Reverse Proxy: An Essential Tool for Modern Web Architecture

When building modern web applications, safeguarding backend servers and ensuring efficient traffic management are critical for both security and productivity. A reverse proxy acts as a smart gateway, fortifying your infrastructure by shielding sensitive systems, optimizing performance, and enabling seamless scalability. In this post, I’ll delve into the essential role of reverse proxies, explore how Cloudflare Tunnels bring a modern twist to this concept, and provide practical configurations using Cloudflare Workers, Node.js, NGINX, and Apache.

For locally hosted applications requiring external access, exposing critical components like firewalls, gateways, or DMZ entry points is a risk no organization can afford. Such exposure can attract unwanted attention, from port scans and brute force attacks to potential exploitation of vulnerabilities. A reverse proxy offers a productive and secure solution by masking these sensitive access points, keeping them invisible to external threats. This layered approach not only strengthens your defenses but also enhances traffic management, ensuring secure, efficient, and uninterrupted connectivity—allowing you to focus on delivering exceptional application performance.

---

Why Do We Need a Reverse Proxy?

A reverse proxy intercepts client requests and forwards them to backend servers. This setup provides several advantages:

1. Improved Security: It hides your backend servers’ IP addresses, reducing their exposure to direct attacks.
2. Load Balancing: Distributes incoming traffic across multiple servers to prevent overloading.
3. Caching: Speeds up content delivery by caching frequently requested resources.
4. SSL Termination: Offloads SSL decryption to the proxy, reducing the load on backend servers.
5. Centralized Access Control: Simplifies management of authentication, authorization, and IP filtering.

Why Hide Web Servers Behind a Proxy?

By concealing your web servers behind a reverse proxy, you minimize attack vectors like DDoS, port scanning, and direct exploitation of vulnerabilities. The proxy becomes the entry point, allowing you to enforce security rules, monitor traffic, and ensure your backend servers remain isolated and secure.

---

Cloudflare Tunnels: A Modern Reverse Proxy Solution

Cloudflare Tunnels enable secure connections to your servers without exposing their IPs. By creating an encrypted tunnel to Cloudflare’s edge network, you can:

• Eliminate the need for public IPs or port forwarding.
• Simplify remote access configurations.
• Protect services from unauthorized access and DDoS attacks.

Challenges with Cloudflare Tunnels

Recently, I encountered issues with Cloudflare Tunnels, such as unreliable connections or latency in specific regions. To address these limitations, I explored the concept of using Cloudflare Workers as a custom reverse proxy. Here’s the Worker code I used:

Cloudflare Worker Code Explanation

export default {
    async fetch(request) {
        const backendUrl = 'http://somethingat.eyaadh.network:5050';

        // Build the full backend request URL
        const url = new URL(request.url);
        const targetUrl = backendUrl + url.pathname + url.search;

        // Forward the request to the backend
        const backendResponse = await fetch(targetUrl, {
            method: request.method,
            headers: request.headers,
            body: request.body,
            redirect: 'manual', // Prevent automatic redirects
        });

        // Handle redirects and rewrite the `Location` header
        if (backendResponse.status >= 300 && backendResponse.status < 400) {
            const location = backendResponse.headers.get('Location');
            if (location) {
                // Parse the absolute URL from the backend's `Location` header
                const backendLocation = new URL(location, backendUrl);

                // Rewrite `Location` to use the Worker’s URL instead of the backend URL
                const workerLocation = backendLocation.pathname + backendLocation.search;
                const rewrittenLocation = new URL(workerLocation, url.origin);

                const responseHeaders = new Headers(backendResponse.headers);
                responseHeaders.set('Location', rewrittenLocation.toString());
                return new Response(null, {
                    status: backendResponse.status,
                    headers: responseHeaders,
                });
            }
        }

        // Forward non-redirect responses as-is
        return new Response(backendResponse.body, {
            status: backendResponse.status,
            headers: backendResponse.headers,
        });
    },
} satisfies ExportedHandler<Env>;

Code Breakdown:

1. Backend URL Setup:

   • Defines backendUrl as the target backend server.
   • Constructs the full target URL by appending the request’s path and query string.

2. Request Forwarding:

   • Uses the fetch API to forward incoming requests to the backend.
   • Maintains the original request’s method, headers, and body for transparency.

3. Redirect Handling:

   • Captures HTTP 3xx responses and rewrites the Location header to ensure redirection paths use the Worker’s URL.

4. Non-Redirect Responses:

   • Forwards all other responses (e.g., HTML, JSON) as-is to the client.

---

Alternative Implementation with Node.js

For those preferring server-side solutions, here’s a simple reverse proxy using Node.js:

const http = require('http');
const httpProxy = require('http-proxy');

const target = 'http://somethingat.eyaadh.network:5050/'; // Backend server URL
const proxy = httpProxy.createProxyServer({});

const server = http.createServer((req, res) => {
    proxy.web(req, res, { target }, (err) => {
        console.error('Proxy error:', err);
        res.writeHead(502);
        res.end('Bad Gateway');
    });
});

server.listen(8080, () => {
    console.log('Proxy running on port 8080...');
});

Key Features:

1. Error Handling:
   • Gracefully handles proxy errors and sends appropriate responses.
2. Flexibility:
   • Can be extended for logging, authentication, or load balancing.

---

Traditional Reverse Proxy with NGINX or Apache

NGINX and Apache are long-standing, reliable solutions for setting up reverse proxies. These servers are widely used due to their robust feature sets, extensive community support, and proven performance in production environments. In this section, we'll explore how to configure NGINX and Apache as reverse proxies, demonstrating how they can efficiently forward requests, preserve client details, and integrate seamlessly into various web application setups.

NGINX Configuration:

server {
    listen 80;
    server_name yourdomain.com;

    location / {
        proxy_pass http://somethingat.eyaadh.network:5050;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
}

Apache Configuration:

<VirtualHost *:80>
    ServerName yourdomain.com

    ProxyPreserveHost On
    ProxyPass / http://somethingat.eyaadh.network:5050/
    ProxyPassReverse / http://somthingat.eyaadh.network:5050/
</VirtualHost>

Both configurations:

• Forward requests to the backend server.
• Preserve client information using headers.

---

Conclusion

While reverse proxies like NGINX and Apache provide robust, battle-tested solutions, Cloudflare Tunnels and Workers offer modern, cloud-native alternatives. However, Cloudflare Workers come with limitations, such as execution time constraints and the inability to maintain persistent connections. For complex use cases, combining traditional tools with cloud services or leveraging Node.js can strike the perfect balance between flexibility and scalability.

For NGINX and Apache, managing DNS records through Cloudflare enhances security and performance. By creating A records with Cloudflare’s proxy enabled, traffic is forced over HTTPS, leveraging Cloudflare's out-of-the-box security features such as DDoS protection, web application firewall (WAF), and bot mitigation. This setup ensures that the reverse proxy benefits from Cloudflare’s robust security infrastructure while maintaining efficient request routing and content delivery.

When using a Node.js-based reverse proxy, integrating it with NGINX or Apache as a secondary layer offers additional advantages. This hybrid approach allows NGINX or Apache to handle static file serving, request buffering, or SSL termination, reducing the load on the Node.js server. With Cloudflare’s proxy in front, this layered architecture combines the strengths of each component, resulting in a secure, scalable, and performant solution for handling web traffic.

Adopting such a setup not only secures your backend servers but also optimizes traffic management and improves the reliability of your web application infrastructure.