Layer 3 · Go deeper · 9 min
Go deeper
Size it, build it, then make the calls an interviewer will push you on.
Back of the envelope
Size it up
Tap through each step of the arithmetic.
How many upstream connections does a proxy need for 10,000 clients?
How busy can each proxy run and still survive losing one?
Build-up · 7 steps
Follow one request through a reverse proxy
From 10,000 mostly idle client connections to a small pool of warm ones, one job at a time.
Step 1 of 7
One public address
DNS points shop.example at the proxy, so clients think it is the server. Browsers keep connections open between clicks, so most of these 10,000 sit idle.
4 interview moments
You’re the candidate
The interviewer pushes on the hard parts. Pick an approach and see how it holds up.
Deep dive 1 of 4
Interviewer
“Your payments service calls a bank that allowlists source IPs, and a webhook sender fetches user-typed URLs. What handles the way out?”
Your move. Pick an approach:
Deep dive 2 of 4
Interviewer
“Your managed L7 balancer already terminates TLS and routes by path. A teammate wants nginx behind it as “the reverse proxy”. Do you agree?”
Your move. Pick an approach:
Deep dive 3 of 4
Interviewer
“Behind nginx, your chat service’s token-by-token LLM answers now reach users in clumps. What do you change?”
Your move. Pick an approach:
Deep dive 4 of 4
Interviewer
“An L4 balancer passes TLS straight through to nginx, which logs the balancer’s address for every user. How do you get the client IP?”
Your move. Pick an approach:
Build-up · 5 steps
Find the client’s real IP
Every hop is a new TCP connection, so the app’s peer is always its own proxy. The client’s address has to travel in a header.
Step 1 of 5
The client lies
Any client can send its own X-Forwarded-For. This one types 10.0.0.5 to look internal and slip past an admin IP allowlist.