# What is an Open Proxy?

> An open proxy is a forward proxy that accepts relay requests from arbitrary or insufficiently restricted clients, commonly from the public internet.

- Canonical URL: https://yellowcube.eu/glossary/open-proxy/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

Openness is an access-control property, not a distinct proxy protocol. Some public relays are intentionally offered, but an unintentionally open proxy is usually a misconfiguration that lets outsiders consume resources and originate activity through its address.

Attackers use open proxies to obscure their immediate source, bypass restrictions, scan targets, automate credential attacks, or reach destinations trusted by the proxy. Targets see the proxy as the connecting peer, complicating attribution and reputation. Poor destination controls may also expose internal services.

### Key points

- **Access control:** Require authenticated, authorized clients or restrict use to controlled source networks. Default-deny relay rules should cover every listener, protocol, address family, and alternate port.
- **Egress constraints:** Limit destinations, methods, ports, request sizes, connection rates, and private-address access. Prevent proxy chaining and requests to cloud metadata, loopback, or management interfaces.
- **Monitoring and response:** Alert on unusual volume, scanning patterns, authentication failures, and reputation listings. Keep proportionate records and provide a tested way to stop abuse without retaining excessive user activity.
- **Important limitation:** A proxy address does not provide trustworthy anonymity. The operator may observe metadata and plaintext, logs may link activity to a client, and destination services can use other identifiers. Conversely, defenders cannot assume the proxy address identifies the original actor. Encryption protects content only for the segments on which it is correctly established.

### Related terms

[Proxy server](<https://yellowcube.eu/glossary/proxy-server/>) · [Reverse proxy](<https://yellowcube.eu/glossary/reverse-proxy/>) · [Transparent proxy](<https://yellowcube.eu/glossary/transparent-proxy/>) · [Network access control list (ACL)](<https://yellowcube.eu/glossary/network-access-control-list/>) · [Eavesdropping attack](<https://yellowcube.eu/glossary/eavesdropping-attack/>)

### Sources

[RFC 9110: HTTP Semantics](https://www.rfc-editor.org/rfc/rfc9110) · [Apache HTTP Server: mod_proxy](https://httpd.apache.org/docs/current/mod/mod_proxy.html) · [MITRE CWE-441: Unintended Proxy or Intermediary](https://cwe.mitre.org/data/definitions/441.html)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.