A forward proxy sends your requests to the internet on your behalf, so websites see the proxy’s IP address. People use private proxies to reach services from a fixed IP (for allow-listing), to test how a site looks from another region, or to route a specific application through a server. (A reverse proxy is different: it sits in front of your own web servers — see reverse proxy on Linux.)

Keep proxies private. An open proxy is found and abused by spammers within hours, and abuse from your IP is your responsibility under your provider’s terms. Always require authentication or restrict by IP.

Option 1: Instant SOCKS5 proxy with SSH

If you can SSH into a server, you already have a proxy:

ssh -D 1080 -N -C deploy@YOUR_SERVER_IP
  • -D 1080 opens a SOCKS5 proxy on your computer’s port 1080.
  • -N doesn’t run a remote command; -C compresses.

Set your browser or application to use SOCKS5 proxy 127.0.0.1:1080. Traffic is encrypted between your computer and the server, and nothing new is exposed on the server.

In Firefox, enable “Proxy DNS when using SOCKS v5” so DNS lookups go through the server too.

Option 2: Squid HTTP proxy with authentication

Squid is a mature HTTP/HTTPS proxy, useful when several devices or applications need a standard proxy.

Install

apt install -y squid apache2-utils

Create users

htpasswd -c /etc/squid/passwd alice
chown proxy:proxy /etc/squid/passwd && chmod 640 /etc/squid/passwd

Configure

Back up the default config and write a minimal one at /etc/squid/squid.conf:

http_port 3128

auth_param basic program /usr/lib/squid/basic_ncsa_auth /etc/squid/passwd
auth_param basic realm Private proxy
acl authenticated proxy_auth REQUIRED

# Optional: also limit to your own IPs
acl my_ips src 203.0.113.50/32

acl SSL_ports port 443
acl Safe_ports port 80 443
acl CONNECT method CONNECT

http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow authenticated my_ips
http_access deny all

# Don't reveal the client's IP to websites
forwarded_for delete
via off

access_log /var/log/squid/access.log

Restart and check:

squid -k parse
systemctl restart squid

Firewall

ufw allow from 203.0.113.50 to any port 3128 proto tcp

Test

curl -x http://alice:PASSWORD@YOUR_SERVER_IP:3128 https://ifconfig.me

It should print the server’s IP.

Note: basic proxy authentication is sent unencrypted between the client and Squid. HTTPS sites stay encrypted inside the CONNECT tunnel, but the proxy password does not. Use it only from trusted networks or over a VPN, or use the SSH method instead.

Option 3: A VPN instead

If you want all traffic from a device to use the server’s IP, a VPN is simpler and more secure than proxy settings in each app. See WireGuard VPN on a VPS.

Using multiple IPs

On a server with several IP addresses, Squid can send traffic from a specific IP using tcp_outgoing_address rules — for example, a different outgoing IP per user. Our Multi-IP VPS plans include up to dozens of IPv4 addresses for this kind of setup. Remember that sending email or spam through proxies is prohibited under our Zero Spam Policy.

Monitoring

tail -f /var/log/squid/access.log

Watch for unexpected users or destinations, and rotate passwords if anything looks wrong.

Summary

For personal use, ssh -D gives you an encrypted SOCKS proxy with zero setup. For a shared HTTP proxy, Squid with authentication and IP restrictions works well. Never run an open proxy. Pick the server location that gives you the exit IP you need — USA, Hong Kong or Japan.

  • Proxy
  • Squid
  • Linux
  • Networking