Proxies, NAT, VPNs and firewalls

Why middlemen exist

Between a client and a server there are often several intermediaries. Each solves a different problem: hide, share, protect or control. Knowing which is which keeps architecture diagrams honest.

Forward proxy (acts for clients)

A forward proxy sits in front of clients. Clients send requests to it and it fetches from the internet on their behalf.

• Why: control and log outbound access (company networks), filter content, cache, hide client addresses, bypass regional limits.
• Who knows what: the server sees the proxy, not the client.
• Example: a company proxy that only allows approved sites; an egress proxy that lets servers call only listed external APIs.

Reverse proxy (acts for servers)

A reverse proxy sits in front of servers. Clients think they talk to the site; the proxy forwards to the right backend.

• Why: TLS termination, load balancing, caching and compression, routing by host or path, hiding the internal layout, absorbing attacks and slow clients, adding headers.
• Examples: NGINX, HAProxy, Envoy, cloud load balancers, CDNs (a CDN is a reverse proxy network).
• An API gateway is a reverse proxy with API-specific policy (see the load balancing lesson).

100%

Figure SDA-NSD-02-1 · Forward and reverse proxies · © forcsguy.com

NAT: sharing addresses

IPv4 addresses are scarce. Network Address Translation (NAT) lets many devices with private addresses (10.x.x.x, 172.16-31.x.x, 192.168.x.x) share one public address. The NAT device rewrites the source address and port of outgoing packets and remembers the mapping to send replies back to the right device.

• Side effect: devices behind NAT are not directly reachable from outside, which is a mild protection but not a firewall.
• In the cloud, a NAT gateway lets private servers reach the internet (for updates and APIs) without being reachable from it.
• NAT complicates peer-to-peer connections (hence STUN, TURN and ICE in video calls; see the real-time communication lesson).
• IPv6 has enough addresses that NAT is not needed for scarcity.

VPN: a private tunnel

A virtual private network creates an encrypted tunnel across an untrusted network.

• Remote access: staff connect to the company network from anywhere.
• Site to site: two networks (office and cloud) are joined securely.
• Privacy services: traffic is routed via a provider's server.
• It protects traffic in transit between the endpoints; it does not make the endpoints themselves safe. Modern designs increasingly favour zero trust: authenticate every request to every service, rather than trusting "inside the network".

Firewalls: allow or deny

A firewall filters traffic by rules.

• Packet filter / stateless: allow or deny by source and destination IP, port and protocol.
• Stateful: remembers connections, so replies to allowed outbound traffic are allowed automatically.
• Application-layer / WAF: understands HTTP and blocks known attack patterns (for example SQL injection attempts).
• In the cloud: security groups (attached to instances, stateful) and network ACLs (on subnets, often stateless).

100%

Figure SDA-NSD-02-2 · Layered network defence for a web app · © forcsguy.com

Principles: default deny, least privilege (open only needed ports to only needed sources), segment (separate tiers and environments), and log. A rule that says "allow all from anywhere" on a database port is a classic breach.

Putting it together

Device	Sits in front of	Main purpose
Forward proxy	Clients	Control and anonymise outbound traffic
Reverse proxy / load balancer	Servers	Route, protect, terminate TLS
NAT	A private network	Share addresses, hide internals
VPN	Two endpoints or networks	Encrypted tunnel over untrusted links
Firewall	A network or host	Allow or deny traffic by rules

Common mistakes

Treating NAT or a VPN as sufficient security; databases reachable from the internet; no outbound restrictions (a compromised server can call anywhere); admin tools exposed publicly; and forgetting that a TLS-terminating proxy sees plain text and must itself be protected.

Real-world reading