License & Deployment Mix: 16 tools – 12 OSS, 1 SaaS. (OSS and SaaS counts can overlap when an open-source tool also offers a vendor-hosted edition.)
What Is a Reverse Proxy?
A reverse proxy sits in front of backend servers and forwards client requests to the appropriate upstream service. Unlike a forward proxy (which acts on behalf of clients), a reverse proxy acts on behalf of servers – hiding backend topology, terminating TLS, enforcing authentication, and distributing traffic across service instances.
An ingress controller extends the reverse proxy concept into Kubernetes, translating Ingress or Gateway API resources into proxy configuration that routes external traffic into the cluster.
This directory evaluates reverse proxies and ingress controllers – both standalone and Kubernetes-native solutions. For dedicated load balancers (L4 focus, HA/failover, ADC), see Load Balancing / ADC. For API gateways (rate limiting, auth, developer portals), see API Gateway. For web servers (static file serving, CGI), see web-servers/. For container orchestration and service mesh, see Container Orchestration.
Reverse Proxy vs Related Technologies
| Concern | Rev Proxy | Load Balancer | API GW | Svc Mesh |
|---|---|---|---|---|
| Primary | Route requests | Distribute traffic | API mgmt | Svc-to-svc |
| Layer | L7 | L4 and/or L7 | L7 | L7 |
| TLS | Termination | Offload | Yes | mTLS |
| Routing | Host/path | Algorithm | Host/path | Virtual svc |
| Discovery | Provider-based | Static/DNS | Static/DNS | Sidecar |
| Auth | Forward-auth | Limited | Core | Core |
| Config | Dynamic/static | Static | Declarative | CRDs |
The information on these pages was researched by a combination of human review and large language models. To suggest an addition or correction, please contact us. Prepared by Rhodium Systems Inc., author of the ResorsIT platform — a unified IT operations management platform for IT teams and MSPs that integrates a curated suite of open-source, commercial, and SaaS applications into a single system with shared identity, single sign-on, access control, and a common audit trail. Use this catalogue only as a starting point for your own research, and review any tool carefully against your own requirements before relying on it. Catalogue data version 2026.197.
Comparison
Traefik is a common choice of reverse proxy and ingress controller: it handles HTTP/HTTPS/gRPC routing, automatic TLS certificate management via Let’s Encrypt, and forward-auth integration with an IdP such as Authentik. Other reverse proxies suit specialized use cases (HAProxy for L4 in front of Traefik, Nginx for static file serving). Proxies are typically monitored via Telegraf + Fluent Bit and managed with configuration automation.
SSO / OIDC (Authentik)
| Tool | Admin OIDC | Admin SAML | Forward Auth | Mgmt UI |
|---|---|---|---|---|
| Traefik | No | No | Yes (native) | Dashboard |
| Nginx | No | No | auth_request | No |
| HAProxy | No | No | Lua/SPOE | Stats page |
| Caddy | No | No | forward_auth | No (API) |
| Envoy | No | No | ext_authz | No (admin) |
| ingress-nginx | No | No | ext auth ann. | No |
| Envoy Gateway | No | No | ext_authz | No |
| Kong | Plugin | No | Plugin | Admin API |
| APISIX | Plugin | No | Plugin | Dashboard |
| Istio | No | No | ext_authz | No (istioctl) |
| Linkerd | No | No | Policy CRD | Dashboard |
| NGINX Plus | No | No | auth_request | Dashboard |
| HAPEE | Yes | No | Lua/SPOE | Web UI |
| CF Tunnel | Yes | Yes | CF Access | Dashboard |
| AWS ALB | Yes | Yes | Cognito | Console |
Best Authentik integration: Traefik (native ForwardAuth middleware is the standard Authentik integration pattern). Nginx and Caddy also support forward-auth well. Kong and APISIX offer OIDC plugins for direct token validation.
Proxy Features
| Tool | L7 | L4 TCP | L4 UDP | gRPC | WebSocket | HTTP/3 |
|---|---|---|---|---|---|---|
| Traefik | Yes | Yes | Yes | Yes | Yes | Yes |
| Nginx | Yes | Yes | Yes | Yes | Yes | Yes |
| HAProxy | Yes | Yes | Yes | Yes | Yes | Yes |
| Caddy | Yes | Plugin | No | Yes | Yes | Yes |
| Envoy | Yes | Yes | Yes | Yes | Yes | Yes |
| ingress-nginx | Yes | Yes | Yes | Yes | Yes | No |
| Envoy Gateway | Yes | Yes | Yes | Yes | Yes | Yes |
| Kong | Yes | Yes | Yes | Yes | Yes | No |
| APISIX | Yes | Yes | Yes | Yes | Yes | Yes |
| Istio | Yes | Yes | No | Yes | Yes | No |
| Linkerd | Yes | Yes | No | Yes | Yes | No |
| NGINX Plus | Yes | Yes | Yes | Yes | Yes | Yes |
| HAPEE | Yes | Yes | Yes | Yes | Yes | Yes |
| CF Tunnel | Yes | Yes | No | Yes | Yes | N/A |
| AWS ALB | Yes | No | No | Yes | Yes | No |
Best protocol breadth: Traefik, HAProxy, Envoy, and NGINX Plus cover L4 TCP/UDP, gRPC, WebSocket, and HTTP/3. Caddy and AWS ALB have gaps in L4.
Routing Capabilities
| Tool | Host | Path | Header | SNI | Regex | Weighted |
|---|---|---|---|---|---|---|
| Traefik | Yes | Yes | Yes | Yes | Yes | Yes |
| Nginx | Yes | Yes | Yes | Yes | Yes | Yes |
| HAProxy | Yes | Yes | Yes | Yes | Yes | Yes |
| Caddy | Yes | Yes | Yes | Yes | Yes | No |
| Envoy | Yes | Yes | Yes | Yes | Yes | Yes |
| ingress-nginx | Yes | Yes | Ann. | Yes | Yes | Ann. |
| Envoy Gateway | Yes | Yes | Yes | Yes | No | Yes |
| Kong | Yes | Yes | Plugin | Yes | Yes | Plugin |
| APISIX | Yes | Yes | Yes | Yes | Yes | Yes |
| Istio | Yes | Yes | Yes | Yes | Yes | Yes |
| Linkerd | Yes | Yes | Yes | Yes | No | Yes |
| NGINX Plus | Yes | Yes | Yes | Yes | Yes | Yes |
| HAPEE | Yes | Yes | Yes | Yes | Yes | Yes |
| CF Tunnel | Yes | Yes | No | N/A | No | No |
| AWS ALB | Yes | Yes | Yes | N/A | No | Yes |
TLS / Certificate Management
| Tool | Termination | Passthrough | ACME | mTLS | SNI Route |
|---|---|---|---|---|---|
| Traefik | Yes | Yes | Built-in | Yes | Yes |
| Nginx | Yes | Yes | Plugin | Yes | Yes |
| HAProxy | Yes | Yes | Plugin | Yes | Yes |
| Caddy | Yes | Plugin | Built-in | Yes | Yes |
| Envoy | Yes | Yes | SDS | Yes | Yes |
| ingress-nginx | Yes | Yes | cert-mgr | Yes | Yes |
| Envoy Gateway | Yes | Yes | cert-mgr | Yes | Yes |
| Kong | Yes | Yes | Plugin | Yes | Yes |
| APISIX | Yes | Yes | Plugin | Yes | Yes |
| Istio | Yes | Yes | cert-mgr | Yes | Yes |
| Linkerd | Yes | Yes | Built-in | Yes | Yes |
| NGINX Plus | Yes | Yes | No | Yes | Yes |
| HAPEE | Yes | Yes | Yes | Yes | Yes |
| CF Tunnel | Edge | N/A | Managed | No | N/A |
| AWS ALB | Yes | No | ACM | No | Yes |
Best automatic HTTPS: Traefik and Caddy (built-in ACME with zero configuration). Linkerd auto-provisions mTLS certificates for mesh traffic.
K8s Integration
| Tool | Ingress | Gateway API | CRDs | Helm | Canary |
|---|---|---|---|---|---|
| Traefik | Yes | Yes | IngressRoute | Yes | Yes |
| Nginx | N/A | N/A | N/A | N/A | N/A |
| HAProxy | N/A | N/A | N/A | N/A | N/A |
| Caddy | Plugin | No | No | Community | No |
| Envoy | N/A | N/A | N/A | N/A | N/A |
| ingress-nginx | Yes | Yes | No | Yes | Ann. |
| Envoy Gateway | No | Yes | Policy | Yes | Yes |
| Kong | Yes | Yes | KongPlugin | Yes | Plugin |
| APISIX | Yes | Yes | ApisixRoute | Yes | Yes |
| Istio | Yes | Yes | VirtualSvc | Yes | Yes |
| Linkerd | No | Yes | Policy | Yes | Yes |
| NGINX Plus | Yes | No | VS/VSR | Yes | Ann. |
| HAPEE | Yes | No | No | Yes | No |
| CF Tunnel | N/A | N/A | N/A | N/A | N/A |
| AWS ALB | Yes | Yes | TargetGroup | Yes | Yes |
N/A = not primarily a K8s ingress controller (standalone proxy).
Best Gateway API: Envoy Gateway (reference implementation), Istio, Traefik, and Linkerd have strong Gateway API support.
API & Integration
| Tool | REST API | Config Format | Svc Discovery | Plugins |
|---|---|---|---|---|
| Traefik | Read-only | YAML/TOML | Docker/K8s/Consul | WASM/Go |
| Nginx | No | nginx.conf | No | C modules |
| HAProxy | Runtime | haproxy.cfg | DNS | Lua/SPOE |
| Caddy | Full CRUD | Caddyfile/JSON | No | Go |
| Envoy | Admin | YAML/xDS | xDS API | WASM/Lua |
| ingress-nginx | No | Annotations | K8s | Lua |
| Envoy GW | No | Gateway API | K8s | ExtProc |
| Kong | Full CRUD | YAML/DB | K8s/DNS | Lua/Go |
| APISIX | Full CRUD | YAML/etcd | K8s/DNS/Consul | Lua/WASM |
| Istio | istioctl | YAML CRDs | K8s | WASM |
| Linkerd | linkerd CLI | YAML CRDs | K8s | No |
| NGINX Plus | Full CRUD | nginx.conf | DNS/API | C/Lua |
| HAPEE | Full CRUD | haproxy.cfg | DNS/Consul | Lua/SPOE |
| CF Tunnel | CF API | Dashboard | CF DNS | No |
| AWS ALB | AWS API | IaC (TF/CDK) | ECS/EKS/EC2 | No |
Deployment
| Tool | License | Docker | K8s | Binary | Min RAM |
|---|---|---|---|---|---|
| Traefik | Apache 2.0 | Yes | Helm | Yes | 128 MB |
| Nginx | BSD-2 | Yes | N/A | Yes | 64 MB |
| HAProxy | GPL-2.0 | Yes | N/A | Yes | 128 MB |
| Caddy | Apache 2.0 | Yes | N/A | Yes | 64 MB |
| Envoy | Apache 2.0 | Yes | N/A | Yes | 256 MB |
| ingress-nginx | Apache 2.0 | Yes | Helm | N/A | 256 MB |
| Envoy GW | Apache 2.0 | Yes | Helm | N/A | 256 MB |
| Kong | Apache 2.0 | Yes | Helm | Yes | 256 MB |
| APISIX | Apache 2.0 | Yes | Helm | Yes | 256 MB |
| Istio | Apache 2.0 | Yes | istioctl | N/A | 512 MB |
| Linkerd | Apache 2.0 | Yes | linkerd CLI | N/A | 256 MB |
| NGINX Plus | Proprietary | Yes | Helm | Yes | 128 MB |
| HAPEE | Proprietary | Yes | Helm | Yes | 256 MB |
| CF Tunnel | Proprietary | Yes | Helm | Yes | 64 MB |
| AWS ALB | Proprietary | N/A | N/A | N/A | N/A |
Monitoring Integration (Telegraf / Fluent Bit /
Grafana)
| Tool | Prometheus | Structured Logs | SNMP | Tracing |
|---|---|---|---|---|
| Traefik | Native | JSON | No | OTel |
| Nginx | Exporter | Text/JSON | No | Module |
| HAProxy | Exporter | Syslog | No | No |
| Caddy | Native | JSON | No | No |
| Envoy | Native | JSON | No | Native |
| ingress-nginx | Native | JSON | No | OTel |
| Envoy GW | Native | JSON | No | Native |
| Kong | Plugin | JSON | No | Plugin |
| APISIX | Plugin | JSON | No | Plugin |
| Istio | Native | JSON | No | Native |
| Linkerd | Native | JSON | No | Native |
| NGINX Plus | Native | JSON | No | Module |
| HAPEE | Native | Syslog | SNMP | No |
| CF Tunnel | No | CF Logs | No | No |
| AWS ALB | No | CloudWatch | No | X-Ray |
Best monitoring integration: Traefik (native Prometheus /metrics, structured JSON logs, OTel tracing), Envoy (native Prometheus, structured logs, native tracing), and ingress-nginx (Prometheus + JSON access logs).
Pricing
Open Source
| Tool | License | Pricing |
|---|---|---|
| Traefik | Apache 2.0 | Free |
| Nginx | BSD-2-Clause | Free |
| HAProxy | GPL-2.0 | Free |
| Caddy | Apache 2.0 | Free |
| Envoy | Apache 2.0 | Free |
| ingress-nginx | Apache 2.0 | Free |
| Envoy Gateway | Apache 2.0 | Free |
| Kong Gateway | Apache 2.0 | Free |
| Apache APISIX | Apache 2.0 | Free |
| Istio | Apache 2.0 | Free |
| Linkerd | Apache 2.0 | Free |
Commercial
| Tool | Pricing |
|---|---|
| NGINX Plus | From ~$2,500/yr per instance |
| HAPEE | From ~$3,500/yr per instance |
| Traefik Enterprise | Contact sales |
| Kong Enterprise | Contact sales |
Cloud / Managed
| Tool | Pricing |
|---|---|
| Cloudflare Tunnel | Free (basic); paid plans from $20/mo |
| AWS ALB | Pay-per-use (~$0.02/hr + LCU) |
Tools
16 tools.
Apache APISIX
Apache APISIX is a cloud-native API gateway and ingress controller that uses etcd as its configuration store. Built on OpenResty (Nginx + Lua), APISIX provides dynamic routing, plugin-based extensibility, and Kubernetes-native deployment.
License: Apache-2.0 (OSS) · Kind: web · Deploy: native, docker, k8s · SSO: none
AWS Application Load Balancer
AWS Application Load Balancer (ALB) is a managed Layer 7 load balancer and reverse proxy for AWS workloads, providing host- and path-based routing, WebSocket and gRPC support, TLS termination, and OIDC auth.
License: Proprietary (proprietary) · Kind: web · Deploy: saas, native, k8s · SSO: none
Caddy
Caddy is an open-source Go web server and reverse proxy whose defining feature is automatic HTTPS, provisioning and renewing TLS certificates with zero configuration, shipping as a single static binary.
License: Apache-2.0 (OSS) · Kind: web · Deploy: native, docker · SSO: none
Cloudflare Tunnel
Cloudflare Tunnel (formerly Argo Tunnel) provides zero-trust ingress to internal services without opening inbound firewall ports.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none
Contour
Contour is a Kubernetes ingress controller built on Envoy Proxy, originally created at VMware/Heptio and now a CNCF Incubating project.
License: Apache-2.0 (OSS) · Kind: web · Deploy: k8s · SSO: OIDC
Envoy
Envoy is a modern, high-performance L7 proxy and communication bus designed for large microservices architectures.
License: Apache-2.0 (OSS) · Kind: web · Deploy: native, docker, k8s · SSO: none
Envoy Gateway
Envoy Gateway is the Kubernetes Gateway API reference implementation built on Envoy Proxy, translating Gateway API resources into Envoy config for L7/L4 routing, rate limiting, and TLS.
License: Apache-2.0 (OSS) · Kind: web · Deploy: k8s · SSO: OIDC
HAProxy
HAProxy (High Availability Proxy) is a high- performance L4/L7 proxy and load balancer widely deployed by companies including GitHub, Reddit, Stack Overflow, and Airbnb.
License: GPL-2.0-only (OSS) · Kind: web · Deploy: native, docker · SSO: none
HAProxy Enterprise
HAProxy Enterprise (HAPEE) is the commercial version of HAProxy, developed and supported by HAProxy Technologies.
License: Proprietary (proprietary) · Kind: web · Deploy: native, docker · SSO: none
ingress-nginx
ingress-nginx is the default Kubernetes Ingress controller, maintained by the Kubernetes project itself.
License: Apache-2.0 (OSS) · Kind: web · Deploy: k8s · SSO: none
Istio
Istio is a CNCF graduated service mesh that provides traffic management, security, and observability for microservices running on Kubernetes.
License: Apache-2.0 (OSS) · Kind: web · Deploy: k8s · SSO: none
Kong Gateway
Kong Gateway is an open-source API gateway built on OpenResty (Nginx + Lua) that also functions as a Kubernetes ingress controller.
License: Apache-2.0 (OSS) · Kind: web · Deploy: native, docker, k8s · SSO: none
Linkerd
Linkerd is a CNCF-graduated, lightweight Kubernetes service mesh focused on simplicity and performance, using a Rust micro-proxy to provide automatic mTLS, observability, and traffic policies.
License: Apache-2.0 (OSS) · Kind: web · Deploy: k8s · SSO: none
Nginx
Nginx is a widely deployed open-source web server and reverse proxy, using an event- driven architecture for high-performance static file serving, SSL termination, load balancing, and HTTP/2 and HTTP/3 support.
License: BSD-2-Clause (OSS) · Kind: web · Deploy: native, docker · SSO: none
NGINX Plus
NGINX Plus is the commercial edition of Nginx from F5, extending the open-source reverse proxy with active health checks, session persistence, live monitoring, and a dynamic configuration API.
License: Proprietary (proprietary) · Kind: web · Deploy: native, docker · SSO: none
Traefik
Traefik is a cloud-native reverse proxy and ingress controller designed to integrate seamlessly with container orchestrators and service discovery systems.
License: Apache-2.0 (OSS) · Kind: web · Deploy: native, docker, k8s · SSO: none
