Forward proxy
Reverse proxy
Pause
Reset view
drag the scene to orbit
Isometric scene: clients, a proxy, and servers, with a trust boundary that moves depending on the proxy type
the client's agent
Deployed by Whoever makes the requests
Client Knows it exists — proxy settings, PAC file, HTTPS_PROXY
Erases Who is asking
Does Egress control, allow-lists, outbound cache, anonymity
Wild Squid, Tor, corporate egress, NAT with inspection
the server's agent
Deployed by Whoever answers the requests
Client Never knows — public DNS points straight at it
Erases Which server answered
Does TLS termination, load balancing, routing, WAF, cache
Wild Nginx, HAProxy, Envoy, ALB, CloudFront
Both hops re-write the sender. That is why X-Forwarded-For exists on the reverse side — and why trusting it from an untrusted hop is a spoofing hole.