A proxy forwards requests for a specific application protocol, usually web traffic, on a client's behalf. A VPN builds an encrypted tunnel at the network layer so all selected traffic moves privately between two points. A proxy is about mediation and policy. A VPN is about a private path.
What does a proxy actually do?
RFC 9110, the HTTP specification, defines a proxy as a message-forwarding agent chosen by the client, usually by configuration, which makes requests for the client. Because it understands HTTP, it can cache, filter by URL, log, and add or strip headers.
For HTTPS, the client asks the proxy to open a tunnel using the CONNECT method. After that the proxy is a blind relay: it sees the destination host and port but not the encrypted content. Seeing content requires the proxy to terminate TLS itself, which means installing its certificate on the client. That is a deliberate inspection setup, not a default.
The specification also describes the reverse case. A gateway or reverse proxy sits in front of servers and clients may not know it is there.
What does a VPN actually do?
NIST SP 800-77 Rev. 1 describes IPsec as a network layer security control. IPsec protects IP packets, so it works for any application riding on IP, with no changes to the apps. The architecture is defined in RFC 4301, and keys are normally negotiated with IKE.
Two things follow. First, a VPN protects the path between the endpoints, not what happens after the traffic leaves the far end. Second, once a device is on the network, it usually gets network-level reach unless other controls limit it.
How do they compare?
| Question | Proxy | VPN |
|---|---|---|
| Works at | Application protocol, such as HTTP | IP packets |
| Covers | Apps configured to use it | All traffic routed into the tunnel |
| Content visible to the operator | Destination, and content only if TLS is terminated | Everything inside the tunnel at the far end |
| Main use | Filtering, caching, logging, egress control | Private access, site to site links |
A constructed example
A contractor needs the internal wiki and one build server. A full VPN gives the contractor's laptop a route to the whole office network, which is more than needed. An application-aware access proxy for just those two services is a smaller grant.
Now flip it. A finance team wants to block downloads from newly registered domains and log every outbound web request. A VPN does not do that. A web proxy with policy does.
Can you use both?
Yes, and many networks do. A remote worker connects through a VPN, and the traffic exits through a web proxy at the office so the same filtering applies. The risk is stacking them without a plan: if the proxy decrypts traffic, it becomes a high-value target holding plaintext, and its logs deserve the same protection as the data they describe.
How to check or apply this
- Write down what you need to protect: the path, the destination, or the content.
- If you need a private path to many internal systems, choose a VPN and limit routes with the narrowest access you can.
- If you need policy, logging or caching for web traffic, choose a proxy and decide up front whether you will inspect TLS.
- If you inspect TLS, exclude categories such as banking and health sites by policy and protect the proxy's keys and logs.
- For access to individual internal apps, compare a per-application access model against a flat network tunnel.
- Test what leaks. Confirm that traffic you expect to be tunneled really is, including IPv6.
Quick check
Does a proxy encrypt my traffic?
Not by itself. A proxy forwards traffic. For HTTPS the content is encrypted end to end between you and the site, and the proxy only relays it, unless it is set up to inspect TLS.
Is a VPN the same as zero trust access?
No. A VPN extends a network to a device. Zero trust access, as NIST SP 800-207 describes it, grants access per resource after evaluating identity and device state.
Sources
- RFC 9110, HTTP Semantics
- NIST SP 800-77 Rev. 1, Guide to IPsec VPNs
- RFC 4301, Security Architecture for the Internet Protocol
- NIST SP 800-207, Zero Trust Architecture
Last reviewed: 18 October 2026.
