--- title: Layer 4 vs Layer 7 Reverse Proxies: Using HAProxy to... description: A practical guide explaining the difference between Layer 4 and Layer 7 reverse proxies, using HAProxy as a concrete example. Layer 4 proxies pass TLS traffic... canonical: https://daily.dev/posts/layer-4-vs-layer-7-reverse-proxies-using-haproxy-to-front-web-services-for-ipv4-to-v6-transition--tclmybwpg twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Layer 4 vs Layer 7 Reverse Proxies: Using HAProxy to front Web Services (for IPv4 to v6 Transition) | daily.dev og:description: A practical guide explaining the difference between Layer 4 and Layer 7 reverse proxies, using HAProxy as a concrete example. Layer 4 proxies pass TLS traffic... og:url: https://daily.dev/posts/layer-4-vs-layer-7-reverse-proxies-using-haproxy-to-front-web-services-for-ipv4-to-v6-transition--tclmybwpg og:image: https://api.daily.dev/og/posts/TCLmYbWpG.png og:image:alt: Layer 4 vs Layer 7 Reverse Proxies: Using HAProxy to front Web Services (for IPv4 to v6 Transition) og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Layer 4 vs Layer 7 Reverse Proxies: Using HAProxy to front Web Services (for IPv4 to v6 Transition) **[apalrd's adventures](https://daily.dev/sources/apalrd)** · 6 min read · 0 upvotes · 0 comments ## Summary A practical guide explaining the difference between Layer 4 and Layer 7 reverse proxies, using HAProxy as a concrete example. Layer 4 proxies pass TLS traffic unmodified using SNI for routing, while Layer 7 proxies terminate TLS and can inspect full HTTP requests. The setup uses HAProxy to front IPv6 backend services for IPv4 clients, covering installation, configuration snippets for HTTP redirect, Layer 7 HTTP proxying, Layer 4 SNI-based HTTPS proxying, and rsyslog-based logging. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the difference between a Layer 4 and Layer 7 reverse proxy for HTTPS traffic? A Layer 4 proxy passes TLS traffic through unmodified, reading only the SNI field in the Client Hello to route by domain name — the backend handles TLS termination. A Layer 7 proxy terminates TLS itself, requiring the certificate and key, and can inspect full HTTP requests, rewrite paths, convert protocols (HTTP/1.1 to HTTP/2), cache responses, and route by URL path. _Engineers choosing between proxy architectures for their stack find the trade-offs covered on daily.dev._ ### How can I use HAProxy to allow IPv4 clients to reach IPv6-only backend servers? HAProxy can act as a protocol bridge: IPv4 clients connect to HAProxy on a shared IPv4 address, and HAProxy forwards connections to backend servers over IPv6. For HTTPS, a Layer 4 SNI proxy passes TLS through unmodified while translating the network layer. IPv6-native clients can bypass the proxy and connect directly to backends. _Developers navigating IPv4/IPv6 coexistence strategies share practical setups like this on daily.dev._ ### How do I enable HAProxy logging to a file on Debian? HAProxy logs via rsyslog by default, so no log file appears unless rsyslog is installed separately. After installing rsyslog, HAProxy writes logs to /var/log/haproxy.log. The log file can grow large over time, so log rotation should be configured to prevent disk exhaustion. _Keeping up with HAProxy operational tips and infrastructure tooling is easier when the relevant posts surface on daily.dev._ ## Similar posts on daily.dev - [A Developer’s Guide to Proxy Servers](https://daily.dev/posts/a-developer-s-guide-to-proxy-servers-a3omjrfop) · freeCodeCamp · 3 upvotes · 0 comments - [EP194: Evolution of HTTP](https://daily.dev/posts/ep194-evolution-of-http-rk0k8khxl) · ByteByteGo · 11 upvotes · 0 comments - [Cloudflare Tunnel: Self-Host Behind CGNAT and Hide Your IP](https://daily.dev/posts/cloudflare-tunnel-self-host-behind-cgnat-and-hide-your-ip-oym3uguge) · Milan Jovanović · 3 upvotes · 0 comments - [The Ghost in the Machine: Why Layer 5 SOCKS5 is the Silent Engine of Modern Automation](https://daily.dev/posts/the-ghost-in-the-machine-why-layer-5-socks5-is-the-silent-engine-of-modern-automation-sqqffg4gu) · Medium · 0 upvotes · 0 comments --- [View this post on daily.dev](https://daily.dev/posts/layer-4-vs-layer-7-reverse-proxies-using-haproxy-to-front-web-services-for-ipv4-to-v6-transition--tclmybwpg) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Layer 4 vs Layer 7 Reverse Proxies: Using HAProxy to front Web Services (for IPv4 to v6 Transition)","url":"https://daily.dev/posts/layer-4-vs-layer-7-reverse-proxies-using-haproxy-to-front-web-services-for-ipv4-to-v6-transition--tclmybwpg","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/layer-4-vs-layer-7-reverse-proxies-using-haproxy-to-front-web-services-for-ipv4-to-v6-transition--tclmybwpg"},"datePublished":"2026-08-11T08:56:33.751Z","dateModified":"2026-08-11T09:38:08.609Z","description":"A practical guide explaining the difference between Layer 4 and Layer 7 reverse proxies, using HAProxy as a concrete example. Layer 4 proxies pass TLS traffic...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/51706d0ad1208d828721dc1b22c57a6a?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/51706d0ad1208d828721dc1b22c57a6a?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"apalrd's adventures","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"apalrd's adventures","logo":"https://media.daily.dev/image/upload/s--4zkx8dRj--/f_auto,q_auto/v1786438309/logos/apalrd?_a=BAMAMicg0","url":"https://daily.dev/sources/apalrd"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/layer-4-vs-layer-7-reverse-proxies-using-haproxy-to-front-web-services-for-ipv4-to-v6-transition--tclmybwpg","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"apalrd's adventures","item":"https://daily.dev/sources/apalrd"},{"@type":"ListItem","position":3,"name":"Layer 4 vs Layer 7 Reverse Proxies: Using HAProxy to front Web Services (for IPv4 to v6 Transition)"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/layer-4-vs-layer-7-reverse-proxies-using-haproxy-to-front-web-services-for-ipv4-to-v6-transition--tclmybwpg#faq","mainEntity":[{"@type":"Question","name":"What is the difference between a Layer 4 and Layer 7 reverse proxy for HTTPS traffic?","acceptedAnswer":{"@type":"Answer","text":"A Layer 4 proxy passes TLS traffic through unmodified, reading only the SNI field in the Client Hello to route by domain name — the backend handles TLS termination. A Layer 7 proxy terminates TLS itself, requiring the certificate and key, and can inspect full HTTP requests, rewrite paths, convert protocols (HTTP/1.1 to HTTP/2), cache responses, and route by URL path. Engineers choosing between proxy architectures for their stack find the trade-offs covered on daily.dev."}},{"@type":"Question","name":"How can I use HAProxy to allow IPv4 clients to reach IPv6-only backend servers?","acceptedAnswer":{"@type":"Answer","text":"HAProxy can act as a protocol bridge: IPv4 clients connect to HAProxy on a shared IPv4 address, and HAProxy forwards connections to backend servers over IPv6. For HTTPS, a Layer 4 SNI proxy passes TLS through unmodified while translating the network layer. IPv6-native clients can bypass the proxy and connect directly to backends. Developers navigating IPv4/IPv6 coexistence strategies share practical setups like this on daily.dev."}},{"@type":"Question","name":"How do I enable HAProxy logging to a file on Debian?","acceptedAnswer":{"@type":"Answer","text":"HAProxy logs via rsyslog by default, so no log file appears unless rsyslog is installed separately. After installing rsyslog, HAProxy writes logs to /var/log/haproxy.log. The log file can grow large over time, so log rotation should be configured to prevent disk exhaustion. Keeping up with HAProxy operational tips and infrastructure tooling is easier when the relevant posts surface on daily.dev."}}]} ```