Forward proxy vs reverse proxy is a question of whose side the proxy is on. A forward proxy acts for clients reaching out to the internet; a reverse proxy acts for servers receiving traffic. A load balancer is a reverse proxy that spreads traffic across several servers. This guide explains all three with real examples.
Before you start
It helps to know that a proxy is simply an intermediary: it receives a request, maybe changes or checks it, and forwards it somewhere else.
Forward proxy
A forward proxy sits in front of clients. Browsers in an office or school send requests to the proxy, which fetches pages from the internet on their behalf.
- Uses: content filtering, caching shared downloads, logging, controlling outbound access, hiding internal IPs.
- Examples: Squid, corporate secure web gateways, SOCKS proxies such as an SSH SOCKS tunnel.
- Who knows about it: clients must be configured to use it (or traffic is intercepted transparently).
Reverse proxy
A reverse proxy sits in front of servers. Visitors think they are talking to your website, but the proxy receives the request and passes it to the real server behind it.
- Uses: TLS termination, caching, compression, serving static files, routing domains or paths to different apps, hiding backend servers, WAF and DDoS filtering.
- Examples: Nginx in front of Node.js, LiteSpeed in front of PHP apps, Cloudflare in front of your origin server.
- Who knows about it: visitors usually do not; the backend sees the proxy's IP unless it reads headers like
X-Forwarded-For.
Load balancer
A load balancer is a reverse proxy with several backends. It decides which server gets each request (round robin, least connections, IP hash) and stops sending traffic to backends that fail health checks.
- Uses: scaling beyond one server, high availability, zero-downtime deployments.
- Examples: HAProxy, Nginx upstreams, cloud load balancers.
Side-by-side comparison
| Forward proxy | Reverse proxy | Load balancer | |
|---|---|---|---|
| Acts for | Clients | Servers | Servers |
| Backends | The whole internet | One or more | Several |
| Main goals | Control and privacy of outbound traffic | Security, TLS, caching, routing | Scale and availability |
| Typical software | Squid | Nginx, LiteSpeed, Caddy, Cloudflare | HAProxy, Nginx |
How they combine in real hosting
A typical busy site might look like: visitor → Cloudflare (reverse proxy/CDN) → HAProxy (load balancer) → several web servers running LiteSpeed or Nginx → application server → database. Each layer is a reverse proxy for the next.
Getting real visitor IPs behind a proxy
Because the backend sees the proxy's address, configure it to trust headers from the proxy only: for example X-Forwarded-For or Cloudflare's CF-Connecting-IP. Never trust these headers from arbitrary clients, or attackers can spoof their IP.
FAQ: forward proxy vs reverse proxy
Is a VPN a forward proxy?
Similar in purpose, but a VPN tunnels all network traffic at the network layer, while a proxy usually handles specific protocols. See the proxy vs VPN guide.
Is Cloudflare a reverse proxy?
Yes, when the orange cloud is enabled, Cloudflare proxies requests to your origin server.
Do I need a load balancer for one server?
No. A reverse proxy is enough until you need more than one backend.