Confirm that the planned listeners are free: ss -ltn | grep -E ':(18080|18081)[[:space:]]' || true. Do not continue if an unrelated listener is using either port.

Create and enter the isolated workspace: mkdir -p /opt/lab-classroom/class64 && cd /opt/lab-classroom/class64.

Create the backend with a shell heredoc:
`cat > /opt/lab-classroom/class64/backend.py <<'PY'

!/usr/bin/env python3

import json
from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer

HOST = "127.0.0.1"
PORT = 18081

class BackendHandler(BaseHTTPRequestHandler):
protocol_version = "HTTP/1.1"

def log_message(self, fmt, *args):
    print("backend:", fmt % args, flush=True)

def send_json(self, status, payload):
    body = json.dumps(payload, separators=(",", ":")).encode("utf-8")
    self.send_response(status)
    self.send_header("Content-Type", "application/json")
    self.send_header("Content-Length", str(len(body)))
    self.send_header("Connection", "X-Backend-Hop")
    self.send_header("X-Backend-Hop", "must-not-reach-client")
    self.end_headers()
    self.wfile.write(body)

def do_GET(self):
    if self.path == "/hello":
        self.send_json(200, {
            "path": self.path,
            "host": self.headers.get("Host"),
            "x_forwarded_for": self.headers.get("X-Forwarded-For"),
            "x_forwarded_host": self.headers.get("X-Forwarded-Host"),
            "x_forwarded_proto": self.headers.get("X-Forwarded-Proto"),
            "via": self.headers.get("Via"),
            "x_lab_hop": self.headers.get("X-Lab-Hop")
        })
    elif self.path == "/fail":
        self.send_json(500, {"error": "intentional failure"})
    else:
        self.send_json(404, {"error": "not found"})

if name == "main":
ThreadingHTTPServer((HOST, PORT), BackendHandler).serve_forever()
PY`

Create the reverse proxy with a shell heredoc:
`cat > /opt/lab-classroom/class64/proxy.py <<'PY'

!/usr/bin/env python3

import http.client
import json
from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer

LISTEN_HOST = "127.0.0.1"
LISTEN_PORT = 18080
UPSTREAM_HOST = "127.0.0.1"
UPSTREAM_PORT = 18081

FIXED_HOP_BY_HOP = {
"connection", "keep-alive", "proxy-authenticate",
"proxy-authorization", "te", "trailer",
"transfer-encoding", "upgrade"
}

def connection_tokens(headers):
tokens = set()
for value in headers.get_all("Connection", []):
for token in value.split(","):
token = token.strip().lower()
if token:
tokens.add(token)
return tokens

def appended(existing, value):
return f"{existing}, {value}" if existing else value

class ProxyHandler(BaseHTTPRequestHandler):
protocol_version = "HTTP/1.1"

def log_message(self, fmt, *args):
    print("proxy:", fmt % args, flush=True)

def send_local_json(self, status, payload):
    body = json.dumps(payload, separators=(",", ":")).encode("utf-8")
    self.send_response(status)
    self.send_header("Content-Type", "application/json")
    self.send_header("Content-Length", str(len(body)))
    self.end_headers()
    self.wfile.write(body)

def proxy_request(self):
    request_hop = FIXED_HOP_BY_HOP | connection_tokens(self.headers)
    try:
        content_length = int(self.headers.get("Content-Length", "0"))
    except ValueError:
        self.send_local_json(400, {"error": "invalid content-length"})
        return
    body = self.rfile.read(content_length) if content_length else None
    outbound = {}
    managed = {
        "host", "content-length", "x-forwarded-for",
        "x-forwarded-host", "x-forwarded-proto", "via"
    }
    for name, value in self.headers.items():
        lower = name.lower()
        if lower not in request_hop and lower not in managed:
            outbound[name] = value
    outbound["Host"] = f"{UPSTREAM_HOST}:{UPSTREAM_PORT}"
    if body is not None:
        outbound["Content-Length"] = str(len(body))
    outbound["X-Forwarded-For"] = appended(
        self.headers.get("X-Forwarded-For"), self.client_address[0]
    )
    outbound["X-Forwarded-Host"] = self.headers.get("Host", "")
    outbound["X-Forwarded-Proto"] = "http"
    outbound["Via"] = appended(self.headers.get("Via"), "1.1 class64-proxy")

    connection = http.client.HTTPConnection(UPSTREAM_HOST, UPSTREAM_PORT, timeout=3)
    try:
        connection.request(self.command, self.path, body=body, headers=outbound)
        response = connection.getresponse()
        response_body = response.read()
        response_hop = FIXED_HOP_BY_HOP | connection_tokens(response.headers)
        self.send_response(response.status, response.reason)
        for name, value in response.getheaders():
            lower = name.lower()
            if lower not in response_hop and lower != "content-length":
                self.send_header(name, value)
        self.send_header("Content-Length", str(len(response_body)))
        self.end_headers()
        self.wfile.write(response_body)
    except (OSError, http.client.HTTPException):
        self.send_local_json(502, {
            "error": "bad_gateway",
            "detail": "upstream unavailable"
        })
    finally:
        connection.close()

def do_GET(self):
    self.proxy_request()

def do_POST(self):
    self.proxy_request()

def do_PUT(self):
    self.proxy_request()

def do_DELETE(self):
    self.proxy_request()

if name == "main":
ThreadingHTTPServer((LISTEN_HOST, LISTEN_PORT), ProxyHandler).serve_forever()
PY`

Start the backend and proxy from the workspace: cd /opt/lab-classroom/class64 && nohup python3 backend.py > backend.log 2>&1 & echo $! > backend.pid && nohup python3 proxy.py > proxy.log 2>&1 & echo $! > proxy.pid && sleep 1. Confirm both listeners with ss -ltn | grep -E ':(18080|18081)[[:space:]]'.

Request the backend through the proxy: curl -sS http://127.0.0.1:18080/hello. The exact body is {"path":"/hello","host":"127.0.0.1:18081","x_forwarded_for":"127.0.0.1","x_forwarded_host":"127.0.0.1:18080","x_forwarded_proto":"http","via":"1.1 class64-proxy","x_lab_hop":null}.

Observe the full proxied response: curl -sS -i http://127.0.0.1:18080/hello. Expect HTTP 200, a Content-Type of application/json, and a Content-Length matching the buffered response. Neither Connection: X-Backend-Hop nor X-Backend-Hop: must-not-reach-client may appear.

Verify Via appending and removal of a Connection-nominated request header: curl -sS -H 'Via: 1.0 lab-client' -H 'Connection: X-Lab-Hop' -H 'X-Lab-Hop: remove-me' http://127.0.0.1:18080/hello. The exact body is {"path":"/hello","host":"127.0.0.1:18081","x_forwarded_for":"127.0.0.1","x_forwarded_host":"127.0.0.1:18080","x_forwarded_proto":"http","via":"1.0 lab-client, 1.1 class64-proxy","x_lab_hop":null}.

Request the intentional backend failure: curl -sS -i http://127.0.0.1:18080/fail. Expect status HTTP 500 and the exact body {"error":"intentional failure"}. This demonstrates that the proxy relays an upstream application error rather than changing it to 502.

Stop only the backend and test bad-gateway behavior: cd /opt/lab-classroom/class64 && kill "$(cat backend.pid)" && sleep 1 && curl -sS -i http://127.0.0.1:18080/hello. Expect status HTTP 502 and the exact body {"error":"bad_gateway","detail":"upstream unavailable"}.

Restart the backend immediately after the 502 test so all later checks can succeed: cd /opt/lab-classroom/class64 && nohup python3 backend.py > backend.log 2>&1 & echo $! > backend.pid && sleep 1 && curl -sS http://127.0.0.1:18080/hello. The final curl must again return the exact successful /hello JSON shown in step 6.

Review process logs without changing system state: cat /opt/lab-classroom/class64/proxy.log and cat /opt/lab-classroom/class64/backend.log.