Proxy Servers - Intermediaries for Network Traffic

About 2 min read

A proxy is a server that sits between the client and the server and relays communication. As its name ("proxy," meaning agent) suggests, it sends requests and returns responses on behalf of the client. It is used for a variety of purposes, including access control in corporate networks, speedups through caching, and ensuring anonymity. Combined with a firewall, it becomes an important component of network security.

Forward Proxy and Reverse Proxy

Direction of Communication and What Happens at the Relay Point

In either direction, the communication always passes through the relay point. That is why who set up the relay point is itself the premise of your trust.

Use in Enterprises

In a corporate network, a forward proxy plays multiple roles. Through content filtering, it restricts access to sites inappropriate for work. By logging all communication, it can be used for investigating data leaks and for compliance audits. Through caching, it speeds up repeated access to the same content and saves bandwidth. Our article on remote work security also explains access control from outside the company.

Transparent Proxy and Explicit Proxy

An explicit proxy is one whose address is set manually in the browser or application. The user is aware of the proxy's existence. A transparent proxy, on the other hand, relays communication automatically at the level of network equipment, so the user needs no configuration and is not aware of the proxy's existence. Captive portals that display a terms-of-use page on public Wi-Fi or hotel networks are also a type of transparent proxy.

The Difference from a VPN

Our article on the basics of VPNs and how to choose one explains in detail how VPNs work and the key points for selecting one.

Security Risks

Because a proxy is a relay point for communication, routing traffic through a malicious proxy carries the risk of a man-in-the-middle attack. Some free proxy services intercept the content of communication to insert advertisements or to steal credentials. With HTTPS communication, the proxy cannot read the contents of the data, but corporate proxies with an SSL inspection feature can inspect the contents because they decrypt and re-encrypt HTTPS communication using their own certificates. Please also refer to our article on public Wi-Fi security.

Where Misuse Behind Legitimate Logins Shows Up

Unauthorized access using stolen credentials or accounts that were never deactivated is indistinguishable from a normal login at the authentication stage — the password and the procedure are both legitimate. Such misuse shows up in what happens afterwards: in behavior, that is, where the traffic goes and what it sends. This is where the structure of a relay point pays off. When the network's exit is consolidated into a proxy, all outbound communication necessarily passes a single observation point, so the records are complete by construction. Moreover, the records are kept on the relay side rather than on the endpoint, so whoever hijacked the account can neither erase nor tamper with them. Catching misuse that slipped past authentication by its behavior requires records that cover every flow without exception and sit beyond the attacker's reach — and a proxy satisfies both conditions structurally.