正向代理 forward proxy、反向代理 reverse proxy、透明代理 transparent proxy

 

https://zh.wikipedia.org/wiki/反向代理

 

反向代理在计算机网络中是代理服务器的一种。服务器根据客户端的请求，从其关系的一组或多组后端服务器（如Web服务器）上获取资源，然后再将这些资源返回给客户端，客户端只会得知反向代理的IP地址，而不知道在代理服务器后面的服务器集群的存在^[1]。

与前向代理不同，前向代理作为客户端的代理，将从互联网上获取的资源返回给一个或多个的客户端，服务端（如Web服务器）只知道代理的IP地址而不知道客户端的IP地址；而反向代理是作为服务器端（如Web服务器）的代理使用，而不是客户端。客户端借由前向代理可以间接访问很多不同互联网服务器（集群）的资源，而反向代理是供很多客户端都通过它间接访问不同后端服务器上的资源，而不需要知道这些后端服务器的存在，而以为所有资源都来自于这个反向代理服务器。

反向代理在现时的互联网中并不少见，而另一些例子，像是CDN、SNI代理等，是反向代理结合DNS的一类延伸应用。

 

反向代理的主要作用为：

• 对客户端隐藏服务器（集群）的IP地址
• 安全：作为应用层防火墙，为网站提供对基于Web的攻击行为（例如DoS/DDoS）的防护，更容易排查恶意软件等
• 为后端服务器（集群）统一提供加密和SSL加速（如SSL终端代理）
• 负载均衡，若服务器集群中有负荷较高者，反向代理通过URL重写，根据连线请求从负荷较低者获取与所需相同的资源或备援
• 对于静态内容及短时间内有大量访问请求的动态内容提供缓存服务
• 对一些内容进行压缩，以节约带宽或为网络带宽不佳的网络提供服务
• 减速上传
• 为在私有网络下（如局域网）的服务器集群提供NAT穿透及外网发布服务
• 提供HTTP访问认证^[2]
• 突破互联网封锁（不常用，因为反向代理与客户端之间的连线不一定是加密连线，非加密连线仍有遭内容审查进而遭封禁的风险；此外面对针对域名的关键字过滤、DNS缓存污染/投毒攻击乃至深度数据包检测也无能为力）

 

常见反向代理软件

• Nginx、Tengine
• Apache HTTP Server
• Varnish cache
• Squid Cache
• Traffic Server
• HAProxy
• YXORP
• Polipo
• Privoxy
• IIS

 

http://httpd.apache.org/docs/2.0/mod/mod_proxy.html#forwardreverse

 

Forward and Reverse Proxies

 

Apache can be configured in both a forward and reverse proxy mode.

 

An ordinary forward proxy is an intermediate server that sits between the client and the origin server. In order to get content from the origin server, the client sends a request to the proxy naming the origin server as the target and the proxy then requests the content from the origin server and returns it to the client. The client must be specially configured to use the forward proxy to access other sites.

 

A typical usage of a forward proxy is to provide Internet access to internal clients that are otherwise restricted by a firewall. The forward proxy can also use caching (as provided by mod_cache) to reduce network usage.

 

The forward proxy is activated using the ProxyRequests directive. Because forward proxys allow clients to access arbitrary sites through your server and to hide their true origin, it is essential that you secure your server so that only authorized clients can access the proxy before activating a forward proxy.

 

A reverse proxy, by contrast, appears to the client just like an ordinary web server. No special configuration on the client is necessary. The client makes ordinary requests for content in the name-space of the reverse proxy. The reverse proxy then decides where to send those requests, and returns the content as if it was itself the origin.

 

A typical usage of a reverse proxy is to provide Internet users access to a server that is behind a firewall. Reverse proxies can also be used to balance load among several back-end servers, or to provide caching for a slower back-end server. In addition, reverse proxies can be used simply to bring several servers into the same URL space.

 

A reverse proxy is activated using the ProxyPass directive or the [P] flag to the RewriteRule directive. It is not necessary to turn ProxyRequests on in order to configure a reverse proxy.