What is a Proxy Server?

By Stephen Bucaro

A proxy server is a piece of software that works at the Application layer of the OSI model to increase the security of a network. A proxy server acts as an intermediary between the internal network and external networks.

For example all requests from the clients on the internal network to the Internet go to the proxy server first. The proxy server analyzes them, and if allowed, sends the requests on to the Internet. Similarly, a response from the Internet to a client on the internal network go to the proxy server first. If allowed, the proxy server sends the response on to the clients on the internal network.

The clients on the internal network and the host on the Internet think they are communicating directly with one another, but in reality, the proxy server is acting as an intermediary. A proxy server has two network interfaces and two IP addresses.

Proxy servers usually use network address translation (NAT), to hide the IP addresses of the client machines on the internal network. An outside network sees only the IP address of the outbound proxy server interface. The IP address of the client machine on the internal network is hidden from the external network. This prevents an outside attacker from invading the internal network.

Proxy servers can improve performance for clients accessing the Internet by caching Web pages. The proxy server can be configured to save recently or frequently accessed web pages so that the next request for that same page can be obtained much faster from the local cache.

A proxy server may be "circuit-level" or "application-level". A circuit-level A Circuit-level Proxy server is a general proxy server that supports multiple applications. An "application-level" proxy server is dedicated to a specific protocol and application such as HTTP or FTP. Application-level Proxy servers are sometimes called "application-level gateways".

A firewall is a device that uses packet filtering at the Data Link and Network layers of the OSI model to prevent unauthorized access to an internal network. The functions of a firewall and a proxy server are frequently combined.