What is a Reverse Proxy and How Does It Work?

It is well-known that a proxy determines the relationship between a user and a web server (or a website). But it is the traffic flow direction that defines who benefits from this relationship: a user or a web server. In case of a forward proxy, users have all the perks: they hide behind a proxy, maintain anonymity, and have access to the geo-restricted content, all while conducting excessive business tasks, such as web scraping or multi-accounting. A reverse proxy helps to process requests and protect anonymity as well but in contrast to a forward proxy, the main beneficiary is a web server (or a website).

What is a Reverse Proxy?
A reverse proxy sits behind a firewall on the private network ensuring that no user has direct access to a web server. It controls web traffic coming from the user. To protect the backend server(s) from any malice or bots a reverse proxy hides the web server's location and provides its anonymity. It also serves as a load balancer and significantly improves the web server's (website's) performance.

How Does a Reverse Proxy Work?
A user on the public network makes a request to a web server. A reverse proxy intercepts the request and examines traffic coming from the user before forwarding it to the web server. Usually, a user does not know that the request is handled by a reverse proxy.
First, a reverse proxy checks the request making sure it is valid, i.e. traffic does not contain malware or other security threats. If the request is not valid, it is blocked and the user receives an error message. If the request does not look suspicious, a reverse proxy addresses it to the backend server. Receiving the response a reverse proxy analyzes the content again (by applying security policies), and sends traffic along to its destination, caching the information.

Caching
As a reverse proxy acts as a gateway between a user and a source on the private network, it compresses and caches the most frequent requests. Whether a user had already sent a similar request in the past, a reverse proxy checks if the information about this request is cached on the proxy server or not. If yes, a reverse proxy does not pass the request to a web server. It sends the response from the cache instead, thus lessening network traffic. The result is a greater level of network security, better speed, and web server (website) performance.

Benefits of Reverse Proxy
A reverse proxy controls access to the original server on a private network. It enables to:

• Increase web server security

A reverse proxy filters the encrypted traffic and does not send it through a firewall unless it is sure that a request does not contain any malice. By blocking traffic from bad actors a reverse proxy protects the backend server from DDoS attacks ensuring its safety.

• Cache a commonly requested content

A reverse proxy caches local content improving the speed, a user's experience, and web server performance.

• Distribute network traffic

A reverse proxy is a great load-balancing tool if there are several backend servers on a private network. It ensures that no one server is overloaded. If one of the servers fails, a reverse proxy redirects a request to the remaining ones constituting flawless operation.

A reverse proxy distributes traffic not only locally but also globally. Whether several backend servers are located around the globe a reverse proxy sends a user to the server that is geographically closest to them minimizing response and load time.

• Decrypt and encrypt SSL communications

A reverse proxy decrypts all incoming requests and encrypts all outgoing responses to ensure secure data transmission between a user and a web server. In general, secure reverse proxying slows every connection, however, SSL encryption provides a caching mechanism, and the user and the web server reuse previously negotiated security parameters, freeing up valuable resources on the origin server.

Handling all SSL communications via a reverse proxy is cost-effective, because there is no need to install SSL certificates on backend servers.

• Authenticate a user

If a request is made by the same user there is no need to re‑authenticate every time they connect to a web server constituting the better performance.

How to Set Up a Reverse Proxy?
To set up and configure a reverse proxy it is necessary to purchase special hardware and configure specific software. These solutions can be expensive and require IT expertise as the process is complicated.

A forward proxy setting up requires:

• provision of the host with appropriate specifications;
• configuration of the operating system and a firewall, deciding on which proxy software to use (open-source Nginx, Varnish, HaProxy, Apache);
• optimization and adjustment of the proxy software for optimal performance (to configure SSL certificate for example);
• enumeration and configuration of the backend servers in the proxy configuration files;
• audit logging setting up;
• configuration of the firewalls in all the backend servers;
• excessive testing to verify that configurations meet the user's needs.

How to Use a Reverse Proxy?
In enterprises with high-intensity traffic, a reverse proxy provides real-time security sitting in front of one or more web servers or in the cloud before SaaS apps. A reverse proxy, unlike a forward proxy, does not monitor all traffic. It filters traffic intended only for authorized assets (web servers, websites, and cloud services).

As a reverse proxy intercepts incoming traffic it allows to:

• Control unmanaged devices With the rise of the remote-from-home trend employees often use their personal smartphones and tablets to remain productive working off the network. Rare employees install security software on their personal devices. A reverse proxy acting as a single entry point for any unmanaged device protects against data leakage and malware. The web server administrator can configure a web server so it accepts traffic only from a proxy, thus raising the safety level.
• Protect sensitive data As a reverse proxy inspects the encrypted traffic based on policy, it ensures that no sensitive data is accidentally or on purpose uploaded to cloud apps (or a web server) or downloaded to unauthorized endpoints.
• Prevent threats The infected file when left unattended can spread across all cloud apps within the enterprise causing havoc. By preventing the downloading from unmanaged devices (possibly containing malware) a reverse proxy defends cloud apps and web servers.
• Control users' access The web server administrators can configure a reverse proxy access policy and reroute all traffic through a proxy instead of configuring each server for employees that access network resources. In big enterprises where there are several backend servers, the process is time-consuming.
• Combine different websites in a single URL Sometimes businesses host their shopping carts apps with a third-party service outside their network. Using a reverse proxy, users never know they have been sent to a different URL for payment. A reverse proxy covers it up.
• Monitor traffic A reverse proxy logs any request that goes through it. Thus it is easier to monitor all data going to and from the website or a web server using a reverse proxy.

Sitting in front of a web server a reverse proxy acts as a single entry point for users and filters traffic rerouting it to the endpoint or distributing it across many web servers ensuring load balance and protecting backend servers from overloading by incoming traffic.

A reverse proxy protects web servers (websites) from DDoS attacks and other malware because the actual server(s) location and the(ir) original IPs are hidden behind the proxy.
A reverse proxy is used to control unmanaged devices that can carry threats and protect sensitive data from stealing.

This post was originally published on SOAX blog.