Reverse proxy or Public load balancer?

Question

What would be the difference between putting in a load balancer or reverse proxy on the perimeter to send requests back to a system in our LAN? We don't want to have people NAT directly into the LAN, which is why we're considering putting this extra step in between.

To make things clear the requests are coming from a cloud provider and currently configured to terminate the connection within the LAN. I don't see what a load balancer would give us from a security perspective, but I'm not sure how much more security would be placed with a reverse proxy either. Either way, I'd prefer these connections to be as secure as possible. I'm limiting what the source addresses from the cloud provider can hit, but there might be a need for remote clients to attach as well, which would make things less secure.

Any suggestions?

Answer 1

A reverse proxy (and by extension most load balancer which are essentially a specialised reverse proxy) would generally reconstruct the packet/request (depending on what layer it functions at) rather than just modifying the packet and forwarding it on.

That process can provide some protection against malformed or forged packets/requests. Typically this is described as "breaking the circuit" because packets are never directly passed between the networks.

Answer 2

For limiting the source addresses, a firewall like iptables will do the needful. This manual whitelisting can be a problem with dynamic public IP Addresses changing frequently (can be a case with cloud).

Load Balancer is more of a transparent reverse proxy with different sort of algorithms like Round Robin, Least Connection method, etc. more focussed on distributing load. Now a days Load Balancers are offering even security features as components which can be on the same box.

Reverse Proxy is a very light-weight component which does redirection based on port or url. As the connection gets terminated at proxy, it provides basic protection against attacks and prevent fingerprinting. You can look into this question to have a better understanding. Reverse Proxy or direct?