Reverse Proxies 101

What is a Reverse Proxy?

A network with a subnet mask of /24 has 254 usable hosts, each host has A reverse proxy sits between clients (browsers, apps) and backend servers. So do you have to open up 16,645,890 ports on your network? Is that the magic upper limit of how many services you can host on a single IP?

No, because you have reverse proxies. A reverse proxy is a service that sits at the edge of your network with ports 80/443 open. When a client requests a service via networking, the client connects to the reverse proxy instead of the application. The reverse proxy decides which backend server should handle the request and forwards the appropriate request and as for the client, it has no qualms as 80/443 ports are the standard ports for web traffic.

Why Use a Reverse Proxy?

Multiple Services on One IP

Most home internet connections give you one public IP. With a reverse proxy, you can run many services and route based on hostname:

1
2
3
cloud.example.com  -> Nextcloud
jelly.example.com  -> Jellyfin
git.example.com    -> Gitea

All on the same IP, same ports (80, 443).

SSL/TLS Termination

Instead of configuring SSL on each service, the proxy handles it once:

One certificate to manage
One place to configure HTTPS settings
Centralized security policies

Security Benefits

Backend services are not directly exposed
Can add authentication, rate limiting, IP filtering
Hides internal network structure
Logs and monitoring in one place

My Setup: Traefik with Docker

I use Traefik because of its excellent Docker integration - its killer feature is that each container can be addressed via labels.

Basic Architecture

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
Internet
  ↓
Router (ports 80, 443 forwarded)
  ↓
Docker Host
  ↓
Traefik (published ports 80, 443)
  ↓
Docker Network
  ├── service1 (Nextcloud)
  ├── service2 (Gitea)
  ├── service3 (Jellyfin)
  └── service4 (Portainer)

Conclusion

Many applications in your homelab are fighting for the singular port 80/443 - a reverse proxy transforms a homelab from a bunch of services on random ports to a polished, production-like setup with HTTPS and proper routing.