Apache · Configuration and operations
How do you configure Apache as a reverse proxy?
Short answer
Enable mod_proxy and a protocol module, then use ProxyPass to map a URL prefix to a backend and ProxyPassReverse to rewrite backend redirects. Keep forward proxying disabled and pass the original host deliberately.
A reverse proxy accepts client requests and forwards them to an upstream server. Apache handles TLS, host routing and static assets while the application server handles dynamic work. The proxy must rewrite Location and Content-Location headers from the backend, otherwise redirects leak the internal address.
LoadModule proxy_module modules/mod_proxy.so
LoadModule proxy_http_module modules/mod_proxy_http.so
ProxyRequests Off
ProxyPreserveHost On
ProxyPass /api http://127.0.0.1:3000/api
ProxyPassReverse /api http://127.0.0.1:3000/api
ProxyPass / http://127.0.0.1:3000/
ProxyPassReverse / http://127.0.0.1:3000/Details that bite
- ProxyRequests Off prevents Apache from becoming an open forward proxy
- ProxyPreserveHost passes the client Host header to the backend
- ProxyPassReverse must match every ProxyPass target for redirect rewriting
- Exclude paths with a leading exclamation mark, for example /static !
- Set X-Forwarded-For, X-Forwarded-Proto and X-Forwarded-Host deliberately
- Use ProxyTimeout and retry settings so a dead backend fails fast
For WebSockets, enable mod_proxy_wstunnel and proxy the upgrade path, or use a recent mod_proxy_http that handles upgrades. If the backend needs the original scheme, set it explicitly or the application may generate http links behind TLS termination.
Follow-ups you should expect
Interviewers use these to check whether the first answer was understanding or memorisation.
- 1What does ProxyPassReverse actually change?
- 2Why is ProxyRequests Off important?
- 3How do you proxy WebSockets through Apache?
- 4How does the backend learn the original client IP and scheme?
Say it in the interview
I enable mod_proxy and mod_proxy_http, turn ProxyRequests off, and map prefixes with ProxyPass. ProxyPassReverse is mandatory so backend redirects do not expose internal addresses. I put specific paths before the catch-all, preserve the host intentionally and set forwarded headers. Then I tune timeouts and test redirects and WebSockets end to end.
Use this as a model, not a script. Saying it in your own words is what makes it survive follow-up pressure.
Related questions
Reading is step one
Now say it out loud.
Understanding an answer and delivering it under pressure are different skills. Rehearse this topic in a live Apache mock interview and get scored feedback on depth, clarity and confidence.