To set up a proxy server, pick its role first: a forward proxy that serves your users or a reverse proxy in front of your servers. Then restrict who may connect, limit which destinations and ports are allowed, require authentication and log requests. An unrestricted proxy becomes a free relay for strangers.
What is a proxy, exactly?
RFC 9110, the HTTP semantics standard, defines a proxy as a message-forwarding agent chosen by the client, usually through local configuration, that receives requests for some kinds of absolute URI and tries to satisfy them. It adds that proxies are often used to route an organization's HTTP requests through a common intermediary for security services, annotation services or shared caching.
NIST's firewall guidance describes the same pattern from the security side. In its HTTP proxy example, users' requests go to the proxy, which sends the request, possibly changed, to the outside web server. The response comes back to the proxy and is relayed to the user. Many organizations cache frequently used pages on it to cut traffic and speed up responses.
A reverse proxy sits the other way round, in front of servers, and clients usually do not know it is there. This post covers the forward case, since that is where most setup mistakes happen.
What is the risky part?
CONNECT. RFC 9110 says the CONNECT method asks the recipient to establish a tunnel to the destination and, once it succeeds, restrict itself to blind forwarding of data in both directions until the tunnel closes. Tunnels are commonly used to create an end to end virtual connection through proxies that is then secured with TLS.
"Blind forwarding" is the point. Once the tunnel is open, the proxy cannot see what flows through. If any client can ask for a tunnel to any host and port, your proxy will happily connect them to mail ports, internal addresses or other services.
Constructed example: a team installs a proxy on a cloud VM with defaults, opens its port to the internet so remote staff can use it, and forgets authentication. Within days its logs show requests from addresses nobody recognizes, to destinations nobody asked for. The proxy has become an open relay, and abuse complaints about its address arrive at the company.
How to check or apply this
- Choose the role and the software, and write down who the clients are.
- Restrict by source. Allow only your own address ranges, or require authentication for any client coming from elsewhere.
- Require authentication for users, and tie it to your identity provider where the software supports it.
- Limit CONNECT to a short allow list of ports, typically 443, and deny requests aimed at internal address ranges and at the proxy host itself.
- Allow only the destinations or categories your policy needs. NIST's default deny approach for firewall policy applies here: permit what is needed and block the rest, because it reduces risk and traffic.
- Log every request with time, client, destination and result, ship the logs to a separate system, and review them.
- Keep the software patched. A proxy is an internet facing service with access to your network.
- Test from outside: try to use it with no credentials and with a destination on your internal network. Both should fail.
Does a proxy replace a firewall?
No. NIST lists application proxy gateways and dedicated proxy servers as separate firewall technologies, each with trade offs. A proxy sees application messages and can enforce policy on them, but it does little for traffic that does not use it. Pair it with network rules that force traffic through the proxy, otherwise users and malware can go around.
What about encrypted traffic?
A proxy that tunnels TLS cannot inspect content unless you add interception, which is a larger decision with privacy, legal and risk implications and its own certificate management. NIST notes firewalls cannot read encrypted application data, and organizations should decide in policy how to treat encrypted traffic that is not authorized. Decide deliberately rather than by default.
Quick check
What is an open proxy and why is it a problem?
An open proxy accepts requests from anyone. Others can use it to hide their activity behind your address, which brings abuse reports and possible blocklisting.
Why restrict the CONNECT method?
CONNECT creates a blind tunnel to any host and port requested. Without limits, it can reach services and networks you never meant to expose.
Sources
Last reviewed: 18 October 2026.
