Reverse Proxies: The Gatekeeper
A reverse proxy sits in front of your web servers and intercepts every client request before it reaches your application. It's called "reverse" because it acts on behalf of the server (as opposed to a forward proxy, which acts on behalf of the client). Load balancing is just one of many things it can do.
What a Reverse Proxy Does
Think of it as a gatekeeper that handles cross-cutting concerns so your application code doesn't have to:
Reverse Proxy vs Load Balancer
The Relationship
A load balancer distributes traffic across servers. A reverse proxy is a superset — it can do load balancing plus SSL termination, caching, compression, security, and more. Every load balancer is conceptually a reverse proxy, but not every reverse proxy is used primarily for load balancing.
In practice, tools like Nginx, HAProxy, and Envoy serve as both — the distinction is about which capabilities you're using.
SSL/TLS Termination
One of the most valuable reverse proxy functions. Instead of every backend server managing certificates and performing expensive TLS handshakes:
- The reverse proxy handles all encryption/decryption
- Backend servers receive plain HTTP (faster, simpler)
- One place to manage certificates (renewal, rotation)
- Hardware acceleration for TLS can be applied at the proxy layer
Connection Handling
A reverse proxy multiplexes connections. It accepts thousands of client connections (each with varying speeds, keepalive settings) and maintains a small pool of long-lived connections to backends. This means:
- Backends handle far fewer TCP connections (expensive to create/maintain)
- Slow clients don't tie up backend resources (the proxy buffers)
- HTTP/2 to clients, HTTP/1.1 to backends — protocol translation
Popular Reverse Proxies Compared
| Tool | Strengths | Best For |
|---|---|---|
| Nginx | Mature, fast, huge community, great docs | General-purpose web serving + proxying |
| HAProxy | Best-in-class LB performance, detailed metrics | High-throughput load balancing |
| Envoy | Modern, gRPC-native, observability, service mesh | Microservices, Kubernetes, Istio |
| Traefik | Auto-discovery, Let's Encrypt integration, Docker-native | Container orchestration, auto-config |
🏢 Real-World: Cloudflare as a Reverse Proxy
Cloudflare sits as a reverse proxy in front of millions of websites. When you put your site behind Cloudflare, all traffic flows through their edge network. They provide: DDoS protection (absorbing attacks), CDN caching (serving static assets from 300+ data centers), SSL termination (free certificates), WAF rules, and bot detection — all without changing your application code. Your origin server's IP is completely hidden from the public internet.
🏢 Real-World: Nginx's Event-Driven Architecture
Nginx handles 10,000+ concurrent connections using an event-driven, non-blocking architecture. Instead of spawning a thread per connection (Apache's old model), Nginx uses a small number of worker processes, each running an event loop that handles thousands of connections simultaneously. This is why a single Nginx instance can reverse-proxy for dozens of backend servers without becoming a bottleneck itself.
Interactive: Configure Your Reverse Proxy
Enable/disable features and watch the architecture diagram update: