2

Proxies were around before NAT, and so early on in the internet, they were popular ways to get an entire network online with only a single public IP. NAT initially required complex software and/or hardware to get it working, and so understandably some organizations still used proxy servers to provide access.

In the last decade however, NAT has become immensely popular, and is available in virtually every router on the market. The hardware is so fast and cheap that unless you are trying to use a $50 home router to run say, a 5000 person office, you're not going to have issues. Firewalls are also smart enough to do complex authentication, easily allowing different users to access different services at different times of day (even the most basic home routers often have this functionality built-in). In fact, NAT is likely easier to set up and manage than a proxy server.

In my job I still often deal with clients using proxy servers to provide internet access, and the ensuing issues that arise from authentication, what account services are running as, etc. This includes some companies that are very big and old (and so I guess got their network installed over a decade ago, and just kept it that way) as well as relatively new organizations that have only a few years old.

So my question is, why in the heck are there still so many places using proxy servers for this purpose?

1
  • I think you're making a lot of assumptions in your question, most of which are incorrect. I mention this in my answer, but frankly, you're comparing apples to oranges here.
    – EEAA
    Jul 14, 2011 at 4:52

4 Answers 4

8

Proxies are still used for a few main reasons:

  1. Content filtering
  2. Authentication
  3. Caching

While NAT and proxies are similar in some respects, they operate at different layers and as such, differ in many ways and they fulfill different needs. NAT is largely a layer 3 technology and HTTP proxies are a layer 7 technology.

1
  • 5
    Authentication is a huge one for businesses. NAT logs might be able to tell you that 10.1.1.1 accessed horse porn at work, but that could have been the cleaner connecting their iPad to the network using a WPA key their friend in office 8B gave them. A Proxy can tell you that "exampleorg\erika" was in fact doing the access. Jul 14, 2011 at 4:58
5

NAT operates on a firewall and so acts on IP packets, while a proxy handles web requests at the application level, thus being able to filter, analyze and record them. This gives a proxy some capabilities which you just can't have on a router:

  • Authentication. A proxy can recognize (and accept/refuse, and log) user accounts, while a firewall only sees IP addresses.
  • Application-level filtering. In this case, URL filtering and content filtering; a proxy can analyze the web requests flowing through it and act based on their content, while a firewall can only block or allow specific IP addresses.
  • Malware protection. A proxy can check the web pages for malicious contents.
  • Logging. A proxy can log the HTTP requests and responses, complete with the full URLs your users accessed. A firewall, again, will only see IP addresses and TCP/UDP ports.
  • Caching. Less useful nowadays with so much dynamic content around, but can still help in reducing network traffic.

On the other hand, a proxy only acts on HTTP (and sometimes FTP) traffic, because it's made specifically for that; if you need any other kind of Internet traffic, a NAT is still in order.

Also, much confusion arises from the facts that there are lots of mixed firewall/proxy appliances and softwares around; but they are two fundamentally different functions, even if they run on the same device.

0

more than likely, they are using the proxy servers for monitoring, and blocking web traffic. there are many filtering tools that connect right into the proxy, and make it very easy.. Also, with proxying, you can get caching of commonly used files. When I worked at a college, every computer had a routable IP, but we still used squid to cut down on traffic.

0

I can sympathize with the authors question because of the additional features offered by routing appliances. There are several options from WatchGuard and SonicWALL which do web filtering services, Antivirus, Antispam and others all from the appliance. The difference is that they do all this without requiring you to configure proxy settings in your browser. Even though a web filter is technically a proxy server because of the layers it looks at, not having to configure browser settings makes it feel more like NAT only.

On the higher end, I feel that dedicated web filters with fiber channels scale better and are more seamless than a Windows proxy server. On the lower end, you can get a much more cost effective all in one solution with one of these multi appliances.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .