What Is a Proxy Server and How Does It Work?

What is a proxy server?

At 3 a.m., a proxy problem rarely announces itself as a proxy problem. You usually get a vague timeout, a failed API request, or an application that works from your laptop but not from the VPS.

A proxy server sits between a client and a destination server. It sends requests on the client’s behalf, so the destination usually sees the proxy’s IP address rather than the client’s own address. Depending on how it is configured, a proxy can control access, cache content, record traffic, filter requests, or provide limited privacy. It does not guarantee anonymity or security.

I used to think of a proxy as simply “a service that changes your IP address.” That view caused me trouble early in hosting. While investigating why an application on a VPS could not reach an external API, I found that the application was fine; an enforced outbound proxy rule was controlling the connection. Changing the apparent IP address without understanding the proxy only moves the failure to another layer.

How does a proxy server work?

With a direct web request, a browser resolves the destination name, opens a connection to the destination server, and sends the HTTP request. A proxy changes that path:

1. The client connects to the proxy server.
2. The proxy opens its own connection to the requested destination.
3. The proxy sends the destination’s response back to the client.

For example, instead of connecting directly to example.com, your browser may connect to proxy.example.net:8080. The HTTP proxy receives the request and creates the connection to the destination. In many cases, the destination server sees the proxy’s IP address instead of the client’s public IP address.

That qualification matters. A proxy can add X-Forwarded-For, Forwarded, or similar headers. The proxy operator may use them to tell the destination your original IP address, and the provider may keep connection logs. Hiding one address does not hide your identity at every layer.

At which layer is the request forwarded?

HTTP proxies operate at the application layer and understand HTTP requests. For HTTPS, the client commonly sends a CONNECT request to the proxy. The proxy then opens a TCP connection to the destination and carries the encrypted TLS session through that connection.

If TLS continues between the client and the destination, the proxy cannot read the HTTPS content. It can still see connection metadata such as the destination address, timing, and traffic volume.

A corporate proxy that terminates TLS is different. It can decrypt and inspect the traffic, which requires the organisation’s certificate authority to be installed on client devices. If certificate validation is configured incorrectly, browsers show warnings. Worse, users can become accustomed to ignoring those warnings.

What types of proxy servers are there?

“Proxy” is not one single technology. The type depends on how it is used and which direction the traffic travels.

Forward proxy

A forward proxy represents clients going out to the internet. Companies use it to filter employee access, restrict permitted domains, monitor bandwidth, or cache frequently requested files. The clients know about the proxy and send their requests to it.

Reverse proxy

A reverse proxy sits in front of servers. Visitors connect to the reverse proxy, which passes their requests to an application behind it. Nginx, HAProxy, Traefik, and Caddy are common choices for this role.

When I put Nginx in front of a web application on a VPS, I can keep TLS termination, host-based routing, static file delivery, and basic rate limiting separate from the application. That still has a resource cost. You need to account for RAM, connection counts, and network capacity, as discussed in What Is a VPS and What Is It Used For? A Detailed Beginner’s Guide.

HTTP and HTTPS proxies

An HTTP proxy can interpret HTTP requests. For HTTPS, it usually creates an encrypted tunnel with the CONNECT method. A proxy that supports HTTPS does not necessarily read the data between the client and the destination.

SOCKS4 and SOCKS5 proxies

SOCKS can forward TCP connections without being tied to one particular application protocol. SOCKS5 can also forward UDP traffic, although support depends on the client and proxy implementation. The ssh -D option creates a SOCKS5-compatible listening point on your local machine:

ssh -N -D 127.0.0.1:1080 [email protected]

This does not install a web proxy service on the remote server. It opens a local port and sends SOCKS traffic through the SSH tunnel. -N tells SSH not to run a remote command, while -D enables dynamic port forwarding.

You can test the tunnel with a tool that supports SOCKS5:

curl --proxy socks5h://127.0.0.1:1080 https://ifconfig.me

With socks5h, DNS resolution also takes place through the proxy. With plain socks5, the client may resolve the hostname locally. That small distinction often explains the question, “My IP changed, so why is the DNS request still coming from my local network?”

Transparent proxy

A transparent proxy intercepts traffic without requiring a separate proxy setting on the client. You may find this in corporate networks, ISP infrastructure, or security appliances. A user may not realise that an HTTP request passed through a proxy.

For HTTPS, transparent forwarding can create a tunnel without inspecting the content. TLS inspection requires certificate installation and an explicit policy. There is a difference.

What is a proxy server used for?

• Access control: Block particular domains, URL paths, or content categories.
• Reverse proxying and load distribution: Send requests to multiple application servers.
• Caching: Avoid fetching unchanged static content from the backend repeatedly.
• IP policies: Make a destination accept connections only from approved egress IPs.
• Monitoring and logging: Record which client connected to which destination and when.
• Security layering: Filter traffic before it reaches an application server exposed to the internet.
• Publishing internal services: Expose applications on a private network through a domain name and TLS.

The purpose of the proxy changes the security assessment. A reverse proxy can give you a cleaner architecture than exposing an application directly, but it does not repair an authentication flaw in that application. A forward proxy does not make harmful content safe by itself.

What is the difference between a proxy and a VPN?

A proxy usually handles traffic from a particular application or protocol. A VPN creates a tunnel at the operating-system level and can carry a broader set of traffic. The details depend on the software and its routing configuration.

An application without SOCKS support cannot use a SOCKS proxy directly, while a system-level VPN client generally does not require each application to understand the tunnel.

A VPN is not automatically anonymous because it is encrypted. The VPN provider may see connection metadata, and a proxy operator may record traffic passing through the service. Asking only “which one is safer?” skips the trust model.

How do you test a proxy on Linux?

First, verify that the connection is actually using the proxy. I prefer a small terminal test over trusting a browser setting. For tools that use environment variables:

export HTTP_PROXY=http://proxy.example.net:8080
export HTTPS_PROXY=http://proxy.example.net:8080
curl -I https://example.com

The -I option requests only the HTTP headers, so it gives you a quick check without downloading the response body. The proxy URL for HTTPS_PROXY can still begin with http:// when the client uses an HTTP proxy and sends an HTTPS destination through CONNECT.

If authentication is required, use a protected configuration file or a secret variable instead of putting the username and password directly in the command. I once left a test credential in shell history because I was moving too quickly. It was harmless, but the lesson was not: check where secrets land before you press Enter.

To compare the visible egress address without and with the proxy:

curl https://ifconfig.me
curl --proxy http://proxy.example.net:8080 https://ifconfig.me

The second command should show the proxy’s egress IP. If both commands return the same address, the proxy may not be working, although the destination service could also be treating both requests the same way. I check the proxy logs and curl -v output instead of deciding from one website’s response.

curl -v --proxy http://proxy.example.net:8080 https://example.com

The -v option shows the connection flow in detail. For an HTTPS request, you should see a line such as CONNECT example.com:443 sent to the proxy. Do not share passwords, cookies, or access tokens in the output. I read terminal output twice before pasting it into a support ticket.

A simple Nginx reverse proxy example

Assume an application listens only on 127.0.0.1:3000. Nginx can accept external connections and pass the requests to that application:

server {
    listen 80;
    server_name app.example.com;

    location / {
        proxy_pass http://127.0.0.1:3000;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

Host and X-Forwarded-For help the application understand the requested domain and client address chain. The application should not trust these headers unconditionally. Configure it to accept forwarded values only from a reverse proxy you control.

Before enabling a configuration, I check its syntax:

sudo nginx -t
sudo systemctl reload nginx

reload asks Nginx to load the new configuration while preserving existing connections as far as possible. Early in my hosting years, my habit was “edit the file, restart the service.” An unnecessary restart can turn a small configuration change into a short outage. Test first, then reload.

If you publish this reverse proxy over HTTPS, check the DNS record, certificate, and the application’s handling of proxy headers together. The resolution and connection layers described in Demystifying Internet Protocols: From TCP/IP to HTTP/3 make this part much easier to reason about.

Is a free and open proxy safe to use?

“Free” is not a security feature. With an open proxy, you may not know who operates it, whether it records traffic, or whether it injects advertisements or malicious code. Sending usernames, passwords, session cookies, or API keys over plain HTTP is especially risky.

HTTPS does not make everything between you and the destination invisible to the proxy. The proxy may see connection times, the destination name, data volume, and the client IP. If TLS is terminated there, it may inspect the content too. Ignoring a certificate warning defeats much of the protection you expected from the connection.

• Do not send credentials over plain HTTP.
• Read the proxy provider’s logging and privacy policy.
• Do not send production API keys through a random proxy.
• Apply current operating-system updates, firewall rules, and access controls to your proxy server.
• Do not run an unauthenticated open proxy.
• For business use, define log retention and access permissions in writing.

If your proxy runs on an internet-facing VPS, it can become a free exit point for attackers. Allow access only from approved client networks, use strong authentication, and limit connection counts. A proxy is not DDoS protection; the basic safeguards in What Is a DDoS Attack? A Practical VPS Protection Guide are still relevant.

What should you check when choosing a proxy?

Start with the actual requirement. Routing one browser’s requests is not the same job as carrying outbound traffic for hundreds of users.

Do not judge performance by ping time alone. Destination response time, per-connection latency, concurrent connection limits, bandwidth, and disk usage all matter. Sending large files through a proxy can affect VPS bandwidth costs or quotas, so VPS Bandwidth Explained: How Much Do You Need? is worth checking before you size the service.

Common proxy mistakes

• Assuming a proxy means anonymity: Your IP may change, but accounts, cookies, browser fingerprints, and logs can still connect the activity to you.
• Sending everything through one proxy: A failure at one critical egress point can affect every application.
• Ignoring DNS leaks: With SOCKS5, verify where name resolution happens.
• Keeping logs forever: Unnecessary personal data increases the security burden.
• Reading the real client IP incorrectly behind a reverse proxy: Application and web-server log formats must handle forwarded headers correctly.
• Deploying without testing: Start with a small client group and test status codes, timeouts, and large responses.

During one of my first hosting shifts, a customer reported that a VPS could not reach an external API. The application log contained only a generic connection error. I initially considered restarting the application; yes, I had that reflex too. Then I checked the proxy variables in env and the gateway connection records. The mandatory proxy was disabled, so requests were trying to leave directly. Fixing the rule solved the problem without touching the application.

That incident left me with a simple habit: read the logs before restarting anything. A restart can hide the useful evidence and create noise instead of a diagnosis.

When I evaluate a web proxy, I also check what it can and cannot protect because not every intermediary works like a VPN. I explain the practical differences and safety checks in [What Is Ktunnel Proxy and Is It Safe to Use?].

Frequently asked questions

Does using a proxy hide my IP address?

The destination server will usually see the proxy’s egress IP, but the proxy operator may know your client IP. HTTP headers, account details, and connection records can also associate the activity with you.

Are a proxy and a VPN the same thing?

No. A proxy usually routes traffic from a particular application, while a VPN can create a tunnel at the operating-system level. The scope varies by protocol and configuration, and the privacy level still depends on how the provider operates the service.

Does a SOCKS5 proxy encrypt HTTPS traffic?

SOCKS5 is a forwarding protocol and does not provide end-to-end encryption by itself. When you use HTTPS, TLS encrypts the connection between the client and destination; SOCKS5 only carries that connection through the proxy.

Why use a reverse proxy?

A reverse proxy forwards client connections to an application server and can handle TLS termination, host-based routing, caching, or rate limiting at the edge. It does not fix application vulnerabilities by itself. Treat it as a front layer that still needs careful configuration.