermediary that sits between the client and the server; the difference is whom it stands in front of and whom it represents. A proxy (forward proxy) stands in front of the clients and connects to external servers on their behalf; the client selects it with its own setting, while a transparent proxy that intercepts at the network level requires no setting. A reverse proxy stands in front of the servers and accepts the requests coming from clients on their behalf; the client does not see the servers behind it and makes no setting. TR7's HTTP and L7 TCP vServices work as a reverse proxy.

Background

RFC 9110 §3.7 defines these two intermediaries as follows: a proxy is an intermediary that the client selects, usually through local configuration rules, and uses to forward the request; the type that the client has not selected and that intercepts in the network is called an interception or transparent proxy. A gateway (also known as a reverse proxy), on the other hand, acts as the origin server toward the client and forwards the requests it receives to one or more servers behind it.

How Does It Work?

Proxy (forward proxy)

Corporate users → Proxy → Sites on the internet

The sites see the proxy's IP, not the users.

Reverse proxy (TR7)

Internet users → TR7 → Backend Services

The users see TR7's address, not the servers.

• Proxy: The user's request first goes to the proxy; the proxy forwards the request to the target site on its own behalf. The organization inspects, filters and logs the traffic going out to the internet from a single point.
• Reverse proxy: The user thinks the connection is made to the site's address; this address actually belongs to the reverse proxy. The reverse proxy forwards the request to the appropriate server behind it and returns the response to the user.

Comparison

	Proxy (forward proxy)	Reverse proxy
Whom it stands in front of	The clients	The servers
Whom it represents	The clients	The servers
What it hides	The clients' IP addresses	The servers' addresses and their number
Client-side setting	Browser / operating system proxy setting; a transparent (interception) proxy requires no setting	Not required; the domain name points to the reverse proxy's address
Typical use	Internet access control, web filtering, logging outbound traffic	Load balancing, TLS termination, cache, application security

In TR7

TR7's HTTP and L7 TCP vServices work as a reverse proxy; Network vServices are not a proxy because they do not terminate the connection. When there are other proxies around TR7, the following points are taken into account:

Situation	Effect	Solution
There is a CDN or another reverse proxy in front of TR7	TR7 sees the IP of that layer, not the client's	In the HTTP vService, the real client IP is resolved from the header with the Trusted Proxies profile
The clients are behind a corporate forward proxy or NAT	Many users come to TR7 from a single IP	Source IP based persistence, the algorithm and Source IP conditions are planned accordingly; in HTTP, cookie-based persistence is preferred
The Backend Service behind TR7	The Backend Service sees TR7's IP, not the client's	The client IP is passed with the X-Forwarded-For header in HTTP, and with SNAT → Use Client IP in HTTP and L7 TCP

Common Misconceptions

• "A proxy and a reverse proxy are the same thing." A proxy represents the clients, a reverse proxy represents the servers; their purposes of use and their locations are different.
• "For a reverse proxy, the users' browser settings change." They do not change. The domain name is directed to the reverse proxy's address; the user does not notice that a layer has been inserted in between.
• "When there is a CDN in front, TR7 sees the real client IP on its own." It does not; for the IP in the header added by the CDN to be used, a Trusted Proxies profile is defined and selected in the vService.

How it is done in the documentation

• Trusted Proxies · What Is the Trusted Proxies Profile?
• HTTP vService · X-Forwarded-For
• Backend Services · Use Client IP
• vService · How Does It Work?

Related questions

• Is a load balancer different from a reverse proxy?
• There is a CDN such as Cloudflare / Akamai in front of TR7; how do I get the Real client IP (trusted proxy)?
• All users coming from behind a corporate NAT go to a single server; why?
• Why do my backend servers see all requests as coming from TR7's IP?