The Fundamental Knowledge of System Design — (7) — Proxy
Proxy — Network Proxy, is a special network service that allows a network terminal, especially a client application to make an indirect connection with another network terminal especially a server through the proxy. Proxy services help to protect the privacy or security of network terminals and prevent attacks. The network devices such as gateways and routers will have built-in network proxy services.
It is the seventh series of the fundamentals knowledge of system design. You can read my previous articles.
A proxy is a server that acts as a gateway between you (client) and the Internet. You (client) establish a connection with the proxy server and then request to create a connection to the target server or obtain the specified resources (such as a file or web page) of the target server according to the proxy protocol used by the proxy server. The proxy server may download the resources of the target server to its local cache of the proxy server. Then, the proxy server will directly return the cached resources to the client application. Otherwise, the requests will be sent to the website directly without the proxy services. However, with the proxy service, the proxy server will replace your real IP address with another IP address, and then sends the request to the target server. So, a proxy server is an encrypted anonymous proxy that not only changes your IP address but also encrypts your Internet browsing session to keep you safe and protected by SSL ( Secure Sockets Layer encryption and decryption between the client and the server). It can prevent unwanted information from being obtained or data collection.
There are 2 types of proxy servers:
- Forward Proxy Server
- It does not have the ability to directly respond to the request and forwards the request to the targeted server, and then obtain the response from the targeted server and forward it to the client (requester), that is browser.
- For example, you can enter the domain name “http://medium.com/, through the DNS system browser, then you can know the corresponding IP address. Also, you must configure the proxy server to tell the browser.
- Is direct access to the webpage not good? It is because of security audit and control considerations. In some organizations, there is an intranet proxy server designated for you to access the Internet.
- Of course, the proxy server itself is not restricted, it can access the external network. However, all your Internet requests go through the proxy server, and this proxy is controlled by the organization, and all requests can be audited.
- For example, the organization will check if you upload confidential information inside the organization to an external website, if you have visited an unsafe website, visiting some webpage that is not related to work, so they will block you.
- Also, the proxy server can cache the webpage for speeding up or saving bandwidth. Hence, when you want to visit the webpage again, the proxy server directly returns the cached webpage.
- Some advanced proxy plug-ins also allow you to configure specific rules, that is, you can configure which addresses go through the proxy, with some predefined rules, whitelists, blacklists, and custom rules.
2. Reverse Proxy Server
- The big difference between a reverse proxy and a forward proxy is that it does not require the client (browser) to do any configuration, and there is no operation to configure the proxy server. If it is the reverse proxy, then the browser does not know if it is proxied by itself, and the browser thinks that the request can be directly sent to the final web server, but it is actually just a “proxy”.
- NGINX is open-source software for web serving, reverse proxying, caching, load balancing, media streaming, and more. It started out as a web server designed for maximum performance and stability. In addition to its HTTP server capabilities, NGINX can also function as a proxy server for email (IMAP, POP3, and SMTP) and a reverse proxy and load balancer for HTTP, TCP, and UDP servers
- There are 2 protocols.
- Common Gateway Interface (CGI)
- FastCGI Process Manager (FPM)
For details, please refer to the official document “PHP: FPM installation”.
- Nginx translates all PHP requests into FastCGI requests and then sends them to the targeted server.
- So, the configuration file must convey the message clearly between Nginx and FPM.
- From the perspective of the external browser, the request is sent directly to the Nginx server, and the response is returned from the Nginx server without any forward proxy in the middle.
- From the perspective of the system designer, Nginx is actually incapable of responding to many requests.
- Is direct access to the webpage not good? It is because the reverse proxy can be used as a method of internal load balancing.
- After a period of time, the traffic may increase, and the webserver cannot handle it. If a lot of requests are flooded at the same time, Nginx will send half of the requests to the webserver on 2 different ports.
- Eventually, all requests are handled by Nginx, users don’t need to know the existence of applications on different ports.
- If you have multiple hosts, for example, one runs Nginx listening on port 80, and the other two run tomcat, monitor ports 8080 and 8081 respectively, and accept and process requests.
- The performance of the load balancer can be improved by adjusting the load ratio so that the port with stronger performance can take on more requests.
- A reverse proxy server can hide IP addresses on the internal network from external users, and determine if users can obtain the resources from the web pages. Hence, it is difficult for hackers to attack internal servers.
- With the functions of load balancing, it can spread data among internal servers, thereby preventing the overloading of servers caused by a large number of requests.
References
If you’ve found any of my articles helpful or useful then please consider throwing a coffee my way to help support my work or give me patronage😊, by using
Last but not least, if you are not a Medium Member yet and plan to become one, I kindly ask you to do so using the following link. I will receive a portion of your membership fee at no additional cost to you.
It is my first affiliate program, if you like to further enhance your system knowledge, you can click the links and buy the course. Honestly speaking, I will receive 20% of your course fees at no additional cost to you. You will have unlimited access to our courses. There is no time expiry and you will have access to all future updates free of cost.