A reverse proxy is a server that sits in front of your web servers and forwards client requests to them. To the outside world, the reverse proxy is your website: visitors connect to it, and it decides what to pass back to your actual origin server. It's a simple idea that quietly powers most of the modern web — and it's the foundation of how DNS-based DDoS protection works.
Forward Proxy vs Reverse Proxy
A forward proxy sits in front of clients and hides them from the internet — a VPN or a corporate web filter is a forward proxy. A reverse proxy is the mirror image: it sits in front of servers and hides them from clients. Visitors never talk to your origin directly; they talk to the proxy, which talks to your origin on their behalf.
What a Reverse Proxy Does
- Terminates TLS: it handles HTTPS encryption, so certificates live at the proxy.
- Routes and load-balances: it can send requests to different backend servers.
- Caches: it can serve static content itself, taking load off your origin.
- Filters: it can inspect each request and block, challenge or rate-limit it.
- Hides the origin: clients only ever learn the proxy's address, not your server's.
Why this matters for security
Because a reverse proxy stands between attackers and your server, it's the natural place to filter attacks. It sees every request before your origin does, and — critically — it keeps your real server address private, so attackers can't bypass it and hit your origin directly.
Why It's the Basis of DDoS Protection
DNS-based DDoS protection is just a reverse proxy you point your domain at. You change your DNS so the world resolves your domain to the proxy instead of your server. From then on every request flows through the proxy, where application-layer attacks are filtered, automated clients are challenged, and abusive sources are rate-limited — and your origin IP stays hidden so direct floods have nowhere to land. Cloudflare popularised the model; Akarguard is a smaller, EU-based, managed version of the same architecture.
The One Thing You Must Get Right
A reverse proxy only protects you while your origin IP stays secret. If your real server address leaks — in email headers, old DNS records, or a subdomain pointing straight at it — an attacker can skip the proxy and target your server directly. Rotate your origin IP after you move behind any reverse proxy, and lock your origin's firewall to accept traffic only from the proxy.