Topic cluster
Proxy fundamentals
How proxies actually work: the accept-decide-rewrite-originate loop, the forward and reverse split, CONNECT tunnels, SOCKS, PAC files and proxy authentication.
Every proxy does the same four things: it accepts a connection, decides where the traffic should go, rewrites what needs rewriting, and originates a second connection to the destination. The differences between a corporate egress gateway, a CDN edge, a service mesh sidecar and a SOCKS relay are differences in who configures them, what they are allowed to see, and which of those four steps they take seriously.
This cluster establishes the vocabulary the rest of the site uses. If you are debugging a specific failure, the troubleshooting cluster is a better starting point. If you are choosing software, go to the reverse proxy comparison.
Where to start#
- New to the subject: read what a proxy server actually does first. It is the map for everything else.
- You keep hearing "forward" and "reverse" and want the real distinction: forward proxy vs reverse proxy settles it on the wire, using the request target rather than a diagram.
- Someone told you a proxy and a VPN are the same thing: they are not, and proxy vs VPN vs NAT vs load balancer explains exactly which layer each one operates at and what that costs you.
- You are configuring client side proxying: PAC files and WPAD plus proxy authentication cover the two things that break in enterprise environments.
Every guide in this cluster#
- Forward proxy vs reverse proxyThe difference is who the proxy acts for and who knows it exists. Includes the absolute-form vs origin-form request line, auth, TLS and logging differences.
- HTTP CONNECT tunnelling explainedCONNECT turns an HTTP proxy into a blind TCP relay. The exact wire exchange, status codes, port policy, HTTP/2 extended CONNECT, MASQUE and failure modes.
- PAC files and WPADHow FindProxyForURL works, every helper function, return-string syntax and fallback, WPAD discovery via DHCP 252 and DNS, and why dnsResolve leaks.
- Proxy authentication (407, Basic, Kerberos, NTLM)407 versus 401, hop-by-hop Proxy-Authorization, Basic, Digest, Kerberos and connection-bound NTLM, plus the Java disabledSchemes trap over CONNECT.
- Proxy vs VPN vs NAT vs load balancerFour middleboxes compared by OSI layer, what they rewrite, whether they terminate connections, and what the origin server actually sees as the client IP.
- SOCKS5 vs HTTP proxySOCKS5 and HTTP proxies solve different problems. Handshake bytes, address types, UDP ASSOCIATE, socks5 vs socks5h DNS leaks, and a decision table.
- Transparent and intercepting proxiesHow traffic is diverted without client configuration, what interception breaks (TLS, HSTS, pinning, IP auth), how to detect it, and TPROXY vs REDIRECT.
- What a proxy server actually doesA proxy terminates one connection and originates another. Covers the accept-decide-rewrite-originate loop, L4 vs L7, TLS visibility and a proxy taxonomy.