How Proxies Work at OSI Layers 3, 4, and 7

Introduction

Proxies are often described in simple terms as “devices that sit between clients and servers.”
However, in real enterprise networks, how a proxy behaves depends heavily on the OSI layer at which it operates.

A proxy can function at:

• Layer 3 (Network layer)
• Layer 4 (Transport layer)
• Layer 7 (Application layer)

Each layer provides different visibility, control, performance, and security capabilities.

Understanding proxy behavior at OSI layers 3, 4, and 7 is essential when designing:

• Load balancers
• Firewalls
• WAFs
• API gateways
• Cloud reverse proxies

This article explains how proxies work at each OSI layer, with clear traffic-flow examples, use cases, and design trade-offs.

---

Quick Refresher: OSI Model Vs TPC/IP

OSI Layer	Name	Role
Layer 7	Application	HTTP, HTTPS, DNS
Layer 6	Presentation	Encryption, compression
Layer 5	Session	Session management
Layer 4	Transport	TCP, UDP
Layer 3	Network	IP routing
Layer 2	Data Link	MAC
Layer 1	Physical	Bits

Proxies mostly operate at Layers 3, 4, and 7, not at every OSI layer.

---

Layer 3 Proxy – Network-Level Proxying

What Is a Layer 3 Proxy?

A Layer 3 proxy operates at the IP level.
It makes decisions based on:

• Source IP
• Destination IP
• Routing tables

It does not understand ports, sessions, or applications.

In many designs, Layer 3 proxying looks similar to:

• IP forwarding
• NAT gateways
• Routing-based proxy behavior

---

How Traffic Flows at Layer 3

Client IP  →  Proxy (IP decision)  →  Server IP

The proxy:

• Reads the IP header
• Decides where to forward the packet
• Forwards it without session awareness

---

Example: Layer 3 Proxy in Action

Scenario:
A gateway performs destination NAT.

Client → 203.0.113.10 (VIP)
Proxy translates to → 10.1.1.20 (Server)

Key points:

• No TCP session tracking
• No awareness of HTTP or TLS
• No security inspection

---

Use Cases for Layer 3 Proxying

• Simple routing redirection
• NAT gateways
• Basic IP-based forwarding
• Internal network segmentation

---

Limitations of Layer 3 Proxies

❌ No TCP state tracking
❌ No SSL/TLS awareness
❌ No application security
❌ Cannot block L7 attacks

Layer 3 proxying is fast, but blind.

---

Layer 4 Proxy – Transport-Level Proxying

What Is a Layer 4 Proxy?

A Layer 4 proxy understands TCP and UDP, including:

• Ports
• TCP flags (SYN, ACK, FIN)
• Connection states

However, it does not understand application data (HTTP, APIs, JSON).

Layer 4 proxies are commonly referred to as:

• TCP proxies
• L4 load balancers
• Half-proxy or flow-based proxies

---

How Traffic Flows at Layer 4

Client → TCP SYN → Proxy
Proxy validates TCP state
Proxy forwards TCP stream → Server

The proxy:

• Tracks TCP state
• Forwards traffic after validation
• Does not inspect payload content

---

Example: Layer 4 Load Balancer

Scenario:
A TCP load balancer distributes HTTPS traffic.

Client → VIP:443
Proxy selects backend server
Proxy forwards encrypted TCP stream

Important:

• TLS is not decrypted
• Proxy cannot see HTTP headers
• Decisions are based on IP + port only

---

What Layer 4 Proxies Can Do

✔ TCP state validation
✔ SYN flood protection
✔ Basic rate limiting
✔ High-performance forwarding
✔ Connection tracking

---

What Layer 4 Proxies Cannot Do

❌ Cannot decrypt HTTPS
❌ Cannot run WAF rules
❌ Cannot inspect URLs or headers
❌ Cannot protect APIs

---

Use Cases for Layer 4 Proxying

• High-speed load balancing
• Database traffic (MySQL, Oracle)
• Non-HTTP protocols
• Low-latency environments

---

Layer 7 Proxy – Application-Level Proxying

What Is a Layer 7 Proxy?

A Layer 7 proxy operates at the application layer and fully understands:

• HTTP / HTTPS
• APIs (REST, JSON, XML)
• Headers, cookies, methods
• Application behavior

Layer 7 proxies are usually:

• Full proxies
• Reverse proxies
• WAF-enabled devices

---

How Traffic Flows at Layer 7

Client → HTTP/HTTPS → Proxy
Proxy terminates TCP + TLS
Proxy inspects application data
Proxy creates new connection → Server

This creates two independent connections:

• Client → Proxy
• Proxy → Server

---

Example: Layer 7 Reverse Proxy

Scenario:
A reverse proxy protects a web application.

Steps:

1. Client connects to proxy
2. Proxy terminates TLS
3. Proxy inspects HTTP request
4. WAF rules applied
5. Clean request sent to backend

---

What Layer 7 Proxies Can Do

✔ SSL/TLS offloading
✔ URL-based routing
✔ Cookie-based persistence
✔ WAF & API protection
✔ Bot mitigation
✔ Header rewriting
✔ Content inspection

---

Use Cases for Layer 7 Proxying

• Web applications
• APIs
• Banking portals
• SaaS platforms
• Cloud security

---

Cost of Layer 7 Proxying

❌ Higher CPU usage
❌ More latency (slightly)
❌ More complex configuration
❌ Stateful by design

---

Side-by-Side Comparison: L3 vs L4 vs L7 Proxy

Feature	Layer 3 Proxy	Layer 4 Proxy	Layer 7 Proxy
OSI Layer	Network	Transport	Application
TCP awareness	❌ No	✔ Yes	✔ Yes
TLS decryption	❌ No	❌ No	✔ Yes
HTTP awareness	❌ No	❌ No	✔ Yes
WAF support	❌ No	❌ No	✔ Yes
Performance	Very High	High	Moderate
Security	Very Low	Medium	Very High
Complexity	Low	Medium	High

---

How Modern Proxies Combine Multiple Layers

In real deployments, proxies often combine layers:

• L3 for routing
• L4 for connection handling
• L7 for security and intelligence

Example:

A reverse proxy may route traffic using L3, validate TCP at L4, and enforce WAF policies at L7.

---

Design Guidance: Which Layer Should You Choose?

Choose Layer 3 Proxying if:

• You need simple routing or NAT
• Security is handled elsewhere
• Performance is the only goal

Choose Layer 4 Proxying if:

• You need high throughput
• Traffic is non-HTTP
• You don’t need content inspection

Choose Layer 7 Proxying if:

• You protect web or API traffic
• You need WAF, bot mitigation, or SSL offload
• Security and control matter most

---

Summary

Proxies behave very differently depending on which OSI layer they operate at:

• Layer 3 proxies move packets efficiently but blindly
• Layer 4 proxies understand connections but not content
• Layer 7 proxies understand applications and enforce security

In modern enterprise and cloud environments:

Layer 7 proxies are essential for security,
while Layer 4 and Layer 3 proxies are essential for performance and scale.

A well-designed architecture uses all three layers together, applying each where it fits best.

Useful Links

Resource	Type	Link
Howto	Sanchit Gurukul	Open →
Tutorial	Sanchit Gurukul	Open →
Tools	Sanchit Gurukul	Open →
@sanchitgurukul	External reference	Open →

Your feedback matters

Was this post helpful?

0 reactions

👍 Like 0 ❤️ Love 0 💡 Helpful 0 🤯 Wow 0 🙏 Thanks 0