In the application-proxy-gateway model described by NIST, the gateway accepts a connection on one side, applies policy, and creates a separate connection on the other side for traffic that is allowed.
Because the proxy acts as a protocol endpoint, it can validate supported application syntax, restrict commands or content, authenticate a requester, normalize traffic, and hide some internal addressing. These capabilities depend on protocol-specific understanding. Generic relaying, unsupported protocols, or encrypted content that is not lawfully terminated and inspected may receive only lower-layer controls.
Key points
Protocol supportIdentify which application protocols and versions the proxy understands, which features it permits, and how unsupported or upgraded traffic is handled.
Trust boundaryDefine where transport encryption terminates and resumes, how destination and client identity are validated, and how keys, certificates, content, and logs are protected.
OperationsGovern policy, authentication, updates, capacity, timeouts, error behavior, high availability, and bypass paths; test protocol compatibility and failure modes before enforcement.
Important limitationProxying does not guarantee safe content or correct authorization. The proxy becomes a security and availability dependency, and parsing differences, unknown protocols, tunnels, direct backend paths, or excessive generic pass-through can defeat the intended control.