A forward proxy is a proxy server that sends a client's requests to websites on the client's behalf, so the websites see the proxy's IP address instead of the client's. It is often just called a proxy. Residential, datacenter, mobile and ISP proxies are all forward proxies.

How a Forward Proxy Works

  1. The client chooses the proxy. The HTTP standard (RFC 9110) defines a proxy as an agent chosen by the client, usually through local configuration such as browser or system settings, a PAC file, or a scraper's code.
  2. Plain HTTP requests carry the full URL. The client sends the complete address to the proxy, for example GET http://www.example.org/pub/WWW/TheProject.html HTTP/1.1, so the proxy knows which server to contact.
  3. HTTPS requests use a tunnel. The client sends CONNECT host:443, and the proxy relays the encrypted traffic as a blind relay without changing the messages.
  4. The proxy returns the response. The website answers the proxy, and the proxy passes the response back to the client.

What Forward Proxies Are Used For

  • Hiding the client's IP address: MDN notes that forward proxies can be anonymous and let users hide their IP address. Tor, for example, routes traffic through multiple proxies.
  • Web scraping and IP rotation: a script can send each session through a different proxy, which is the basis of IP rotation.
  • Location-specific results: choosing a proxy in a given country or city lets you see what users there see, known as geo-targeting.
  • Internet access for internal networks: Apache's docs describe giving internet access to internal clients that are otherwise restricted by a firewall.
  • Caching: a forward proxy can store and reuse content to reduce bandwidth use for a group of users.

Explicit vs. Transparent Forward Proxies

  • Explicit proxy: the client is configured to use the proxy and sends its requests to it directly.
  • Transparent proxy: the client isn't configured at all. The network intercepts its traffic and sends it through the proxy. RFC 9110 calls this an interception proxy and notes that it is not chosen by the client.

Forward Proxy vs. Reverse Proxy

Forward proxyReverse proxy
Acts forThe clientThe server
Set up byThe user or client appThe site's operator
Client configurationRequired (unless transparent)None
HidesThe client's identity from serversThe servers' identities from clients

A reverse proxy works in the other direction: it receives requests on behalf of the site's own servers.

Security Considerations

  • Open proxies: Apache's docs warn that a forward proxy lets clients reach arbitrary sites through your server and hide their true origin, so only authorized clients should be allowed to use it. MDN notes there are likely hundreds of thousands of open forward proxies on the internet.
  • What the operator can see: the proxy can read and modify plain HTTP traffic. HTTPS traffic in a CONNECT tunnel stays encrypted unless the proxy is set up to intercept TLS.