What is a Proxy Server?

Sam Erickson
Updated last week

Key Takeaways

A proxy server relays communication between clients and other servers. A forward proxy represents clients; a reverse proxy sits in front of servers.
Ordinary HTTPS tunneling keeps HTTP contents encrypted through the proxy. TLS interception is different: it lets the proxy decrypt traffic and changes whom the client must trust.
IP masking, filtering, and caching are conditional capabilities—not guarantees that come with every proxy.
A proxy is not automatically an anonymity service, a firewall, or an encrypted VPN. Choose it for a specific networking requirement.

A proxy server is an intermediary that relays communication between a client, such as your browser, and another server. What it can see, change, or protect depends on its placement, protocol, and configuration.

How Does a Proxy Server Work?

Imagine opening Facebook in your browser: the browser is the client, and the website's servers provide the service. During a normal HTTPS visit, your browser negotiates Transport Layer Security (TLS) and validates the server's certificate against the requested hostname and trusted certificate authorities. That authenticates the connection's endpoint; it doesn't establish that everything the website does is trustworthy. See how TLS works for the underlying exchange.

A forward proxy adds an intermediary. For an ordinary, unencrypted HTTP request, the exchange looks like this:

Request:  Browser --------> Forward proxy --------> Website
Response: Browser <-------- Forward proxy <-------- Website

Proxy sees: source IP of the browser's connection
Website normally sees: proxy's outbound IP address

The browser sends its request to the proxy.
The proxy evaluates any configured policies and forwards an allowed request to the destination.
The destination returns its response to the proxy, which relays it to the browser.

The proxy handles connections on both sides rather than simply replacing an address inside the browser's request. HTTPS adds an encryption boundary, explained below.

Forward Proxy vs Reverse Proxy

The most useful distinction is which side the proxy represents. Apache's forward and reverse proxy documentation describes both arrangements.

Question	Forward proxy	Reverse proxy
Who operates or selects it?	The client, or the client's organization	The website or service operator
Which side does it represent?	Clients accessing other services	Backend servers receiving requests
Typical purpose	Outbound access control and centralized internet access	Incoming request routing and load balancing
Does the visitor configure it?	Usually through application, device, or organizational settings	Normally no; visitors use the website's regular address

A reverse proxy receives incoming traffic—often called ingress—and passes it to a backend server. Load balancing distributes that traffic across multiple backends, as illustrated in the NGINX load-balancing documentation.

                                  +--> Backend A
Client <----> Reverse proxy <------+
                                  +--> Backend B

Responses return through the reverse proxy.

A reverse proxy can also perform TLS termination: it handles the browser's TLS connection and can read the HTTP contents. Its connection to the backend is a separate decision; encrypting the browser-facing connection doesn't automatically encrypt that second connection. NGINX's TLS termination guide explains this server-side role.

HTTP Proxy vs SOCKS Proxy

Forward and reverse describe placement. HTTP and SOCKS describe protocols, so these aren't competing classifications.

HTTP proxy: Understands HTTP requests and can apply HTTP-specific policies. For HTTPS destinations, it commonly establishes a tunnel using the CONNECT method.
SOCKS proxy: Provides a more general-purpose relay rather than requiring HTTP messages. SOCKS5 supports TCP connections and UDP relaying, but using SOCKS does not inherently encrypt the relayed application data.

Check your application's supported proxy protocols before choosing a service. Protocol support, authentication, and encryption are separate requirements.

Can a Proxy Server See HTTPS Traffic?

CONNECT Tunneling

With a conventional HTTP forward proxy, the browser asks the proxy to establish a CONNECT tunnel to a destination host and port. The browser then negotiates TLS with the destination through that tunnel. The proxy relays encrypted bytes rather than reading the HTTP headers, page contents, or passwords inside them.

The proxy still knows the CONNECT destination and can observe connection timing and transferred data volume. Encryption protects the contents, not every piece of connection metadata.

TLS Interception

An inspection proxy instead establishes two TLS connections: one with the browser and another with the destination. It presents a substitute certificate that the client must trust, decrypts traffic between the connections, and can inspect or modify the HTTP contents. Microsoft's TLS inspection explanation illustrates this arrangement.

CONNECT tunnel:
Browser ===== TLS through proxy ===== Website
HTTP contents readable by: browser and website

TLS interception:
Browser === TLS === Inspection proxy === TLS === Website
HTTP contents readable by: browser, proxy, and website

Also distinguish a proxy that carries HTTPS traffic from an HTTPS connection to the proxy itself. Encrypting the client-to-proxy connection doesn't, by itself, mean the proxy intercepts the destination's TLS connection. For terminology, see SSL vs TLS.

Does a Proxy Server Hide Your IP Address?

A typical forward proxy makes the destination see the proxy's outbound address instead of your connection's source address. That's address masking, not a guarantee of anonymity.

Forwarding headers: An HTTP-aware proxy can disclose your address through Forwarded or X-Forwarded-For. A tunnel-only proxy cannot insert those headers into the encrypted HTTP exchange. MDN explains client-IP forwarding.
Proxy records: The operator can observe your connection and may retain logs. You are moving trust to another intermediary, not removing the need for trust.
Website identity: Signing into an account still identifies you to that service. Cookies and browser fingerprinting can also link activity despite an address change; MDN's web privacy guide explains those mechanisms.
DNS handling: Domain-name lookup may happen locally or at the proxy, depending on the client and protocol. Don't assume that configuring a proxy also moves every DNS lookup; the curl manual documents both SOCKS behaviors.

Proxy Server Uses: Policy, Security, and Caching

Businesses use forward proxies to centralize outbound access and enforce egress policies—rules governing traffic leaving their networks. Allowing or blocking destinations is an optional policy function. A proxy is not automatically a firewall, and inspecting encrypted page contents requires more than simply relaying the connection.

Caching is optional too. A caching proxy stores eligible responses for later requests, potentially reducing bandwidth use and response time. It must follow HTTP caching rules: for example, an unqualified Cache-Control: private response cannot be stored by a shared cache, while no-cache requires validation before reuse rather than forbidding storage.

An ordinary CONNECT tunnel cannot cache the encrypted HTTP responses passing through it. A reverse proxy that terminates TLS can evaluate HTTP caching rules, but that doesn't make every response safe to share between users.

Transparent, Anonymous, and Distorting Proxies

These labels concern deployment or identity disclosure, not a complete taxonomy of proxy architecture. Ask what the proxy actually does rather than relying on the label.

Transparent Proxy

In network-deployment discussions, transparent commonly means traffic is redirected through a proxy without explicit browser configuration. It doesn't guarantee unchanged requests or preserved client addresses. Squid calls this interception proxying.

Anonymous Proxy

The useful question is whether the proxy discloses the client's address—not whether its name promises anonymity. Suppressing an address header doesn't remove accounts, cookies, or other identifying signals.

Distorting Proxy

Treat claims about a distorting proxy cautiously. Supplying misleading client-address information in an HTTP header is not the same as making the connection originate from a fabricated IP address. Forwarding information can be altered or forged and isn't inherently trustworthy.

Proxy Server vs VPN

A conventional application proxy handles traffic directed to it by supported applications. A secure remote-access VPN creates an encrypted tunnel to a VPN gateway and can carry traffic from multiple applications. Microsoft's VPN Gateway overview describes encrypted VPN connections.

A VPN doesn't necessarily carry all device traffic: split tunneling sends selected traffic through it. Neither a VPN nor a proxy replaces HTTPS between your browser and the destination, or guarantees anonymity from websites and service operators.

Choosing and Using a Proxy Safely

Choose by the problem: a forward proxy for controlled outbound access, a reverse proxy for incoming service traffic, or SOCKS when your application needs its general-purpose relay capabilities. Individuals should evaluate the same trust and protocol questions as businesses, rather than assuming a privacy-branded service is safe.

Availability: Plan what happens when the proxy fails; traffic depending on it may stop.
Performance: Measure latency rather than assuming an extra intermediary makes requests faster.
Access: Restrict authorized clients and permitted destinations. Don't accidentally operate an unrestricted public forward proxy.
Logging: Decide what is recorded, who can access it, and how long it is retained.
Maintenance: Secure the proxy, keep it updated, and manage any inspection certificates and keys carefully.

Legitimate administrators can use proxies to enforce policy and protect services; malicious or compromised intermediaries can abuse their position to observe or alter accessible traffic. The intermediary is a trust boundary, not a security guarantee.

FAQ

What is a proxy server and how does it work?

A proxy server relays communication between a client and another server. The client communicates through the proxy, which forwards permitted traffic and returns responses.

What is the difference between a forward proxy and a reverse proxy?

A forward proxy represents clients accessing other services. A reverse proxy is operated in front of backend servers to receive and route incoming requests, often with load balancing or TLS termination.

Can a proxy server see HTTPS traffic?

An ordinary CONNECT proxy sees the tunnel destination and connection metadata, but not the encrypted HTTP contents. A TLS-intercepting proxy can read those contents because it establishes separate TLS connections with the client and destination.

Does a proxy server hide your IP address?

A forward proxy typically substitutes its outbound address as the source visible to the destination. However, forwarding headers may disclose the client address, the proxy may retain logs, and accounts or browser identifiers can still identify you.

What is the difference between a proxy server and a VPN?

A conventional proxy relays traffic that supported applications direct to it. A secure remote-access VPN encrypts traffic to a VPN gateway and can carry traffic from multiple applications, although split tunneling may leave some traffic outside it.