Squid is the classic open-source forward proxy. Clients send their HTTP and HTTPS requests to Squid, and Squid fetches the content on their behalf. On a VPS, that gives you a fixed exit IP for API allow-lists or scraping, a way to route specific apps or browsers through another region, centralised filtering, and optionally caching. This guide sets up a secure, authenticated Squid proxy.

Warning: a misconfigured proxy that anyone can use (an “open proxy”) gets discovered and abused within hours, for spam, fraud and attacks, and the abuse reports name your IP. Always restrict access.

Install

sudo apt update
sudo apt install squid apache2-utils     # apache2-utils provides htpasswd
squid -v | head -1

RHEL family: sudo dnf install squid httpd-tools.

Back up the very long default config, and start a clean one:

sudo mv /etc/squid/squid.conf /etc/squid/squid.conf.orig

Option A: allow only your IP addresses

# /etc/squid/squid.conf
http_port 3128

acl my_clients src 203.0.113.50/32 198.51.100.0/29
acl SSL_ports port 443
acl Safe_ports port 80 443
acl CONNECT method CONNECT

http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow my_clients
http_access deny all

# privacy: don't reveal client IPs to websites
forwarded_for delete
via off
request_header_access X-Forwarded-For deny all

# no caching (pure proxy); remove to enable caching
cache deny all

access_log /var/log/squid/access.log squid

Option B: username and password authentication

For clients with changing IPs:

sudo htpasswd -c /etc/squid/passwd alice          # -c only for the first user
sudo chown proxy:proxy /etc/squid/passwd && sudo chmod 640 /etc/squid/passwd
auth_param basic program /usr/lib/squid/basic_ncsa_auth /etc/squid/passwd
auth_param basic realm Proxy
auth_param basic credentialsttl 2 hours
acl authenticated proxy_auth REQUIRED

http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow authenticated
http_access deny all

(The helper path may be /usr/lib64/squid/basic_ncsa_auth on RHEL.)

Basic auth sends credentials in base64 between client and proxy. For use across the internet, combine it with an IP allow-list, or reach the proxy through a VPN or SSH tunnel. See WireGuard.

Apply and open the port

sudo squid -k parse                  # syntax check
sudo systemctl restart squid
sudo ufw allow from 203.0.113.50 to any port 3128 proto tcp      # restrict at the firewall too

Changing the port from 3128 to something less common reduces scanner noise. Firewall restrictions do the real work.

Test it

curl -x http://203.0.113.10:3128 -U alice:password https://ifconfig.me
# → your VPS's IP

Configure clients:

  • Browsers: proxy settings, HTTP proxy vps-ip:3128, used for HTTPS too.
  • Command-line tools: export https_proxy=http://alice:password@vps-ip:3128 http_proxy=$https_proxy.
  • apt through the proxy: Acquire::http::Proxy "http://vps-ip:3128"; in /etc/apt/apt.conf.d/.

How HTTPS works through Squid

For HTTPS, the client sends CONNECT example.com:443, and Squid opens a TCP tunnel. Squid sees only the hostname and the amount of data, not the content, because TLS stays end-to-end. (Squid can do TLS interception, “SSL bump”, for corporate inspection, but that requires installing a custom CA on every client, and has serious privacy and legal implications.)

Caching (optional)

For many users fetching the same static content (software updates, for example), enable a disk cache:

cache_dir ufs /var/spool/squid 5000 16 256      # 5 GB
maximum_object_size 512 MB
cache_mem 256 MB

Run sudo squid -z to create the cache directories. Most modern web content is HTTPS and per-user, so caching gains are limited unless you cache package repositories or similar.

Logs and monitoring

sudo tail -f /var/log/squid/access.log
sudo awk '{print $3}' /var/log/squid/access.log | sort | uniq -c | sort -rn | head    # top clients

Watch for unexpected client IPs or TCP_DENIED floods (scanners probing for an open proxy). Add a Fail2Ban jail if needed. See Fail2Ban.

Squid vs alternatives

Need Tool
HTTP/HTTPS proxy with ACLs, auth and caching Squid
Any TCP app (SOCKS-aware) Dante SOCKS5
Quick personal encrypted proxy ssh -D (SOCKS). See SSH tunnels
Route everything from a device VPN. See VPN vs proxy
In front of your own web servers Reverse proxy (Nginx, HAProxy)

Use proxies in line with the terms of the sites you access and your provider’s acceptable use policy.

Quick reference

Task Command / setting
Install apt install squid
Port http_port 3128
Allow IPs acl x src IP/CIDR + http_access allow x
Password auth basic_ncsa_auth + htpasswd
Hide client IP forwarded_for delete, via off
Check config squid -k parse
Logs /var/log/squid/access.log

Related: UFW firewall and HAProxy TCP proxy.

  • Proxy
  • Networking
  • Ubuntu