Forward Proxy vs Reverse Proxy: Differences and Use Cases
Updated:
A reverse proxy is a server that sits in front of one or more web servers, receives requests from users, passes them to the servers behind it and returns the response as if it were the website itself. Visitors only see the reverse proxy and never learn where the real servers are. Nginx, HAProxy, Caddy and CDN services are commonly used this way for load balancing, HTTPS termination, caching and shielding the origin. A forward proxy, the kind you buy to change your IP, sits on the user's side instead: it represents you on the internet, and websites see the proxy's IP. In short, a forward proxy hides the user, a reverse proxy hides the server. This guide explains both, shows an nginx example and clarifies who needs which.
Forward proxy: acting for the user
A forward proxy sits between your device and the internet. You configure a browser or app to send requests through it, and the proxy connects to websites on your behalf. Sites see the proxy's IP, not yours. This is the type covered by most articles on this site, from what a proxy is to our pieces on IPv4 and ISP proxies.
People use forward proxies to browse from another country, keep separate IPs for different accounts, collect public data, or, in companies, to control and filter staff web access. Configuration happens on the user's side.
Reverse proxy: acting for the server
A reverse proxy lives on the website's side. A visitor types a domain, DNS points to the reverse proxy, and it decides which application server behind it should handle the request. Visitors configure nothing and usually do not know it exists.
Typical jobs of a reverse proxy:
- Load balancing: spread requests across several app servers and skip failed ones.
- HTTPS termination: keep TLS certificates in one place while back-end servers speak plain HTTP internally.
- Caching and compression: serve static files and pages quickly without hitting the app.
- Shielding and filtering: rate-limit and drop bad requests before they reach the application.
- Path-based routing: for example
/apigoes to one service and everything else to another.
Forward vs reverse proxy compared
| Forward proxy | Reverse proxy | |
|---|---|---|
| Acts for | The user | The web server |
| Configured by | The user, in a browser or app | The site administrator |
| Hides | The user's IP | The origin servers |
| Main purpose | Change IP, separate accounts, control outbound access | Load balancing, HTTPS, caching, protection |
| Common tools | Proxy services, Squid, corporate proxies | nginx, HAProxy, Caddy, CDNs |
| Does the user know? | Yes, they set it up | Usually not |
Example: a reverse proxy in nginx
This minimal config makes nginx accept requests for a domain and pass them to an app on port 3000 on the same server. The extra headers tell the app the original host and the visitor's real IP.
server { listen 80; server_name example.com; location / { proxy_pass http://127.0.0.1:3000; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; } }
HAProxy follows the same idea: a frontend section accepts connections and a backend section lists the app servers to balance across. In production you would add HTTPS, request size limits and timeouts.
One request can pass through both
The two are not mutually exclusive. When you open a large website through a forward proxy, the request goes from your machine to the forward proxy, out to the internet, into the site's reverse proxy or CDN, and only then to the app server. The site's reverse proxy sees the forward proxy's IP, and that is the IP the site records.
The X-Forwarded-For header a reverse proxy adds is meant for internal use between it and the app. On the forward side, some proxies add similar headers and leak your real IP; proxy anonymity levels explains how to check.
Who needs which
- You run a website or API: you need a reverse proxy, built with nginx or HAProxy or provided by a CDN. Buying proxies does not help here.
- You need to browse from another IP or country: you need a forward proxy, such as a Vietnam proxy or a US proxy.
- You manage many accounts or scrape data: you need dedicated forward proxies. See web scraping with proxies.
- You test your own site from several countries: use forward proxies to see what foreign visitors see, while your reverse proxy keeps running on the server side.
Forward proxies at VinaProxy
VinaProxy provides forward proxies: dedicated datacenter IPv4 in 7 countries and static ISP in Vietnam and the US, over HTTP/HTTPS with username and password, one customer per IP and unlimited bandwidth. We do not offer reverse proxy or CDN services. Current prices are on the pricing page.
Frequently asked questions
Is nginx a forward or reverse proxy?
Nginx is mainly used as a reverse proxy and web server. It is not designed as a full HTTPS forward proxy without extra modules.
Does a reverse proxy change my IP when browsing?
No. A reverse proxy serves a website; it does not change visitors' IPs. To change your IP while browsing you need a forward proxy.
Is a CDN a reverse proxy?
Yes. A CDN is a distributed network of reverse proxies placed near users to cache content and protect the origin.
Is a VPN a forward or reverse proxy?
A VPN is closer to a forward proxy because it acts for the user, but it works at the network layer and encrypts all traffic. See proxy vs VPN.
Can I use a purchased proxy as a reverse proxy for my site?
No. A purchased proxy is a forward proxy for outbound traffic; a reverse proxy must run on a server you control with your domain pointed at it.
Need dedicated forward proxies?
Datacenter IPv4 in 7 countries and static ISP in Vietnam and the US. HTTP/HTTPS, username and password, automatic activation.
View pricing