What Is a Reverse Proxy?

In modern web architecture, application servers (like Node.js, Python Flask, Ruby on Rails, or Java Spring) rarely interact directly with the public Internet. Instead, incoming web requests pass through a intermediate component known as a Reverse Proxy.

In this guide, we explore what a reverse proxy is, how it differs from a forward proxy, and how to use Nginx as a reverse proxy on your RivinCloud VPS.

1. Forward Proxy vs Reverse Proxy

FORWARD PROXY (Protects Clients)
[ Client A ] ──┐
[ Client B ] ──┼──► [ Forward Proxy ] ──► Internet / External Web
[ Client C ] ──┘     (Masks Client IPs)

REVERSE PROXY (Protects Servers)
Internet /      ──► [ Reverse Proxy ] ──┬──► [ App Server 1 (Node.js) ]
Web Visitors         (Nginx / HAProxy)  ├──► [ App Server 2 (Python)  ]
                     (Masks Server IPs) └──► [ App Server 3 (Go)      ]

• Forward Proxy: Sits in front of client browsers (e.g. an office VPN or anonymizing proxy) to intercept outgoing internet requests and hide client identities.
• Reverse Proxy: Sits in front of one or more backend web servers to intercept incoming requests and route them to appropriate internal services.

2. Key Benefits of a Reverse Proxy

1. SSL/TLS Termination: Decrypting HTTPS certificates is CPU-intensive. A reverse proxy handles TLS decryption at the edge, allowing backend applications to run plain HTTP locally.
2. Load Balancing: Distributes incoming traffic across multiple backend app instances to prevent server overload.
3. Security & Anonymity: Hides internal backend IP addresses and infrastructure ports from public visibility.
4. Static Content Caching: Caches static images, CSS, and JS files directly in memory, serving them instantly without triggering backend code execution.

3. Basic Nginx Reverse Proxy Configuration

Here is how Nginx forwards incoming requests on port 80 to a Node.js application running locally on port 3000:

server {
    listen 80;
    server_name api.example.com;

    location / {
        proxy_pass http://127.0.0.1:3000;
        
        # Forward original client headers
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

Command of the Day: curl -I

The curl command with -I (or --head) requests only the HTTP headers from a web server.

Syntax

curl -I [URL]

Practical Example

curl -I https://rivincloud.in

Sample Output

HTTP/2 200
server: nginx
date: Mon, 28 Sep 2026 14:30:00 GMT
content-type: text/html; charset=UTF-8
strict-transport-security: max-age=31536000

Explanation

Inspecting response headers verifies whether Nginx, Cloudflare, or HAProxy is serving as the reverse proxy in front of a website.

Common Mistakes

• Forgetting proxy_set_header X-Real-IP: Without forwarding client headers, backend application logs will record 127.0.0.1 as the user IP for every incoming visitor!
• Not setting WebSocket upgrade headers: WebSockets (like Socket.io or Discord gateways) require explicit Upgrade headers in Nginx to maintain connection upgrade handshakes.

Troubleshooting

• 502 Bad Gateway: Nginx is working, but the backend application service on port 3000 is stopped or unreachable. Verify backend service status:

  sudo systemctl status myapp
  # Or check PM2:
  pm2 status
  

Best Practices

• Always terminate SSL/TLS at the reverse proxy layer using Certbot.
• Enable proxy_cache for high-traffic read-only API endpoints.

Frequently Asked Questions

What software can be used as a reverse proxy?

Nginx, HAProxy, Traefik, Apache (mod_proxy), Caddy, and Envoy are popular open-source reverse proxy engines.

Conclusion

Reverse proxies improve security, speed, and scalability for web applications. Configure Nginx as a reverse proxy on your RivinCloud VPS today!