Both carry the name "proxy" and both step into the middle. The difference lies in whose behalf they intervene on. A forward proxy is the client's agent: it makes requests on your behalf. A reverse proxy is the server's agent: it answers requests on the server's behalf. This one-sentence distinction explains every other difference.
A forward proxy sits on the user side, a reverse proxy on the server side. The same request can pass through both; they are not alternatives to each other.
Role Comparison
All of the products on this site fall into the forward proxy category; a reverse proxy is an infrastructure component for those who publish sites.
What Does a Reverse Proxy Do?
There is almost always a reverse proxy in front of a modern website. Its duties:
The last layer is the wall that the side using a forward proxy runs into: bot filtering rules run here.
A Simple Nginx Example
X-Forwarded-For header is added here. On the forward proxy side, however, this header is expected not to be added — the same header carries opposite meanings in the two architectures.
The Same Header, Opposite Meanings
On the reverse proxy side, X-Forwarded-For is a good practice: it lets the backend server see the real visitor's IP. On the forward proxy side, however, the same header breaks anonymity: it carries your real address to the target site. You can measure which headers your proxy forwards with anonymity test ; an "Elite" result means that this header is never sent.
Commonly Confused Points
- A CDN is a reverse proxy: services such as Cloudflare and Fastly take on exactly this role.
- An API gateway is a reverse proxy too: it adds authentication and routing.
- The name gateway proxy is misleading: the "gateway" at proxy providers is a single entry address and belongs to the forward proxy architecture.
- A transparent proxy is a forward proxy: even though the user configures nothing, it works on the client's behalf.
For products on the forward proxy side, see the residential, ISP and datacenter pages; for the protocol distinction, see our HTTP–SOCKS5 article .