Reverse proxy deep dive (2024)

https://startwithawhy.com/reverseproxy/2024/01/15/ReverseProxy-Deep-Dive.html

93•miggy•7mo ago

Comments

shelajev•7mo ago

It took me an embarrassingly long time to internalize what the reverse proxy is. My brain got stuck on the fact that it is just proxying requests. What's so reverse about this? Silly.

rini17•7mo ago

Since web proxy was originally used near clients, caching stuff to save precious bandwidth of their kbps-tier connection.

happytoexplain•6mo ago

It's one of the classic cases of a thing being named relative to what came before it, rather than being named on its own merit. This makes sense to people working at the time the new thing is introduced, but is confusing to every other learner in the future.

nosianu•6mo ago

Could be worse. All the many things named after people prevalent in some fields more than in others, biology/medicine for example. When you read, for example, "loop of Henle" or "circle of Willis" you don't even know where to begin. You either know the term or not.

happytoexplain•6mo ago

True, though I think it's often a larger challenge to capture the intrinsic quality of a medicinal compound or physiological feature than a man-made tool.

raincom•6mo ago

What came before "reverse proxies"? Just curious to understand the history.

p_ing•6mo ago

Forward proxies, proxies where client machines were configured to route all their outbound traffic through (similar to a router). Usually performed caching back in the day when the Internet tube was slow, later on got SSL decryption capabilities and filtering lists to make sure you stay off of your naughty sites and so the proxy admin could decrypt your banking credentials.

azaras•6mo ago

Nowadays, "reverse" is suppressed in most ways. I have heard that Nginx is a proxy more often than a reverse proxy.

Valodim•6mo ago

Except in the configuration where you use the reversep_proxy directive, of course

daveguy•6mo ago

How about service proxy vs web proxy rather than reverse proxy and proxy? Makes more clear that one is a proxy on the service side and the other is a proxy on the client side. Service proxy and Client proxy might be even better.

MortyWaves•6mo ago

Caddy, Nginx, Traefik seem to be the most popular reverse proxies in the self hosting/homelab communities.

I definitely prefer Caddy in my experience, so far.

lowwave•6mo ago

Is there a reverse proxies that can support DTLS support out of box without some kind experimental patch[1]?

1: https://nginx.org/patches/dtls/

joshbaptiste•6mo ago

Trying out ferron recently as a reverse proxy https://www.ferronweb.org/.. config is super simple

ethan_smith•6mo ago

HAProxy deserves a mention alongside those - it's particularly strong for high-traffic production environments where its advanced load balancing algorithms and detailed metrics shine.

p_ing•6mo ago

I would argue this is the best mainstream proxy. Even better when paired with OpenBSD and CARP.

somehnguy•6mo ago

Caddy has been excellent for me thus far as well. I'm using it on a VPS to reverse proxy to the services I run at home via a Tailscale tunnel. Coming from Nginx in the past Caddy was drop-dead simple to configure.

The entire config for each vhost is 3 lines, including the domain definition and closing brace - and that includes TLS!

MortyWaves•6mo ago

Just curious if you have Caddy running in Docker or normal?

somehnguy•6mo ago

Caddy is in docker via compose

BrandoElFollito•6mo ago

I used to use Caddy for years and was active in the community.

I switched to Traefik for a few reasons: labels configuration (there is a parallel version of caddy maintained by somebody else that does it), how middleware are implemented and the dynamic capacities of Traefik.

Caddy is excellent, a brilliant piece of tech. For edge routing Traefik is worth at least considering.

vojtechrichter•6mo ago

Amazing read, I personally find it fascinating to make my own load balancer.

jeffbee•6mo ago

I would say the bullet points at the top are not strictly correct. The response does not necessarily transit the proxy. Responses can be returned directly to the client (DSR).

nyrikki•6mo ago

> Note: For simplicity, we’ll focus on Layer 7 (HTTP) reverse proxy.

Layer 4 proxies are a very specific sometimes food that most people should actively avoid until they need it because of the tradeoffs.

DSR is layer 4, and not in scope of this post.

jeffbee•6mo ago

Your comment, to me, only points out that the OSI layer model is nonsense. Envoy in DSR mode routes traffic based on application features, at "layer 7".

nyrikki•6mo ago

Envoy calls it Layer 4

https://blog.envoyproxy.io/introduction-to-modern-network-lo...

jeffbee•6mo ago

That's fair. Of course that post also calls the OSI model "unfortunate" and "a poor approximation".

nyrikki•6mo ago

All models are wrong, some are useful.

Layer 4 to 7 is useful in this case, as layer 4 involves forging tcp/udp packets, which is vastly different than say a http level reverse proxy.

thequux•6mo ago

If you actually read ITU T-REC X.200, which specifies the OSI model, you'll find that it doesn't match the modern internet at all. E.g., we don't have an OSI-style transport protocol at all (connections themselves aren't addressable independent of the SSAPs), TCP and UDP are actually layer 5, the presentation layer is protocol-specific, and pretty much the entire stack falls to bits if the network layer isn't packet switched.

There's a separate term for the bits of the OSI model that are actually relevant; it's called the IETF model.

philwelch•6mo ago

The model itself isn’t nonsense because it’s not a model of load balancers; it’s a model of network protocols. Load balancers might handle multiple levels of the stack for the same traffic, but so does any other networked program, eg handling cross-domain redirects.

tdiff•6mo ago

Really looks like an ai-generated overview.

philwelch•6mo ago

Original, Medium-free URL is https://startwithawhy.com/reverseproxy/2024/01/15/ReversePro...

Meta request: can we change the URL to the original source? This isn’t quite blogspam (since it’s the same author reposting the same piece onto Medium) but Medium is annoying enough that I’d still rather resolve to the original source

imcotton•6mo ago

Thanks, I have being putting medium domain into dns blocklist for years.

mdaniel•6mo ago

The alternative is the amazing scribe.rip -> https://scribe.rip/@mitendra_mahto/cross-posted-from-https-s...

Quarrel•6mo ago

Wow. Thanks for this. Setting up redirects now.

Medium is terrible.

luckman212•6mo ago

How do you set up those automatic redirects if I might ask?

Quarrel•6mo ago

In the end I just used a greasemonkey script. There are several on greasyfork.

tomhow•6mo ago

We're late to this but have changed the URL now.

raincom•6mo ago

What's the difference between Reverse proxy and forward proxy? Is there something like "intermediate proxy"? Is this concept of L7 proxy, similar to DNAT/SNAT or Port forwarding in L3/L4?

p_ing•6mo ago

TL;DR: Forward Proxy == protects clients; Reverse Proxy == protects server

https://en.wikipedia.org/wiki/Proxy_server#Forward_proxy_vs....

The Search Engine Map

Show HN: Souls.directory – SOUL.md templates for AI agent personalities

Real-Time ETL for Enterprise-Grade Data Integration

Economics Puzzle Leads to a New Understanding of a Fundamental Law of Physics

Switzerland's Extraordinary Medieval Library

A new comet was just discovered. Will it be visible in broad daylight?

ESR: Comes the news that Anthropic has vibecoded a C compiler

Frisco residents divided over H-1B visas, 'Indian takeover' at council meeting

If CNN Covered Star Wars

Show HN: I built the first tool to configure VPSs without commands

AI agents from 4 labs predicting the Super Bowl via prediction market

EU bans infinite scroll and autoplay in TikTok case

Benchmarking how well LLMs can play FizzBuzz

Why I Joined OpenAI

Octave GTM MCP Server

Show HN: Portview what's on your ports (diagnostic-first, single binary, Linux)

Voyager CEO says space data center cooling problem still needs to be solved

Boilerplate Tax – Ranking popular programming languages by density

Zen: A Browser You Can Love

My GPT-5.3-Codex Review: Full Autonomy Has Arrived

Show HN: FastLog: 1.4 GB/s text file analyzer with AVX2 SIMD

God said it (song lyrics) [pdf]

I left Linus Tech Tips [video]

Program Theory

Show HN: Local DNA analysis skill for OpenClaw

Ask HN: Non-profit, volunteers run org needs CRM. Is Odoo Community a good sol.?

WiFi Could Become an Invisible Mass Surveillance System

Build your own Mac cloud

Anduril announces AI Grand Prix – autonomous drone racing competition (2026)

How the Tandy Color Computer Works [video]

The Search Engine Map

Show HN: Souls.directory – SOUL.md templates for AI agent personalities

Real-Time ETL for Enterprise-Grade Data Integration

Economics Puzzle Leads to a New Understanding of a Fundamental Law of Physics

Switzerland's Extraordinary Medieval Library

A new comet was just discovered. Will it be visible in broad daylight?

ESR: Comes the news that Anthropic has vibecoded a C compiler

Frisco residents divided over H-1B visas, 'Indian takeover' at council meeting

If CNN Covered Star Wars

Show HN: I built the first tool to configure VPSs without commands

AI agents from 4 labs predicting the Super Bowl via prediction market

EU bans infinite scroll and autoplay in TikTok case

Benchmarking how well LLMs can play FizzBuzz

Why I Joined OpenAI

Octave GTM MCP Server

Show HN: Portview what's on your ports (diagnostic-first, single binary, Linux)

Voyager CEO says space data center cooling problem still needs to be solved

Boilerplate Tax – Ranking popular programming languages by density

Zen: A Browser You Can Love

My GPT-5.3-Codex Review: Full Autonomy Has Arrived

Show HN: FastLog: 1.4 GB/s text file analyzer with AVX2 SIMD

God said it (song lyrics) [pdf]

I left Linus Tech Tips [video]

Program Theory

Show HN: Local DNA analysis skill for OpenClaw

Ask HN: Non-profit, volunteers run org needs CRM. Is Odoo Community a good sol.?

WiFi Could Become an Invisible Mass Surveillance System

Build your own Mac cloud

Anduril announces AI Grand Prix – autonomous drone racing competition (2026)

How the Tandy Color Computer Works [video]

Reverse proxy deep dive (2024)

Comments