A reverse proxy is a server that intercepts client requests, forwards them to one or more backend servers, and returns the response to the client—all while hiding the backend servers' details from the client.
Unlike a standard proxy (which clients explicitly connect to), a reverse proxy is transparent to the client. The client connects to the reverse proxy's address, believing it's the actual service, while the proxy routes traffic to hidden backend servers. This pattern is foundational to modern infrastructure scaling and security.
How it works
When a client makes a request to example.com, it connects to the reverse proxy listening on that domain. The proxy inspects the request, decides which backend server should handle it (based on load, path, hostname, or other rules), forwards the request, receives the response, and sends it back to the client. The client never learns the backend server's IP address.
Common uses
- Load balancing: Distribute requests across multiple backend servers to prevent overload.
- SSL/TLS termination: Handle HTTPS encryption at the proxy layer, reducing computational load on backends.
- Caching & compression: Store or compress responses before sending to clients.
- Security & hiding: Obscure backend server locations and architectures from the internet.
- Request routing: Direct traffic to different backends based on path, hostname, or other criteria.
Concrete example
You run three backend web servers internally (10.0.1.5, 10.0.1.6, 10.0.1.7). Clients never contact them directly. Instead, they request myapp.example.com, which points to your reverse proxy at 203.0.113.42. The proxy distributes requests round-robin across the three backends, collects responses, and serves them to clients.
TipReverse proxies are distinct from load balancers, though the terms overlap; a load balancer is typically one function a reverse proxy performs.