Linux Reverse Proxy

Reverse Proxy, Load Balancing & API Gateway

1. Introduction

Modern web architectures rely on a combination of components to ensure scalability, reliability, and security. Nginx is frequently used as:

• A reverse proxy
• A load balancer
• An API gateway

This scriptum introduces the essential theoretical concepts behind these roles.

---

2. Reverse Proxy

A reverse proxy is a server that sits between clients and backend servers. Clients communicate only with the proxy, which forwards requests to internal servers.

2.1 What It Does

• Accepts incoming HTTP(S) traffic
• Forwards requests to backend servers
• Hides internal network topology
• Terminates TLS
• Adds headers or rewrites URLs
• Implements caching or compression

2.2 Benefits

• Security: backend servers remain inaccessible from the internet
• Centralization: all routing and TLS configuration in one place
• Scalability: easy to add/remove backend servers
• Uniform interface for multiple backend technologies

---

3. Load Balancing

Load balancing is the distribution of traffic across multiple backend servers.

3.1 Load Balancing Methods

Round Robin

Requests go to backends in sequential order.

Least Connections

Requests go to the backend with the fewest active connections.

IP Hash

Uses client IP to route requests consistently to the same backend (sticky sessions).

3.2 Why Load Balance?

• Increase total throughput
• Reduce load on individual servers
• Improve fault tolerance
• Allow horizontal scaling

---

4. API Gateway Basics

Nginx can perform many “gateway” tasks before requests reach the backend.

4.1 Rate Limiting

Rate limiting prevents abusive behavior or overload by limiting how many requests a client may send in a defined time window.

Examples:

• Limit per IP
• Limit per path
• Burst control

4.2 Request Filtering

Nginx can filter:

• Forbidden HTTP methods
• Suspicious patterns in URLs
• Unwanted User-Agents (bots, scrapers)
• Oversized request bodies

4.3 Header Manipulation

Nginx can add, remove, or rewrite headers:

• Add security headers (CSP, X-Frame-Options)
• Remove sensitive client-provided headers
• Forward IP/identity metadata to backends

---

5. Security Enhancements

Nginx provides multiple layers of security:

5.1 HTTP Method Restrictions

Allow only desired methods (e.g., GET, POST).

5.2 Blocking User Agents

Block known bots or malicious crawlers.

5.3 IP Allow/Deny Lists

Allow or deny access based on IP ranges.

5.4 Basic WAF Behavior

Although Nginx is not a full WAF, it can:

• Block suspicious query strings
• Prevent directory traversal
• Enforce CORS policies
• Limit upload size

---

6. Architecture Overview

A typical system may look like this:

Client → Internet → Nginx → Backend Pool
                      |
                      → Security Policies
                      |
                      → Rate Limiting

---

7. Summary

Nginx provides robust tools for building scalable, secure, and flexible web infrastructures:

• Reverse proxy ensures central routing and abstraction
• Load balancing increases performance and reliability
• API gateway features add critical security and traffic-management controls