Home / server / Questions / 994319
In Process
Tim
Asked: 2019-12-05 10:02:13 +0800 CST

What is the difference between a proxy server and a gateway server?

  • 772

From Proxy server on Wikipedia:

A proxy server may reside on the user's local computer, or at any point between the user's computer and destination servers on the Internet. A proxy server that passes unmodified requests and responses is usually called a gateway or sometimes a tunneling proxy. A forward proxy is an Internet-facing proxy used to retrieve data from a wide range of sources (in most cases anywhere on the Internet). A reverse proxy is usually an internal-facing proxy used as a front-end to control and protect access to a server on a private network. A reverse proxy commonly also performs tasks such as load-balancing, authentication, decryption and caching.

From HTTP: The Definitive Guide by David Gourley and Brian Totty:

Strictly speaking, proxies connect two or more applications that speak the same protocol, while gateways hook up two or more parties that speak different protocols. A gateway acts as a “protocol converter,” allowing a client to complete a transaction with a server, even when the client and server speak different protocols.

Figure 6-2 illustrates the difference between proxies and gateways:

  • The intermediary device in Figure 6-2a is an HTTP proxy, because the proxy speaks HTTP to both the client and server.

  • The intermediary device in Figure 6-2b is an HTTP/POP gateway, because it ties an HTTP frontend to a POP email backend. The gateway converts web transactions into the appropriate POP transactions, to allow the user to read email through HTTP. Web-based email programs such as Yahoo! Mail and MSN Hotmail are HTTP email gateways.

In practice, the difference between proxies and gateways is blurry. Because browsers and servers implement different versions of HTTP, proxies often do some amount of protocol conversion. And commercial proxy servers implement gateway functionality to support SSL security protocols, SOCKS firewalls, FTP access, and web-based applications.

Difference between a proxy server and a gateway server

A gateway connects two parties that speak the same protocols without modification by the first source, and it connects two parties that speak different protocols and convert between the protocols by the second source. Aren’t the definitions of gateway in the two sources contradicting each other?

Nginx can be used as a reverse proxy server, when the proxied server is a CGI server, according to its official online document. A reverse proxy server is a proxy server by the first source, which connects two parties that speak the same protocols by the second source. Nginx speaks to the client using HTTP, so shouldn’t Nginx also speak to the CGI server using HTTP?

nginx

2 Answers

  1. Communication with CGI scripts is done using the Common Gateway Interface. It is a sort of calling convention, where HTTP headers and the requested URL are passed through environment variables, whereas the request data are passed on stdin. This is a local communication as the web server must run the CGI script as a process on the same machine.

    FastCGI is a slight variation where everything is passed to the CGI script using a stream socket and a binary protocol. The socket is usually a UNIX socket (so local), but can be also a regular TCP/IP connection.

    • 2

  2. Contrary to what your sources states, the difference between a proxy and a gateway is not about whether the incoming messages are transformed or not; both types of intermediaries (forwarding agent) can transform incoming messages in reality.

    The key difference is explained in § 5.2.3 Components of Roy Fielding’s doctoral dissertation Architectural Styles and the Design of Network-Based Software Architectures (emphasis mine):

    Intermediary components act as both a client and a server in order to forward, with possible translation, requests and responses. A proxy component is an intermediary selected by a client to provide interface encapsulation of other services, data translation, performance enhancement, or security protection. A gateway (a.k.a., reverse proxy) component is an intermediary imposed by the network or origin server to provide an interface encapsulation of other services, for data translation, performance enhancement, or security enforcement. Note that the difference between a proxy and a gateway is that a client determines when it will use a proxy.

    It is also explained in § 2.3. Intermediaries of Roy Fielding and Julian Reschke’s RFC 7230 Hypertext Transfer Protocol (HTTP/1.1): Message Syntax and Routing (emphasis mine):

    HTTP enables the use of intermediaries to satisfy requests through a chain of connections. There are three common forms of HTTP intermediary: proxy, gateway, and tunnel. In some cases, a single intermediary might act as an origin server, proxy, gateway, or tunnel, switching behavior based on the nature of each request.

    […]

    A "proxy" is a message-forwarding agent that is selected by the client, usually via local configuration rules, to receive requests for some type(s) of absolute URI and attempt to satisfy those requests via translation through the HTTP interface. Some translations are minimal, such as for proxy requests for "http" URIs, whereas other requests might require translation to and from entirely different application-level protocols. Proxies are often used to group an organization's HTTP requests through a common intermediary for the sake of security, annotation services, or shared caching. Some proxies are designed to apply transformations to selected messages or payloads while they are being forwarded, as described in Section 5.7.2.

    A "gateway" (a.k.a. "reverse proxy") is an intermediary that acts as an origin server for the outbound connection but translates received requests and forwards them inbound to another server or servers. Gateways are often used to encapsulate legacy or untrusted information services, to improve server performance through "accelerator" caching, and to enable partitioning or load balancing of HTTP services across multiple machines. All HTTP requirements applicable to an origin server also apply to the outbound communication of a gateway. A gateway communicates with inbound servers using any protocol that it desires, including private extensions to HTTP that are outside the scope of this specification. However, an HTTP-to-HTTP gateway that wishes to interoperate with third-party HTTP servers ought to conform to user agent requirements on the gateway's inbound connection.

    A "tunnel" acts as a blind relay between two connections without changing the messages. Once active, a tunnel is not considered a party to the HTTP communication, though the tunnel might have been initiated by an HTTP request. A tunnel ceases to exist when both ends of the relayed connection are closed. Tunnels are used to extend a virtual connection through an intermediary, such as when Transport Layer Security (TLS, [RFC5246]) is used to establish confidential communication through a shared firewall proxy.

    In other words:

    • a proxy is an intermediary whose intermediary nature is known to the client;
    • a gateway (also known as reverse proxy) is an intermediary whose intermediary nature is not known to the client.
    • 1