Nordic APIs Engineering Blog

Ideas you will meet

Distributed Systems

Consensus, time, failure and the fundamentals of scale-out.

What we already know about this

Our own lessons on these ideas. Read them here before you start, so it makes sense.

• Networking and Web Security Deep Dive · 12 minProxies, NAT, VPNs and firewallsThe network middlemen: what forward and reverse proxies do, how NAT shares addresses, what a VPN protects and how firewalls decide what passes.Read hereClose

  Why middlemen exist

  Between a client and a server there are often several intermediaries. Each solves a different problem: hide, share, protect or control. Knowing which is which keeps architecture diagrams honest.

  Forward proxy (acts for clients)

  A forward proxy sits in front of clients. Clients send requests to it and it fetches from the internet on their behalf.

  • Why: control and log outbound access (company networks), filter content, cache, hide client addresses, bypass regional limits.
  • Who knows what: the server sees the proxy, not the client.
  • Example: a company proxy that only allows approved sites; an egress proxy that lets servers call only listed external APIs.

  Reverse proxy (acts for servers)

  A reverse proxy sits in front of servers. Clients think they talk to the site; the proxy forwards to the right backend.

  • Why: TLS termination, load balancing, caching and compression, routing by host or path, hiding the internal layout, absorbing attacks and slow clients, adding headers.
  • Examples: NGINX, HAProxy, Envoy, cloud load balancers, CDNs (a CDN is a reverse proxy network).
  • An API gateway is a reverse proxy with API-specific policy (see the load balancing lesson).

  100%

  Figure SDA-NSD-02-1 · Forward and reverse proxies · © forcsguy.com

  Before: forward proxy

  100%

  After: reverse proxy

  100%

  What changed

  • A forward proxy acts for the clients, a reverse proxy acts for the servers
  • A reverse proxy hides and protects the backend
  • Both sit in the middle but face opposite ways

  NAT: sharing addresses

  IPv4 addresses are scarce. Network Address Translation (NAT) lets many devices with private addresses (10.x.x.x, 172.16-31.x.x, 192.168.x.x) share one public address. The NAT device rewrites the source address and port of outgoing packets and remembers the mapping to send replies back to the right device.

  • Side effect: devices behind NAT are not directly reachable from outside, which is a mild protection but not a firewall.
  • In the cloud, a NAT gateway lets private servers reach the internet (for updates and APIs) without being reachable from it.
  • NAT complicates peer-to-peer connections (hence STUN, TURN and ICE in video calls; see the real-time communication lesson).
  • IPv6 has enough addresses that NAT is not needed for scarcity.

  VPN: a private tunnel

  A virtual private network creates an encrypted tunnel across an untrusted network.

  • Remote access: staff connect to the company network from anywhere.
  • Site to site: two networks (office and cloud) are joined securely.
  • Privacy services: traffic is routed via a provider's server.
  • It protects traffic in transit between the endpoints; it does not make the endpoints themselves safe. Modern designs increasingly favour zero trust: authenticate every request to every service, rather than trusting "inside the network".

  Firewalls: allow or deny

  A firewall filters traffic by rules.

  • Packet filter / stateless: allow or deny by source and destination IP, port and protocol.
  • Stateful: remembers connections, so replies to allowed outbound traffic are allowed automatically.
  • Application-layer / WAF: understands HTTP and blocks known attack patterns (for example SQL injection attempts).
  • In the cloud: security groups (attached to instances, stateful) and network ACLs (on subnets, often stateless).

  100%

  Figure SDA-NSD-02-2 · Layered network defence for a web app · © forcsguy.com

  Principles: default deny, least privilege (open only needed ports to only needed sources), segment (separate tiers and environments), and log. A rule that says "allow all from anywhere" on a database port is a classic breach.

  Putting it together

  Device	Sits in front of	Main purpose
  Forward proxy	Clients	Control and anonymise outbound traffic
  Reverse proxy / load balancer	Servers	Route, protect, terminate TLS
  NAT	A private network	Share addresses, hide internals
  VPN	Two endpoints or networks	Encrypted tunnel over untrusted links
  Firewall	A network or host	Allow or deny traffic by rules

  Common mistakes

  Treating NAT or a VPN as sufficient security; databases reachable from the internet; no outbound restrictions (a compromised server can call anywhere); admin tools exposed publicly; and forgetting that a TLS-terminating proxy sees plain text and must itself be protected.

  Real-world reading

  Related reading

  • NGINX HTTP Load BalancingNGINX · F5 / NGINXDocumentation
  • Google SRE Book: Load Balancing in the DatacenterGoogle SRE team · GoogleBlogs
  • Load Balancing infrastructure to support more than 1.3 billion users at FacebookFacebook engineers · FacebookCase Studies
  • Scaling Load Balancing Infra to Support 1.3 Billion Users at Facebook - Patrick Shuff, Production Engineer at FacebookFacebookYouTube

  Show 6 moreShow fewer

  • Traffic Infrastructure (Edge Network) at DropboxDropbox engineers · DropboxCase Studies
  • Intelligent DNS based load balancing at DropboxDropbox engineers · DropboxCase Studies
  • Envoy ProxyEnvoy · CNCF / EnvoyGitHub
  • Top Five (Load Balancing) Scalability PatternsF5 engineers · F5Case Studies
  • Gaurav Sen: System Design PlaylistGaurav Sen · Gaurav Sen (YouTube)YouTube
  • Nordic APIs Engineering BlogNordic APIs engineers · Nordic APIsBlogs

  Open this lesson with its quiz and exercise