I'd say you don't even need to run your local proxy on 80/443 unless it's your public-facing endpoint. Client -> load balancer:80 -> [proxy:8080 -> application:

I'd say you don't even need to run your local proxy on 80/443 unless it's your public-facing endpoint. Client -> load balancer:80 -> [proxy:8080 -> application:8085] or something is fine. > As for the various grandparents talking about whatever they did at FAANG: I don't believe it I promise you there's a lot of stuff that by-design lives in its own private network (VPC, etc.), and that won't change even with efforts to reduce reliance on corporate intranets. Your laptop gets treated differently from some application server in a cloud provider's datacenter. The latter probably has no reason ever to reach out over the Internet, it has no business even accepting connections from anyone but the (very small) set of allowed clients (probably just your load-balancer layer, plus whatever management stuff). So why allow it? The only argument I've seen for this is that by knowing your hosts are exposed to the internet, you're forced to build for that high-threat environment, but that doesn't seem to outweigh the additional layer of defense-in-depth. This is not to say that anyone should use that private networking layer as their only security control. So: build as if you're on the public internet, but then don't be, to the maximum extent possible.