What is a Proxy?
A proxy (or proxy server) is an intermediary that receives requests from a client, such as a web browser or application, forwards them on the client’s behalf to a destination server and returns the response. Because all traffic passes through a single point, you can filter, inspect, accelerate and record it there. In HTTP, the proxy is formally described in RFC 9110 (HTTP Semantics, June 2022), which distinguishes three kinds of intermediary: the proxy, the gateway (better known as a reverse proxy) and the tunnel. In IT/OT environments, the proxy is a standard component of the DMZ between the office network and the production network.
Proxies are mainly used for Security, performance, Access Control and Monitoring.
🧠 How does a proxy work?
Without a proxy, a client sets up a connection to the server itself. With a proxy, the communication is split in two: the client talks to the proxy, and the proxy talks to the server. The proxy therefore sees every request and can decide per request what happens to it.
- Hiding - the destination server sees the proxy’s address, not the internal IP Address of the client
- Filtering - the proxy blocks websites, file types, protocols or destinations that policy does not allow
- Caching - frequently requested content is stored locally, so subsequent requests are served faster and with less bandwidth
- Logging - every request is recorded with time, user and destination; these logs feed a SIEM
- Enforcing policy - access based on user, group, time, content or device, often tied to IAM and RBAC
For encrypted traffic (HTTPS) the client uses the
CONNECT method: the proxy then builds a tunnel to the server and sees only the destination,
not the content. If the organisation wants to inspect that content anyway, TLS inspection is required (see
below). When the proxy requires login, it responds with status code 407 Proxy Authentication
Required.
How does a client find the proxy? Through a manual setting in the browser or operating system, through a PAC file (Proxy Auto-Config: a small JavaScript file that decides per URL which proxy to use) or automatically through WPAD, in which the client looks for the PAC file on the network itself. WPAD is a known attack route: an attacker on the same network can pose as the proxy and redirect traffic. Disable automatic detection on systems that do not need it, especially in OT.
🛠 What types of proxy server are there?
| Type | Direction | Does the client choose the proxy? | Typical use |
|---|---|---|---|
| Forward proxy | Client → proxy → internet | Yes, via browser or system settings | Internet access and web filtering for staff |
| Reverse proxy | Internet → proxy → internal server | No, the client thinks it talks to the server | Shielding web applications, HMI web servers and dashboards |
| Transparent proxy | Client → proxy → internet | No, the network redirects traffic | Filtering without client configuration |
| Application proxy | Both | Depends on protocol | Per-protocol inspection (HTTP, FTP, SMTP) |
| Caching proxy | Usually forward | Yes | Faster access, less bandwidth |
| SOCKS proxy | Client → proxy → destination | Yes | Generic forwarding of TCP and UDP traffic |
| Web proxy | Browser → web service → website | Yes, via a web page | Shielded or filtered browsing by consumers; not a security control for OT |
RFC 9110 calls a transparent proxy an interception proxy: the client has not chosen it. That works well for unencrypted web traffic, but with HTTPS such a proxy sees only the destination unless TLS inspection is in place. The same RFC calls a reverse proxy a gateway: to the client it behaves as the origin server, and it forwards requests to the backend, translated into another protocol if needed. SOCKS5 is defined in RFC 1928 (March 1996), uses port 1080 by default and supports, among other methods, username and password authentication. Well-known products include Squid (default port 3128) as a forward proxy and NGINX, HAProxy and Apache as reverse proxies.
🔄 What is the difference between a proxy, a firewall and a VPN?
| Feature | Proxy | Firewall | VPN |
|---|---|---|---|
| Operates at layer | Application (layer 7) | Usually network and transport (layers 3–4), NGFW also layer 7 | Network, as an encrypted tunnel |
| Terminates connections | Yes, two separate sessions | No, passes or drops packets | No, extends the network |
| Sees content | Yes for HTTP; for HTTPS only with TLS inspection | Limited, unless using DPI | No, only transports |
| Main purpose | Mediating and controlling each request | Allowing or blocking traffic | Secure connection over an untrusted network |
The key difference is that a proxy terminates the connection and builds a new one itself. A firewall passes or drops packets, but client and server still talk to each other directly. In practice they work together: the firewall enforces that clients can only reach the outside world through the proxy.
🏭 How is a proxy used in OT environments?
In industrial networks following the Purdue Model, the proxy is one of the main building blocks of the industrial DMZ (IDMZ). The design that Cisco and Rockwell Automation describe in their Converged Plantwide Ethernet architecture applies the rule that all traffic from either side terminates in the IDMZ and that there is no direct path between the enterprise zone and the industrial zone. Industrial protocols such as EtherNet/IP stay inside the production zone. That is exactly what a proxy does: it terminates the session on one side and opens a new one on the other.
Typical uses in OT:
- Reverse proxy for web interfaces - office users view a SCADA dashboard, Historian report or HMI web client through the proxy in the IDMZ, without ever making a connection into the production network
- Forward proxy for updates - OT servers fetch security updates and antivirus definitions through a proxy in the IDMZ that only allows the vendors’ domains; this supports patch management without open internet access
- Remote access - vendors come in through a Jump Server or RD Gateway in the DMZ, with MFA and session recording, rather than through a direct remote access connection
- Data exchange - an application mirror or proxy lets PLC and historian data flow upwards; for protocols such as OPC UA, a gateway or aggregating server is often used, which is technically a translating proxy
A proxy is not a replacement for a data diode: a proxy allows traffic in both directions within the session, whereas a diode physically supports only one direction. For the highest protection requirements, a diode is therefore combined with a proxy or mirror server on the enterprise side.
🔐 What security benefits and risks does a proxy bring?
| Security function | Explanation |
|---|---|
| IP shielding | External systems see only the proxy address, not the internal addressing |
| Access control | Combined with IAM, RBAC and user groups; only authenticated users get out |
| Content filtering | Blocks unwanted sites, categories or file types, and with them much Malware |
| TLS inspection (formerly SSL inspection) | Decrypts and inspects TLS traffic using an in-house certificate authority |
| Data loss prevention (DLP) | Checks outbound uploads for confidential data, such as recipes or customer files |
| Logging and auditing | Complete trail of outbound traffic for SIEM and incident investigation |
| Attack surface | A reverse proxy exposes only the published paths, not the whole backend server |
A proxy also introduces risks:
- Single point of failure - if the proxy goes down, the service goes down; in OT, provide redundancy or a documented fallback
- Attractive target - whoever controls the proxy sees all traffic; RFC 9110 notes that an intermediary is indistinguishable at protocol level from an on-path attacker
- TLS inspection has a cost - the internal root certificate must be on every client, applications using certificate pinning stop working and certificate management becomes heavier; reading personal data also brings the rules of the GDPR (AVG) into play
- False sense of security - a proxy only covers traffic that passes through it; without firewall rules that block direct traffic, malware simply bypasses the proxy
🧭 How do you set up a proxy in an OT environment?
A practical five-step approach:
- Inventory the flows - which systems need to reach outside (updates, cloud, licensing) and which users need to come in (dashboards, vendors)? Record each flow as a conduit in line with IEC 62443.
- Choose per direction - a forward proxy for outbound traffic, a reverse proxy for inbound web traffic, a jump server for interactive access.
- Place the proxy in the DMZ - never in the production zone itself; the firewall only allows traffic to and from the proxy.
- Use an allowlist - in OT, allow only explicitly named domains and paths, rather than a category-based blocklist as in the office.
- Connect to monitoring - send proxy logs to the SIEM and check them for unusual destinations, such as a PLC engineering workstation that unexpectedly tries to reach the internet.
For Dutch organisations covered by the Cybersecurity Act (Cyberbeveiligingswet), in force since 15 August 2026, a well-configured proxy and its logs help demonstrate that network segmentation and access control actually work. NIST SP 800-82 Rev. 3 (Guide to Operational Technology (OT) Security, September 2023) likewise recommends a DMZ to host services shared between IT and OT. A proxy also fits a Zero Trust approach, in which every access is assessed per request.
❓ Frequently asked questions
What is the difference between a forward and a reverse proxy?
A forward proxy acts on behalf of the client: staff or systems reach the outside world through the proxy. A reverse proxy acts on behalf of the server: external users think they are talking to the server, but they are talking to the proxy that shields the backend. In OT, the forward proxy is often used for updates and the reverse proxy for dashboards.
Does a proxy make me anonymous on the internet?
A proxy hides the client’s IP address from the destination server, but the proxy itself sees and logs everything. A proxy is therefore not an anonymisation service; in a corporate network, recording traffic is one of its very purposes.
Can a proxy inspect HTTPS traffic?
A proxy can only inspect HTTPS traffic with TLS inspection, in which the proxy decrypts the connection and re-encrypts it with its own certificate. Without TLS inspection the proxy sees only the destination. TLS inspection requires an internal root certificate on all clients and does not work with applications that use certificate pinning.
Is a proxy the same as a firewall?
A proxy is not the same as a firewall. A firewall passes or blocks packets, whereas a proxy terminates the connection and builds a new one itself. In a good design they complement each other: the firewall enforces that traffic may only go through the proxy.
Why does a proxy sit in the industrial DMZ?
A proxy sits in the industrial DMZ so that there is no direct connection between the office network and the production network. All sessions terminate in the DMZ, so an attacker on the office network cannot directly reach a PLC or SCADA server.
Which port does a proxy server use?
A proxy server has no fixed port, but there are common values: 8080 for many HTTP proxies, 3128 as the Squid default and 1080 for SOCKS. Reverse proxies usually simply listen on 443 for HTTPS.
📌 In summary
A proxy mediates between client and server, terminates connections and thereby enables filtering, caching, logging and access control at a single point. Forward proxies handle outbound traffic, reverse proxies protect internal servers. In IT/OT environments the proxy is a core component of the IDMZ, provided it is combined with firewall rules, monitoring and a strict allowlist.
A proxy acts as a controlled intermediary between networks or systems and ensures there is no direct path between office and production. Indispensable in networks where segmentation, Monitoring and risk reduction are essential.