Proxies

Published on:

Most important commands to remember

  • curl --proxy URL — send through an explicit proxy.
  • curl --noproxy … — control which destinations bypass proxy configuration.

Commands and flags

Option Meaning
-v Show connection and protocol diagnostics on standard error.
--max-time 10 Limit each transfer to ten seconds.
--proxy http://127.0.0.1:3128 Use the existing local HTTP proxy.
--noproxy '' / --noproxy '*' Bypass no destinations / bypass proxies for all destinations.

Quotes pass an empty string or a literal asterisk to curl instead of shell filename expansion. The HTTPS URL is the destination, not the proxy address.

The concepts that matter

1. A forward proxy acts for the client

A forward proxy receives a client’s request to reach another service. Organizations use it for controlled egress, authentication, caching, or connection policy. The client explicitly uses the proxy or is directed through infrastructure performing that role.

The proxy is another participant with its own connectivity and rules. Reaching it successfully does not prove that it can reach the requested destination.

2. A reverse proxy acts in front of servers

A reverse proxy accepts traffic at a service’s public endpoint and forwards it to a backend. Clients normally address the service rather than choose the internal backend.

It can route by hostname or path, terminate TLS, or balance traffic. Forward and reverse describe the intermediary’s role, not opposite packet directions: both can carry requests and responses.

3. A tunnel and TLS termination expose different information

For HTTPS through an HTTP forward proxy, curl commonly sends CONNECT to establish a tunnel toward the destination’s host and port. After tunnel establishment, TLS can run end to end between client and origin.

A proxy terminating TLS instead decrypts one connection and may establish another to the backend. Those are separate security relationships. An encrypted client-to-proxy leg does not establish that the backend leg is encrypted too.

4. Intermediaries change what observations mean

A backend may see a proxy’s source address instead of the original client. Forwarded headers can communicate client information, but only trusted proxies should be allowed to establish those values.

A proxy-generated error is not necessarily an origin response. Investigating a failed request means distinguishing client-to-proxy connection, tunnel or routing decision, upstream connection, and application response. Each stage can succeed while the next fails.

One small example

Optional: use the stated existing local lab proxy. If none is running, read the comparison rather than assuming port 3128 provides a service.

curl -v --max-time 10 --proxy http://127.0.0.1:3128 --noproxy '' https://example.com/
curl -v --max-time 10 --noproxy '*' https://example.com/

Compare the verbose connection stages. The proxied request can show a CONNECT exchange followed by the destination’s TLS handshake. The direct request omits that explicit HTTP-proxy tunnel. Actual status codes, addresses, and TLS details vary.

A refused connection to port 3128 means the configured local proxy was unavailable; it says nothing about the destination website. A proxy rejection and an origin HTTP error are also distinct. Curl keeps certificate verification enabled in both commands.

The commands do not install a proxy or change global settings. They make two GET requests and require no cleanup. Keep credentials and private URLs out of diagnostics you share.

Keep this idea: Locate the intermediary and each connection leg before attributing a response or failure to the origin.