A reverse proxy works by terminating every client connection itself and opening a separate connection of its own to the backend, rather than passing packets through to the server behind it. That split is what makes it a defensive control, and how much attack traffic it absorbs before the origin feels it is what a DDoS test measures. It sits in front of one or more backend servers, forwards only the requests it chooses to pass on, and can rate-limit, run challenge-response checks, cache responses, and hide the real origin IP. Most CDN and WAF deployments are reverse proxies at their core.
What terminating the connection buys you
Because the TCP handshake and the TLS session end at the proxy, everything below HTTP ends there too. Spoofed SYNs, malformed segments and stray UDP never become backend work: the origin only ever sees well-formed requests, arriving from the proxy's own addresses.
Buffering extends that. A proxy configured to read the whole request before forwarding it (NGINX does this by default with proxy_request_buffering on) means a client trickling a body in one byte at a time ties up a proxy connection, not a backend worker. Against slowloris style attacks this matters a great deal, because an event-driven proxy holds an idle connection for a few kilobytes of memory, while a thread-per-request backend spends a whole worker on it.
What the proxy does not do is change the cost of a valid request. An HTTP flood of real, complete, uncacheable requests is forwarded faithfully, because from the proxy's point of view that is the job. Layer 3 and 4 floods become the proxy's problem; Layer 7 floods stay the backend's.
Where a proxy runs out first
A proxy has ceilings of its own, and they are usually lower than people assume.
Each proxied request holds two sockets: one to the client and one to the upstream. NGINX counts both against worker_connections, so a worker configured for 1,024 connections serves roughly 512 proxied clients, not 1,024. The operating system's open-file limit sits underneath that and is often the real cap.
Toward the backend, every new upstream connection needs a local ephemeral port. Linux defaults to a range of about 28,000 ports, and closed connections sit in TIME_WAIT for a minute, so a proxy opening fresh connections to a single backend address at high rate can run out of ports while the backend is idle. Upstream keepalive is the fix, and it is frequently not configured.
Then there is waiting. If the backend slows under load, the proxy holds each request open until its read timeout, which defaults to 60 seconds in NGINX. A backend that goes from 50 milliseconds to 5 seconds per request multiplies the number of connections the proxy must hold by a hundred at the same request rate.
What a DDoS test measures
A test first checks the property everything else depends on: that the origin cannot be reached except through the proxy. If the origin IP leaks through DNS history, certificate transparency logs or a forgotten direct record, the proxy never sees the flood, which is the origin IP exposure problem.
It then pushes the proxy to its own limits, separately from the backend. Slow-client connections find the connection ceiling; a high rate of short requests to one upstream finds port exhaustion; a deliberately slowed backend finds out how fast held connections pile up.
The error codes say which layer gave way. A 503 from the proxy's own rate limiter is a control working. A 502 or 504 means the backend failed or stopped answering behind it, and connection refusals at the proxy itself mean the proxy is the layer of first failure.
Finally it checks what the backend believes about client identity. Behind a proxy every request comes from the proxy's address, so backend rate limits keyed on source IP see one enormous client unless X-Forwarded-For or the PROXY protocol is wired through, and trusted only from the proxy. A header the backend accepts from anyone is a header an attacker sets.
The same reasoning applies to a load balancer built on the same software, which DDoS testing an NGINX load balancer works through.