Forward Proxy

A forward proxy is a server that acts for the client. You point your browser, script, or whole network at it, and from then on it makes requests to the internet on your behalf and passes the answers back.

When someone says just "proxy", this is almost always what they mean. The name only becomes necessary when you need to distinguish it from a reverse proxy, which does the mirror-image job for a server.

Forward or reverse — who is being protected?

• A forward proxy is configured by you and hides you from the websites you visit.
• A reverse proxy is configured by the site owner and hides their servers from you.

The technology is much the same; the difference is whose side it sits on. You choose whether to use a forward proxy. You never get a say in whether a site puts a reverse proxy in front of itself.

How much does it reveal?

Forward proxies differ in how openly they announce themselves, and this matters more than most people realise:

• Transparent — passes your real IP along in headers such as X-Forwarded-For. The site sees both the proxy and you. Common in corporate networks, where the aim is filtering rather than privacy.
• Anonymous — hides your IP, but still sends headers that reveal a proxy is in use. The site knows you are behind one, just not who you are.
• Elite (high-anonymity) — hides your IP and sends no proxy-revealing headers at all, so the request looks like an ordinary direct connection. See elite proxy.

Two very different reasons to run one

Inside organisations, forward proxies are a control point. All staff traffic is routed through one, which can then log activity, block categories of site, scan for malware, and cache popular content to save bandwidth. Here the proxy exists to watch traffic, not to conceal it.

Outside them, forward proxies are used to change how you appear online — collecting web data at scale, viewing region-specific pricing and search results, keeping accounts separated by IP, and reaching content restricted in your location.

Setting one up

You normally supply a host, a port, and credentials, then apply them at the level you want: a single browser, one script via an environment variable such as HTTP_PROXY, or an entire network through a device policy. Remember the scope — a proxy set in one browser does nothing for the rest of your machine.