Front cover - IBM Redbooks

168 Lotus Security Handbook
From a topology point of view (both generally and bandwidth-wise), forward
proxies are always relatively closer in network speed terms to your users,
compared to a slower (WAN) link that typically separates the forward proxy from
the actual contents on the Internet.
5.3.2 Transparent proxies
5.3.3 Caching proxies
Transparent proxies are proxies that “are there,” but that do not make users
explicitly aware that the proxy is there. In forwarding proxies, these are typically
Linux/UNIX boxes that listen to all the traffic for a particular protocol for a
particular segment of a network, and intercept the traffic without the user process
actually knowing about their existence. In fact, the user process is not talking to
the proxy, but talking to another (the end) site, and the proxy is effectively
becoming a man-in-the-middle, highjacking the connection.
A proxy is non-transparent, or declared, when users know that they are talking
via a proxy, because they are talking (in proxy-speak: HTTP) to the proxy. In
other words, if I declare my proxy to be proxy.mydomain.com, then my processes
will talk to proxy.mydomain.com, asking “it” to contact the ultimate destination of
my requests. I’m fully cognizant of the existence of the proxy, that I have to talk
“proxy-speak” to it (that is, HTTP), and that I have to tell it where to go and fetch
the content from.
You can have declared, non-transparent proxies that are automatically declared,
are configured, or are discovered. Regardless of how they become declared,
these proxies are visible and known to the requesting user or process. In other
words, it does not matter how you or your process know the proxy exists, what
matters is that you do know the proxy exists, and that you are talking to the
proxy.
A transparent proxy is not truly a type of proxy on its own, but rather any proxy is
either transparent or declared by design.
A caching proxy, as the name indicates, is a proxy that is configured to reuse
cached images of content when available and possible. When a previously
cached piece of content is not available, then it fetches and serves the content
but also tries to cache it.
The most important aspect of caching proxies is to ensure that caching proxies
only cache what is truly cacheable. Dynamic, regularly changing content would
not be a good choice to cache since this could affect the stability of the
application relying on the content. In the case of HTTP content, HTTP headers
indicate if it is possible to cache the content or not via the “cache” directives.