A proxy server's job is to manage the internet traffic entering or leaving a private network. Although its function may appear to be a single one, it actually underpins a great many uses:
- it filters browsing: for example, it can block a corporate user from browsing sites unrelated to their work;
- it speeds up browsing: thanks to a caching system, it can make browsing much faster on the pages most frequently requested by a group of users;
- it raises the security level of the device you browse with: it is in fact the proxy that connects to the IP/port you want to reach (for example www.sito.com on port 80) — it is never your PC that establishes the connection, but the proxy, which then takes care of redirecting the result, in this case an http page;
- it behaves like a firewall, with its own specific context-based filtering rules;
- it increases the privacy of whoever is browsing;
- it allows only authorised devices to browse within the local network they belong to: for example, a corporate network where browsing from the servers is blocked, except towards the domains of the operating system and hardware vendors;
- by masking your IP it can also mask your location, defeating any attempt to geolocate the IP.
Its job is essentially to intercept and manage the traffic between devices and the protocols they use. Then there are reverse proxies: these particular servers do precisely the opposite job, intercepting client requests on behalf of one or more servers and, where necessary, forwarding them to the destination servers (which provide the requested service). This type of configuration not only prevents anyone from communicating directly with the servers, but also improves performance through load balancing: incoming traffic can be managed by distributing it across several servers delivering the same service, rather than concentrating it on a single machine. Here too the benefits are multiple, including a higher level of security for the servers, which are in effect not exposed directly to the internet.
How the proxy does its job
- Step 1 — requests are sent from your IP address to the proxy server;
- Step 2 — the proxy server forwards the request to the outside world using its own IP address;
- Step 3 — the responses are routed to the proxy server;
- Step 4a — the proxy server forwards the requested data to your browser;
- Step 4b — or your browser receives a warning page telling you that the requested traffic is not allowed.
It is not all upside, though. Since the proxy knows all your requests and all the traffic destined for you, it automatically exposes you to a security and privacy risk. In short: if you do not ‘trust’ the proxy server you are using, you could run risks equal to — if not greater than — not using one at all.
The three main types
- Transparent proxy — essentially used to cache frequently accessed pages, as well as to filter sites the organisation does not welcome. This type of proxy does no IP masking whatsoever: the address remains, in effect, that of the device you are browsing from.
- Distorting proxy — provides a false IP address to the web server being called, although it still identifies itself as a proxy. The false IP address guarantees anonymity, but the real advantage is that you can lead the remote server to geolocate you in a fictitious position. This type of proxy is often used to get around the typical restrictions of sites that serve content based on geographical area.
- Anonymous proxy — keeps your device's IP address hidden from the websites you visit. This can help prevent identity theft, as well as allowing anonymous browsing; however, anonymous proxies still present themselves as proxy servers, and some websites may not grant you access. There is a high-anonymity version of the anonymous proxy: this mode adds rotation of the outbound IP, so your device will appear to the outside world with IP addresses that change over time. This second type of anonymous proxy does not present itself externally as a proxy, which guarantees ‘cover’ for your digital tracks, making it one of the most secure types of proxy server.
Risks, or benefits only?
Obviously no system exists that does not also carry risks. It can happen, for example, that the proxy server does not encrypt web traffic: this point is certainly fundamental and has a real impact on your privacy, and can expose you to the theft of passwords and other sensitive data.
It is not common practice, but it can also happen that some free open proxy services track and sell user information (email, name, browsing history and so on): so it is wise to do your homework before using a proxy, and in general the first rule of cybersecurity always applies: ‘Trust no one!’. Using a corporate proxy server is clearly a different story — although in that case the company may track user activity for legitimate security reasons; the user, however, should be informed of such activity.
A more secure system
A VPN (Virtual Private Network) offers decidedly better protection. Whether you are browsing from home, from the pizzeria or from the office, routing your traffic through a VPN is certainly the safer choice.
From a privacy standpoint the difference is not that perceptible: while it is true that the transit ‘channel’ is more secure (traffic always encrypted in both directions), it is equally true that the operator of the VPN server has to earn our trust — which is why VPNs are often used in corporate settings, where keeping unwanted and undesirable users at bay really matters.
Nothing stops us thinking in terms of ‘double’ protection, that is, a proxy server reachable exclusively through a VPN. Clearly this would not be a configuration suited to a home user; for a company that wants to protect its users even when they are using laptops or other mobile devices, however, it can offer the security of encrypted transit from the user's device to the VPN server and, from there, browsing that is protected and governed by the proxy. Designing this kind of perimeter — and actually verifying that it holds — is one of the trades of security work.
Article originally published on the blog of VPS GREEN, the VPS service on our green private cloud.
