A proxy firewall, which NIST calls an application-proxy gateway, never lets two hosts talk directly. It ends the client's connection, inspects the request at the application layer, and opens a second connection to the destination. That buys content level control and costs speed and protocol coverage.
How does a proxy firewall work?
NIST SP 800-41 Rev. 1 describes it plainly. The proxy agent acts as an intermediary and never allows a direct connection. Every successful attempt creates two separate connections: one from the client to the proxy, one from the proxy to the true destination. To each side it looks like a direct link.
Because the proxy performs the TCP handshake itself and reads the application protocol, it can allow or deny traffic based on headers or payloads, not only on addresses and ports. Some proxies can also require authentication of individual users. External hosts only see the proxy, so internal IP addresses stay hidden.
A packet filter, by contrast, looks at addresses, ports and protocol fields and forwards or drops. A stateful firewall adds memory of connection state. The proxy goes further, which is why it is slower.
What are the trade-offs?
The NIST guide lists both sides.
On the plus side, the proxy can offer a higher level of security for some applications, since it blocks direct connections and inspects content for policy violations. Some can decrypt TLS protected payloads, examine them, and re-encrypt before forwarding. Traffic the gateway cannot decrypt passes straight to the application.
On the minus side, reading every packet takes much more time than packet filtering. NIST notes that some gateways suit high bandwidth or real time traffic poorly, though models rated for high bandwidth exist. They also tend to lag on new protocols, because each application needs its own proxy agent.
Decrypting traffic brings its own duties. You are now holding plain text of user sessions at one point, which makes that device a high value target and raises privacy questions that your policy needs to answer before you switch it on.
Proxy firewall versus a web application firewall
They overlap but are not the same. NIST's guide lists web application firewalls as their own category alongside application-proxy gateways. A web application firewall is tuned to HTTP behaviour and attacks on web apps. An application-proxy gateway is a general mechanism that mediates connections and applies rules at the application layer. Many products blend the two, so read what a specific device inspects rather than trusting its label.
A constructed example
A finance team wants to stop staff uploading customer exports to personal storage. A stateful firewall sees a TLS session to a storage domain on 443 and can allow or block the whole domain. A proxy that inspects traffic can tell an upload from a download, apply a rule per user group, and log the file name. The cost is a certificate trust change on every managed laptop, a performance budget for the proxy, and exemptions for banking and health sites where inspection is inappropriate.
How to check or apply this
- Write down what you need to control: which protocols, which users, and whether you need content rules or only reachability.
- If addresses and ports are enough, use packet filtering or stateful inspection and save the proxy for traffic where content matters.
- Size the proxy for peak throughput with inspection on, not for the data sheet number.
- Decide your decryption policy in writing: what is inspected, what is exempt, who can read logs, and how long logs are kept.
- Plan for protocols the proxy does not support. Decide whether to block them or route them through another control.
- Place the device deliberately. Section 3 of SP 800-41 covers firewall placement in network architectures.
- Review rules on a schedule. A firewall policy is a living document, so assign an owner and a review date.
Quick check
Is a proxy firewall the same as a forward proxy?
Not exactly. A forward proxy is a server that clients use to reach the internet. An application-proxy gateway is a firewall feature that mediates connections and enforces rules. A dedicated proxy server can sit behind a firewall to take load, as the NIST guide describes.
Why not use proxy inspection for everything?
Because it is slower, needs per protocol support, and often means decrypting traffic. Use it where content level control is worth that cost.
Sources
- NIST SP 800-41 Rev. 1, Guidelines on Firewalls and Firewall Policy
- NIST SP 800-41 Rev. 1, full text (PDF)
Last reviewed: 18 October 2026.
