Reverse Proxy

How it works

A reverse proxy sits in front of one or more backend servers, forwarding client requests and returning the response as if it came from the proxy itself. It centralizes SSL termination, compression, caching, and static file serving — and hides backend topology from the outside world, which pays off even with a single server.

Mental models

• Clients only ever see the proxy's IP — you can add, remove, or reconfigure backend servers without clients noticing.
• SSL termination happens once at the proxy, so backend servers skip the expensive decrypt/encrypt work.
• The proxy can serve cached responses and static files directly, without ever bothering a backend.
• Unlike a load balancer, a reverse proxy earns its keep even with a single backend — security and SSL termination alone justify it.
• NGINX and HAProxy commonly do both jobs at once: layer 7 reverse proxying and load balancing.

Common pitfalls

• It's a new single point of failure — pair it with a standby, same as a load balancer.
• Terminating SSL at the proxy often means plaintext traffic to the backend — fine inside a trusted network, a real gap if it isn't.
• Forward proxy and reverse proxy solve opposite problems: a forward proxy hides clients from servers, a reverse proxy hides servers from clients — don't mix them up.