What Is a Forward Proxy? – Definition and How It Works
Learn what a forward proxy does, how it differs from a reverse proxy, how HTTPS tunnelling works through one, and where each is used.
A forward proxy sits in front of clients and makes requests on their behalf. A reverse proxy sits in front of servers and receives requests on their behalf. The names describe which side the intermediary serves.
1. The Two Directions
| Forward proxy | Reverse proxy | |
|---|---|---|
| Sits in front of | Clients | Servers |
| Configured by | The client | The site operator |
| Knows about | Where the client wants to go | Which backend should answer |
| Hides | The client from the destination | The origin from the visitor |
| Typical use | Egress control, anonymity, geography | Load balancing, caching, TLS termination, security |
A visitor to a website usually passes through the site's reverse proxy without knowing it, and passes through a forward proxy only if their own client was configured to use one.
2. How Clients Use One
The client is configured with the proxy's address, and requests are sent there instead of to the destination.
curl -x http://user:[email protected]:8000 https://example.com/
The proxy opens the connection to the destination and relays the response.
3. HTTPS Goes Through a Tunnel
An HTTP proxy cannot read encrypted traffic. For HTTPS the client sends a CONNECT request naming the destination host and port; the proxy opens a TCP connection and then relays bytes blindly.
TLS is negotiated end to end through that tunnel, so the proxy sees the destination and the traffic volume but not the content — unless it terminates TLS itself, which requires its certificate to be trusted by the client.
4. What Organisations Use Them For
- Egress control, so all outbound traffic passes one auditable point.
- Content filtering by category or destination.
- Caching, historically significant and less so now that most traffic is encrypted.
- Logging for compliance.
- Address consolidation, presenting one exit address.
5. What Collection Uses Them For
- Geography, exiting from a specific country or city.
- Distributing load across many addresses.
- Isolating tasks so one task's reputation does not affect another.
- Consistent egress for a session, since server-side state is often bound to an address.
6. Authentication and Secrecy
Proxies commonly authenticate with a username and password embedded in the configuration URL, and providers often encode session and geography parameters into the username.
That URL is a credential. It must live in environment configuration or a secret manager, and must be redacted before any request diagnostic reaches a log — proxy URLs are among the most frequently leaked secrets in collection code.
7. What It Does Not Change
A proxy changes the visible source address. Headers, TLS fingerprint, protocol behaviour, cookies, and pacing are unchanged, so a client identifiable for those reasons remains identifiable through any proxy.
8. Summary
A forward proxy acts for clients, relaying their requests and presenting its own address to destinations, with HTTPS carried through a CONNECT tunnel it cannot read.
It is the mirror image of a reverse proxy, which acts for servers. It changes the source address and nothing else — and its configuration URL is a secret.