Reverse vs Forward Proxy — Open Proxy Exfiltrates Metadata

# Forward Proxy Configuration using Nginx + ngx_http_proxy_connect_module
# This turns Nginx into a forward proxy that corporate clients route through.
# NOTE: Standard Nginx doesn't support CONNECT (HTTPS tunneling) out of the box.
# You need the ngx_http_proxy_connect_module patch for full HTTPS support.
# This example shows HTTP forward proxying which works with vanilla Nginx.

server {
    # The port corporate clients point their browser proxy settings at
    listen 8888;

    # resolver is required so Nginx can resolve the destination hostname dynamically
    # 8.8.8.8 is Google's public DNS — replace with your internal DNS in production
    resolver 8.8.8.8;

    location / {
        # $http_host captures the destination host the client requested
        # $request_uri captures the full path and query string
        # Together they reconstruct the original target URL
        proxy_pass http://$http_host$request_uri;

        # Forward the real client IP in a custom header so destination servers
        # can log who actually made the request (optional, reduces anonymity)
        proxy_set_header X-Forwarded-For $remote_addr;

        # Pass along the original Host header so the destination server
        # knows which virtual host it's being asked for
        proxy_set_header Host $http_host;
    }

    # Block access to internal/private IP ranges — critical security rule.
    # Without this, an attacker could use YOUR proxy to attack your own internal network
    # (known as Server-Side Request Forgery, SSRF)
    location ~* ^http://(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.) {
        # Return 403 Forbidden for any request targeting private IP space
        return 403 "Access to private network ranges is blocked";
    }
}

# Production-style Reverse Proxy Configuration
# This Nginx config sits in front of three application server instances
# and handles load balancing, SSL termination, and health checking.

# Define the pool of backend application servers
# Nginx will distribute requests across these using round-robin by default
upstream application_servers {
    # Each 'server' directive points to a running application instance
    # These could be Node.js, Python/Gunicorn, Java/Spring — anything
    server 10.0.1.10:3000 weight=3;  # This server handles 3x the traffic (more powerful machine)
    server 10.0.1.11:3000 weight=1;  # Standard traffic share
    server 10.0.1.12:3000 weight=1;  # Standard traffic share

    # Health check: if a server fails to respond twice in 30 seconds, stop sending it traffic
    # Nginx will automatically recheck it every 30 seconds and re-add it when healthy
    server 10.0.1.13:3000 backup;    # Only used if ALL primary servers are down

    # Keepalive maintains persistent connections to backends — reduces TCP handshake overhead
    keepalive 32;
}

# Redirect all HTTP traffic to HTTPS — never serve your app unencrypted
server {
    listen 80;
    server_name api.yourapp.com;
    return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl http2;
    server_name api.yourapp.com;

    # SSL termination happens HERE at the proxy — backend servers talk plain HTTP internally
    # This offloads crypto work from your app servers (significant CPU saving at scale)
    ssl_certificate     /etc/ssl/certs/yourapp.crt;
    ssl_certificate_key /etc/ssl/private/yourapp.key;
    ssl_protocols       TLSv1.2 TLSv1.3;  # Never allow TLS 1.0 or 1.1 — they're broken

    # Security headers added here once, for ALL backends — not in each app separately
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    add_header X-Frame-Options DENY always;
    add_header X-Content-Type-Options nosniff always;

    # Rate limiting — block clients making more than 100 requests/second
    # This protects ALL backend servers centrally without touching app code
    limit_req zone=api_rate_limit burst=200 nodelay;

    location /api/ {
        # Hand the request off to our upstream pool
        proxy_pass http://application_servers;

        # Tell the backend the REAL client IP, not the proxy's IP
        # Your app needs this for logging, analytics, and fraud detection
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;  # Tell backend this came in over HTTPS

        # Pass the original hostname so the backend knows which virtual host was requested
        proxy_set_header Host $host;

        # Timeouts: don't let a slow backend server hang the proxy indefinitely
        proxy_connect_timeout 5s;   # Max time to establish connection to backend
        proxy_read_timeout    30s;  # Max time to wait for backend to send a response
        proxy_send_timeout    10s;  # Max time to send the request to backend
    }

    # Cache static assets at the proxy level — backends never even see these requests
    location /static/ {
        proxy_pass http://application_servers;
        proxy_cache_valid 200 7d;  # Cache successful responses for 7 days
        add_header X-Cache-Status $upstream_cache_status;  # Shows HIT or MISS in response
    }
}

# Full local demo: Forward proxy + Reverse proxy in the same Docker Compose setup
# Run: docker compose up
# This lets you see both proxy types operating simultaneously on your machine

version: '3.9'

services:

  # ── REVERSE PROXY (public-facing) ──────────────────────────────────────────
  # This is what the internet hits. It knows nothing about which backend answers.
  reverse_proxy:
    image: nginx:alpine
    container_name: reverse_proxy
    ports:
      - "80:80"      # Exposed to the outside world (simulates public internet)
    volumes:
      - ./reverse_proxy.conf:/etc/nginx/conf.d/default.conf:ro
    networks:
      - public_network   # Faces the outside
      - private_network  # Can reach backend servers
    depends_on:
      - api_server_1
      - api_server_2

  # ── BACKEND API SERVERS (hidden from public) ────────────────────────────────
  # These servers are ONLY on the private network.
  # There is no way to reach them except through the reverse proxy.
  api_server_1:
    image: node:18-alpine
    container_name: api_server_1
    working_dir: /app
    volumes:
      - ./api_server.js:/app/server.js
    command: node server.js
    environment:
      SERVER_ID: "api-server-1"   # So we can see which server handled the request
      PORT: "3000"
    networks:
      - private_network            # NOT on public_network — completely hidden

  api_server_2:
    image: node:18-alpine
    container_name: api_server_2
    working_dir: /app
    volumes:
      - ./api_server.js:/app/server.js
    command: node server.js
    environment:
      SERVER_ID: "api-server-2"
      PORT: "3000"
    networks:
      - private_network            # NOT on public_network — completely hidden

  # ── FORWARD PROXY (internal clients use this to reach outside) ─────────────
  # Internal services that need to make outbound HTTP calls route through this.
  # It logs all outbound requests centrally and can block/allow by domain.
  forward_proxy:
    image: ubuntu/squid   # Squid is the industry standard forward proxy daemon
    container_name: forward_proxy
    ports:
      - "3128:3128"       # Standard Squid port — clients set HTTP_PROXY=http://forward_proxy:3128
    volumes:
      - ./squid.conf:/etc/squid/squid.conf:ro
    networks:
      - private_network   # Internal clients use this to reach the internet
      - public_network    # It needs internet access to fulfill those requests

  # ── INTERNAL CLIENT (simulates a service making outbound calls via forward proxy) ──
  # This could be a data pipeline, a webhook sender, a third-party API caller etc.
  internal_service:
    image: curlimages/curl:latest
    container_name: internal_service
    # Route ALL outbound HTTP traffic through the forward proxy
    environment:
      HTTP_PROXY: "http://forward_proxy:3128"
      HTTPS_PROXY: "http://forward_proxy:3128"
      NO_PROXY: "localhost,127.0.0.1,reverse_proxy"  # Don't proxy internal service-to-service calls
    networks:
      - private_network   # Only on private network — can't reach internet directly
    command: sh -c "sleep 5 && curl -s http://httpbin.org/ip"  # Test: what IP does the internet see?

networks:
  public_network:    # Represents the internet-facing network
    driver: bridge
  private_network:   # Represents your internal datacenter network
    driver: bridge
    internal: false  # Set to true in production to truly block direct internet egress

# Forward proxy config (simplified)
# Client sends: GET http://example.com/path HTTP/1.1
server {
    listen 8888;
    resolver 8.8.8.8;
    location / {
        proxy_pass http://$http_host$request_uri;   # Full URL
        proxy_set_header Host $http_host;
    }
}

# Reverse proxy config (simplified)
# Client sends: GET /path HTTP/1.1  (Host: api.example.com)
upstream backend {
    server 10.0.1.10:3000;
}
server {
    listen 443 ssl;
    server_name api.example.com;
    location / {
        proxy_pass http://backend;                # Just the upstream
        proxy_set_header Host $host;               # Original host header
    }
}