How traffic actually moves through proxies
An independent, source-checked reference for proxy engineering: forwarding headers, reverse proxy configuration, TLS, timeouts, and free tools to test all of it.
Topic clusters#
- Proxy fundamentalsWhat a proxy is, the forward/reverse split, CONNECT tunnels, SOCKS, PAC files and proxy authentication.8 guides
- Client IP and forwarding headersX-Forwarded-For, RFC 7239 Forwarded, the PROXY protocol, and how to trust any of it without opening a spoofing hole.6 guides
- Reverse proxy configurationnginx, HAProxy, Envoy, Caddy and Traefik: routing semantics, upstreams, health checks, WebSockets and gRPC.11 guides
- TLS and proxy securityTermination, passthrough, SNI routing, mTLS, interception, request smuggling and SSRF through proxies.8 guides
- Performance and protocolsKeep-alive, connection pools, buffering, timeout budgets, HTTP/2 and HTTP/3, compression and caching.7 guides
- Troubleshooting proxiesReading 502/503/504 correctly, curl through a proxy, no_proxy behaviour, corporate proxies and dev tooling.6 guides
- Proxy toolsBrowser-side calculators and parsers: client IP resolution, no_proxy matching, proxy_pass rewriting, PROXY protocol decoding.6 tools
Six tools that answer a question without a deploy#
Every one of these runs in your browser. Nothing is uploaded, and each tool page explains the rule it implements so you can check its working.
| Tool | The question it settles |
|---|---|
| Client IP resolver | Which address in this X-Forwarded-For chain is the real client, given my trusted proxies? |
| no_proxy tester | Do curl, Go, Python and Java all agree that this URL bypasses the proxy? |
| nginx proxy_pass simulator | What upstream URI does this location and proxy_pass pair actually produce? |
| PROXY protocol decoder | What do these header bytes mean, and does the length field add up? |
| PAC file tester | What does FindProxyForURL return, and how many DNS lookups did it cost? |
| Timeout ladder checker | Which hop gives up first, and is my ladder inverted? |
Start with the question you arrived with#
"Why is my client IP wrong?" The client IP is not a header, it is the result of walking a chain and deciding which hops you trust. Read The X-Forwarded-For header for the mechanism, Configuring trusted proxies for the configuration in nine different stacks, and Client IP spoofing through proxies for the test that tells you whether yours is forgeable.
"Why did adding a slash change my URL?" Because a trailing slash is a URI part, and a URI part means nginx replaces the matched location prefix instead of forwarding the request URI unchanged. nginx proxy_pass and the trailing slash has the full truth table.
"Which reverse proxy should we run?" nginx vs HAProxy vs Envoy vs Caddy vs Traefik reduces the choice to two axes that actually differ, then gives the capability matrix and an honest section on what each one is bad at.
"What is this 502?" 502 vs 503 vs 504 maps each status to what the proxy experienced, then to the log signature that confirms it, for nginx, HAProxy and Envoy.
"Everything broke when I joined the corporate network." Corporate proxies and developer tooling covers the two settings every tool needs, and TLS interception and corporate root CAs explains why unable to get local issuer certificate appears in fifteen different phrasings.
"What does that term actually mean?" The proxy glossary defines around sixty terms precisely, including the ones the industry uses loosely, such as transparent versus intercepting, and L4 proxy versus NAT.
What makes this different from the vendor documentation#
Vendor documentation describes one product correctly. It cannot tell you that nginx and Caddy disagree about whether X-Forwarded-For is set by default, that Envoy's route timeout is a quarter of what everything around it uses, or that NO_PROXY=example.com stopped bypassing the proxy for notexample.com only in Python requests 2.34.0, so two containers in the same cluster can route the same URL differently depending on a pin in a lock file.
That is the gap this site fills: the behaviour at the seams, where two correct implementations meet and disagree. Every page is built around comparison tables across implementations, worked examples with real configuration or real wire bytes, and the failure modes each choice produces, named by the exact log line you will see.
How the content is verified#
Claims are checked against primary sources: RFCs, the official documentation for the version in question, and published source code. Every page lists the sources it relied on, version-qualifies anything that changed between releases, and carries the date it was last reviewed. Where behaviour is genuinely ambiguous or undocumented, the page says so rather than guessing.
There are no invented benchmarks, no fabricated statistics and no vendor rankings on this site. See editorial standards for the full method, standards and sources for the specification index, and corrections for the log of changes made after publication.