Skip to main content
Reverse & forward proxy

Two different middlemen, for two different jobs

A proxy is a middleman for web traffic. Firecradle runs one in front of your servers, so visitors reach the right one every time, and one in front of your users, so staff web access is safe and under control.

HAProxy · Squid · TLS inspection

Two proxies, two directions

One protects the servers you run. The other protects the people using your network. Both are included.

Reverse proxy (HAProxy)
Sits in front of your servers. Visitors from the internet reach it first, and it decides which server actually answers.
Forward proxy (Squid)
Sits in front of your users. Staff web traffic passes through it on the way out, so it can allow, block, or cache what they reach.

Reverse proxy: in front of your servers

One public address can stand in for several internal websites, with HTTPS handled in one place instead of on every server.

One address, several sites
One public address can serve several internal websites, each by its own name. Visitors never see the difference.
HTTPS handled in one place
TLS encryption is set up once, on the proxy, instead of on every server behind it. One certificate to renew, not five.
Faster connections with HTTP/2
HTTP/2 lets one connection carry many requests at once, so pages with lots of images and scripts load quicker.
Health checks take a sick server out of rotation
If one server behind the proxy stops responding properly, it is quietly skipped until it recovers. Visitors are sent to a healthy one instead.
Sticky sessions
Once a visitor is talking to one server, they keep talking to that same one for the rest of their visit — useful for shopping carts and logins.
Built on HAProxy
A widely used, battle-tested piece of software. Nothing new or unproven sitting in front of your servers.

Forward proxy: in front of your users

Every request staff make to the web passes through here first. Firecradle decides what is allowed, caches what it can, and can look closer when you ask it to.

Default-deny web access
Decide which sites staff can reach, and block everything else by default, instead of trying to blocklist the whole internet one site at a time.
Caching
Frequently visited pages and files are kept close by, so the second person to load them gets a faster result and less data is pulled from the internet.
Optional TLS inspection
TLS inspection lets Firecradle check inside encrypted web traffic for threats. It is off unless you turn it on.
A guided certificate install
Turning on TLS inspection means installing a certificate on each device. A step-by-step helper walks staff through it instead of leaving them guessing.

Being straight about TLS inspection

TLS inspection decrypts encrypted web traffic, checks it, and re-encrypts it before it carries on. That is the honest tradeoff: Firecradle can see what staff browse while inspection is on. It also needs a certificate installed on every device that is inspected, which is why Firecradle includes a guided install helper. It is off by default, and turning it on is entirely your choice.

What it runs on

HAProxy
Reverse proxy engine
Squid
Forward proxy engine
HTTP/2
Supported on the reverse proxy
Default deny
Forward proxy blocks by default

How people actually use this

Five websites, one address

The problem: A small company runs five internal web apps on five different servers, but only has one public address and does not want five separate certificates to manage.

What Firecradle does:
One reverse proxy sits in front of all five servers
Each site keeps its own name, like invoices.company.com and support.company.com
HTTPS is set up once on the proxy, not five times
A failed server is skipped automatically until it is fixed

Staff web access nobody has to police by hand

The problem: A company wants staff to reach the sites they need for work, and nothing else, without maintaining an endless blocklist of bad sites.

What Firecradle does:
The forward proxy blocks everything by default
Only approved sites and categories are allowed through
Frequently used pages load faster thanks to caching
TLS inspection can be turned on later if deeper checks are needed

Everything here is included

No add-on licence, no extra box

Reverse proxy (HAProxy) in front of any number of internal servers
HTTPS and HTTP/2 handled centrally, not per server
Health checks that take a failing server out of rotation automatically
Sticky sessions for logins and shopping carts
Forward proxy (Squid) with default-deny web access
Caching to speed up frequently visited pages
Optional TLS inspection, off unless you turn it on
A guided certificate-install helper for staff devices

Common questions

What is the difference between a reverse proxy and a forward proxy?

A reverse proxy sits in front of your servers and shares traffic between them. A forward proxy sits in front of your users and controls what they can reach. Firecradle runs both, for different jobs.

Does TLS inspection mean the firewall reads staff private messages?

TLS inspection decrypts and re-encrypts web traffic so it can be scanned, then sends it on its way. It needs a certificate installed on each device to work, and it is entirely optional — you decide if and when it is turned on.

Will visitors notice the reverse proxy is there?

No. They type one address or one site name and reach the right server behind the scenes. If a server is unhealthy, they are quietly sent to a working one instead.

Can I use the reverse proxy without also turning on the forward proxy?

Yes. They are separate features that happen to share the same screen. Use one, the other, or both, depending on what your network needs.

Put a proper front door on your servers and your staff

Reverse proxy and forward proxy are part of every Firecradle appliance. Try it free for 30 days.

No credit card required · Cancel anytime · 30-day free trial