One Network Card Is Enough for an Explicit Proxy

A private forward proxy does not need to sit physically between the laptop and the router. It can be another machine on the same LAN, using one network interface.

The laptop connects to the proxy's address and listening port. The proxy process opens a separate connection toward the website or its parent. The same interface can carry both conversations, with the host's routing table choosing the next hop.

client → proxy listener
proxy → existing router → destination

That is enough for an application that has explicitly selected the proxy. On Linux, this ordinary arrangement does not require enabling IP forwarding merely to relay the application's requests.

The default gateway answers another question

A client's default gateway handles packets the client sends toward other networks. Changing that setting does not make the browser issue HTTP proxy requests or SOCKS negotiation. Equally, entering a proxy in the browser does not route every other application through that machine.

A host can perform both jobs, but then it has two configurations to manage: the proxy service and the routing or firewall function. More interfaces may make network separation easier. They are a topology choice, not a prerequisite imposed by explicit HTTP proxying.

This distinction also explains a common failed experiment: editing a proxy server's forwarding rules has no effect on a direct client connection that travels through another router. The packets never crossed that server.

If the requirement is compulsory use, establish where alternate outbound traffic can be controlled. A one-interface explicit proxy can be a valid service while a separate gateway enforces the network policy. Place the enforcement where the packets actually pass.