Forward proxy vs. reverse proxy
Same three boxes every time: a client, a proxy, a server. The only thing that changes is whose side the middle one is on — and everything else follows from that. Send a request through each arrangement and watch it hop by hop. Everything is simulated in this tab: no connection is opened, no name is resolved, nothing is sent anywhere.
Six words this lab leans on, in case any of them are new. Skip if not — the diagram works without them.
Flip the arrangement and send it again — the contrast is the point, so run one and then the other. Click any hop to jump to it. The addresses come from the ranges reserved for documentation, the proxy names are invented, and the request and response lines are drawn from the protocol documents rather than captured from a wire.
The caveats
Where this comes from
Architecture and protocol behavior, not any one vendor's implementation. Forward and reverse describe where a proxy sits and who put it there, so the same software shows up in both roles.
Related
A forward proxy only handles the clients somebody configured, and the PAC file tester is where that configuration gets written and checked. What happens when a forward proxy stops relaying and starts terminating is the TLS inspection lab. Whether an origin should believe the client address a reverse proxy puts in a header is the Cloudflare edge lab.
get the PAC cheat sheet
One page: the debugging order, the classic mistakes, the pattern gotchas, and the client behavior that catches people out. Confirm your email and it's yours straight away — plus a note when a new tool lands.
ack — check your inbox for a confirmation link.
One confirmation email, then you're in. Unsubscribe anytime.