Forward vs Reverse Proxy: What Is the Difference

The word "proxy" is used for two different things. Some people buy proxies to collect prices or manage accounts. Others set up a proxy on their server so the website can handle the load. Technically they are relatives, but their tasks are opposite.

Below: how a forward proxy differs from a reverse proxy, where each sits on the request path and why proxy services sell forward ones. If you are just starting to figure this out, first take a look at the article what is a proxy server.

A middleman that works for you

A proxy server is a middleman between the two sides of a connection. A forward proxy sits on the client side. You send a request not to the website but to the proxy, and the proxy goes to the website itself and returns the response to you.

In words, the request path looks like this: your computer → forward proxy → internet → website. The website sees the proxy's address, not yours. It does not know that a specific person is behind the proxy, unless you give yourself away.

You set up a forward proxy on your side: in a browser, in an antidetect browser, in a script, in the system. The client chooses which proxy to go through. The website configures nothing and decides nothing in this setup.

A program can talk to a forward proxy over different protocols. Most often these are HTTP, HTTPS or SOCKS5, with a username and password or with access by IP. The protocol affects which programs can connect, but the proxy's role does not change: it still sits on your side and sends requests from its own address.

What a forward proxy is for

The main thing a forward proxy gives you is a different address for your requests. All the typical tasks follow from this:

• Collecting public data. A script spreads requests across different addresses and does not hit the limit of a single IP.
• Checking geo. You see prices, search results or ads the way a shopper in Poland or Germany sees them.
• Working with several accounts. Each profile has its own address, and the platform does not link them by IP.
• Testing websites and apps from different countries before launch.
• Corporate access. A company lets employees go online through its own proxy and controls where they go.

A middleman that works for the website

A reverse proxy sits on the server side. The visitor thinks they are contacting the website, but in fact the proxy meets them. It receives the request, decides which of the servers to pass it to and returns the response.

The request path: visitor → internet → reverse proxy → website server. The visitor does not see the server's real address and usually does not know how many servers stand behind the proxy. This setup is configured by the website owner, not the client.

The best-known examples are the nginx web server in the role of a proxy, load balancers and CDNs like Cloudflare that are placed in front of a website. When you open a large website, your request almost certainly passes through a reverse proxy first.

What a reverse proxy can do

• Load balancing. Requests are spread across several servers, and the website does not go down when a crowd of visitors arrives.
• Caching. Images, styles and unchanging pages are served from the proxy's memory, and the server does not spend resources on them.
• TLS termination. The proxy accepts a secure HTTPS connection, decrypts it and passes the request to the server inside its own network.
• WAF, a web request filter. The proxy cuts off suspicious requests, attacks and overly frequent requests before they reach the server.
• Hiding the server. The server's real address is not exposed, and attacking it directly is harder.

It is usually the website's reverse proxy that answers you with a 429 error or shows a browser check. This is the website owner's decision, and a forward proxy does not cancel it: it changes the address, but the website's rules and limits apply to any address.

Comparison in one table

An easy way to remember it: a forward proxy speaks on behalf of the client, a reverse proxy on behalf of the server. Both can easily appear in one request. Your script goes through a forward proxy, and the website receives the request with its reverse proxy.

Why services sell forward proxies

A reverse proxy is not sold as addresses: it is set up for your own website and works only for it. Buying addresses makes sense only for a forward proxy, because the value lies in which address the website will see.

That is why everything sold as a "proxy" - residential, mobile, datacenter - is a forward proxy. Prokso is no exception: you connect to the host gw.prokso.com with your username and password, and the website sees an address of the country you need from the pool. More about address types on the residential proxies page.

Backconnect: one entry, many exits

A classic forward proxy has one address: you connect to it, and you exit from it. A backconnect proxy works differently. You connect to one gateway, and it sends the request through one of many addresses in the pool.

Such a gateway is convenient because the connection string does not change, while the exit addresses change by the rules. In Prokso it looks like this:

• Port 823 for HTTP and 824 for SOCKS5 - the "Rotating (new IP per request)" mode. This is a rotating proxy: every request exits from a new address.
• Ports from 10000 to 20000 - the "Sticky session" mode. Each port keeps one address for 1 to 120 minutes, 30 by default, and works over both HTTP and SOCKS5.
• You can open up to 1000 concurrent connections per plan, and the gateway itself stays the same.

For the client, a backconnect gateway is still a forward proxy. It sits on your side of the request path and changes the address the website will see. It is just that behind one entry there is not one address but a whole pool.

Transparent proxy: a middleman without settings

There is one more kind: the transparent proxy. It is not set up on the device: the provider, office network or public Wi-Fi intercepts the traffic on its own. The user may not even know that their requests go through a middleman.

Transparent proxies are used to filter websites in offices and schools, for caching at providers and for login pages on guest Wi-Fi. They usually do not hide the client's address and often add headers to the request that tell the website there was a middleman. For the tasks people buy proxies for, this option does not fit.

Headers that reveal a middleman

A proxy can add service headers to a request, for example X-Forwarded-For or Via. They record the client's address or the very fact that the request went through a middleman. For a reverse proxy this is normal: the website server needs to know which visitor came to it, not just the address of its own proxy.

For a forward proxy, on the contrary, such headers are undesirable: they tell the website what you wanted to hide. That is why it is important to check what the website sees after you connect. The "my IP" page shows which address and country the website got and whether your address leaks through WebRTC.

How not to get confused by the terms

• If you set up the proxy so that the website sees a different address, it is a forward proxy.
• If the website owner puts the proxy in front of their servers, it is a reverse proxy.
• If traffic is intercepted without any settings on your side, it is a transparent proxy.
• If you connect to one gateway and exit from different addresses, it is backconnect, a kind of forward proxy.

To connect a forward proxy to your program, take a look at the guides section: it has step-by-step instructions for browsers, antidetect browsers, operating systems and automation libraries. You can check which address the website sees after you connect on the my IP page.