Proxies, Load Balancers, CDNs & VPNs
The middle-boxes that make real-world apps fast, scalable, and private
Real production traffic rarely goes straight from client to server. It passes through helpful intermediaries — proxies, load balancers, CDNs, and sometimes VPNs. This chapter demystifies each one and shows how they combine.
Forward proxy
A forward proxy sits in front of clients and talks to the internet on their behalf. It can hide the client’s identity, filter or cache requests, and enforce policy. Corporate networks often route all outbound traffic through one.
Reverse proxy
A reverse proxy sits in front of servers and is the single public entry point for many backends. It can terminate TLS, route by path, and cache responses. Nginx and Envoy are common examples — the client thinks it is talking to one server, but the proxy fans out to many.
Load balancer
A load balancer spreads incoming requests across a pool of identical servers, so no single one is overwhelmed. It also adds resilience: if a server fails its health check, traffic is routed to the others. Load balancers can work at layer 4 (by IP/port) or layer 7 (by HTTP details).
CDN (edge caching)
A CDN (Content Delivery Network) caches your content on servers spread around the world. Users are served from the nearest edge location, cutting latency dramatically and offloading your origin. This is why images and static assets load fast globally.
VPN (encrypted tunnel)
A VPN (Virtual Private Network) creates an encrypted tunnel across the public internet, making a remote device appear as if it is on a private network. It is used to reach internal resources securely and to protect traffic on untrusted networks.
Putting them together
In a real request path these stack up: a user hits the nearest CDN edge; cache misses go to a load balancer; that forwards to a reverse proxy which terminates TLS and routes to the right backend servers. Knowing where each piece sits makes production architectures far less mysterious.