Forward proxy versus reverse proxy

Example: • X = client computer with a connection to the internet • Y = the (reverse) proxy server • Z = the web server you want to visit Forward proxy server • Most discussion of web proxies refers to the type of proxy known as a “forward proxy.” • The proxy event in this case is that the “forward proxy” retrieves data from another web site on behalf of the original requestee. Normally, one would connect directly from X –> Z. However, in some scenarios, it is better for Y –> Z on behalf of X, which chains as follows: X –> Y –> Z. Possible uses of a forward proxy server: a) Someone with administration authority over X’s internet connection has decided to block all access to site Z. Examples: • The Storm Worm virus is spreading by tricking people into visiting, so the system administrator has blocked access to the site to prevent users from inadvertently infecting themselves. • Employees at a large company have been wasting too much time on, so management wants access blocked during business hours. • A local elementary school disallows internet access to the web site. • A government is unable to control the publishing of news, so it controls access to news instead, by blocking sites such as See TOR or FreeNet. b) The administrator of Z has blocked X. Examples: • The administrator of Z has noticed hacking attempts coming from X, so the administrator has decided to block X’s ip address (and/or netrange). • Z is a forum web site. X is spamming the forum. Z blocks X. Reverse proxy server Normally, one would connect directly from X –> Z. However, in some scenarios, it is better for the administrator of Z to restrict or disallow direct access, and force visitors to go through Y first. So, as before, we have data being retrieved by Y –> Z on behalf of X, which chains as follows: X –> Y –> Z. What is different this time compared to a “forward proxy,” is that this time the user X does not know he is accessing Y. A Reverse Proxy is typically less visible than a “forward proxy”, and requires no configuration or special knowledge by the client, X. The client X probably thinks he is visiting Z directly (X –> Z), but the reality is that Y is the invisible go-between (X –> Y –> Z again). Possible uses of a reverse proxy server: a) Z has a large web site that millions of people want to see, but a single web server cannot handle all the traffic. So Z sets up many servers, and puts a reverse proxy on the internet that will send users to the server closest to them when they try to visit Z. This is part of how the Content Distribution Network (CDN) concept works. Examples: • Apple Trailers uses Akamai • hosts it’s javascript files using CloudFront CDN (sample). b) The administrator of Z is worried about retaliation for content hosted on the server, and does not want to expose the main server directly to the public. • Owners of Spam brands such as “Canadian Pharmacy” appear to have thousands of servers, while in reality having most websites hosted on far fewer servers. Additionally, abuse complaints about the spam will only shut down the public servers, not the main server. In the above scenarios, Z has the ability to choose Y.