Why are proxies implemented on the application level of the OSI model?

Question

Why are all proxy servers implemented on the application level of the OSI model, and not the network level? Is it possible to implement a proxy server on the network level? Such as on the gateway server?

Corporate proxies are almost always used to route all external traffic through a server before leaving the local network.

My understanding is that, theoretically speaking, this should be handled on the network level and not the application level. Practically speaking, having proxy settings configured on the application level is problematic:

• Proxy settings are not network specific.
• Proxy settings are not provided during network connection handshake (i.e the DHCP handshake)
• Proxy settings tend to linger. This causes delays or prevents connections when the proxy server is no longer accessible (e.g. the client is connecting to the internet on a different network)

I appreciate that there are valid use cases for proxies on the application level. However, I cannot help but think that the most common use of proxies is a bad application of the technology.

Answer 1

My understanding is that, theoretically speaking, this should be handled on the network level and not the application level.

Forgive me, but this is just wrong. At the network layer (or internetwork layer in the TCP/IP model), there are no logical connections, no sessions, no conversations, just individual packets. There is no mechanism to associate one packet with another or to associate a received packet with one that was sent earlier. In short, proxies require maintaining state, and there is none at the network layer.

You are correct to feel that proxies are a bit of a hack, but so are many things in networking. The models and theories that were developed in the early days of networking didn't anticipate many of the practical problems that were encountered when everyone on the planet was watching funny cat videos and posting pictures of their breakfast.

Answer 2

This actually depend on which kind of proxy you are talking about.

The most common type (and the one it seems you are referring to) is an HTTP proxy.

HTTP is a application protocol and as such an HTTP proxy belongs to the application layer.

The Internet layer doesn't care about the transported protocol, so it cannot distinguish between an HTTP request or something else.

Implementing an HTTP proxy at the Internet layer means this layer must inspect the content of the packet, which violates the very principle of layers in the first place.
This is actually done, by both transparent proxy and advanced firewall, but this doesn't change the fact this is an application layer protocol which is handled.

Also your premises are inaccurate.
Most of the time proxy settings are network specifics.
Fixed proxy settings at the computer level are only used on fixed computers where the network connections isn't supposed to changed or on laptops when you can only connect (through VPN) to the corporate network before you can access the Internet.

Automatic proxy configuration is commonly used, DHCP can also be use to provide proxy settings, and Windows 10 handle proxy settings at the connection level.

Also, note that the OSI model is only a theoretical model and is not used in real life. In practice we use the TCP/IP model.