Self-Hosted Proxy: Setting Up Squid on a VPS

Why run your own proxy?

Running your own proxy on a cheap VPS gives you a private, dedicated datacenter IP that only you use, with no per-GB fees beyond the server's bandwidth allowance. It's useful for:

• Giving yourself a fixed IP for whitelisting with services.
• Testing your apps from another region.
• Learning how proxies work.
• Small, lenient scraping jobs.

Limitations: it's one datacenter IP (easy to identify as hosting), you're responsible for security, and scaling to many IPs gets expensive quickly. For most commercial use, buying proxies is cheaper. See cheap proxies.

Prerequisites

• A VPS running Ubuntu or Debian, with root or sudo access.
• Its public IP address.
• A firewall you can configure.

Step 1: Install Squid

sudo apt update
sudo apt install -y squid apache2-utils

apache2-utils provides htpasswd for creating password files.

Step 2: Create a user

sudo htpasswd -c /etc/squid/passwords proxyuser

Enter a strong password when prompted. Omit -c when adding more users later.

Step 3: Configure Squid

Back up the default config and create a minimal one:

sudo cp /etc/squid/squid.conf /etc/squid/squid.conf.bak
sudo tee /etc/squid/squid.conf > /dev/null <<'EOF'
http_port 3128

auth_param basic program /usr/lib/squid/basic_ncsa_auth /etc/squid/passwords
auth_param basic realm proxy
auth_param basic credentialsttl 2 hours
acl authenticated proxy_auth REQUIRED

acl SSL_ports port 443
acl Safe_ports port 80 443
acl CONNECT method CONNECT
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports

http_access allow authenticated
http_access deny all

# Don't reveal the client's IP or that a proxy is in use
forwarded_for delete
via off
request_header_access X-Forwarded-For deny all

cache deny all
EOF

The path to basic_ncsa_auth can vary by distribution; check with dpkg -L squid | grep basic_ncsa_auth.

Step 4: Restart and enable

sudo systemctl restart squid
sudo systemctl enable squid
sudo systemctl status squid

Step 5: Firewall

Open the proxy port, ideally only to your own IPs:

sudo ufw allow from YOUR.HOME.IP to any port 3128 proto tcp
sudo ufw allow OpenSSH
sudo ufw enable

Never run an open proxy without authentication. It will be found and abused within hours, and you'll be responsible for that traffic.

Step 6: Test

curl -x http://proxyuser:PASSWORD@YOUR.VPS.IP:3128 https://api.ipify.org
curl -x http://proxyuser:PASSWORD@YOUR.VPS.IP:3128 http://httpbin.org/headers

The first should show the VPS IP; the second should show no X-Forwarded-For or Via header. See how to check if a proxy works and proxy anonymity levels.

Optional: IP-based access instead of passwords

acl myips src 203.0.113.5/32
http_access allow myips
http_access deny all

See proxy authentication methods.

Maintenance

• Keep the system updated.
• Monitor logs: /var/log/squid/access.log.
• Rotate passwords periodically.
• Watch bandwidth usage against your VPS plan.

Adding more users and restricting each one

Create additional users without -c (which would overwrite the file):

sudo htpasswd /etc/squid/passwords seconduser
sudo systemctl reload squid

To restrict a user to certain destination domains:

acl user_alice proxy_auth alice
acl alice_sites dstdomain .example.com .example.org
http_access allow user_alice alice_sites
http_access deny user_alice

Place these rules before the general http_access allow authenticated line, since Squid evaluates rules in order.

Limiting bandwidth

Squid's delay pools can cap bandwidth, useful if your VPS has a monthly transfer allowance:

delay_pools 1
delay_class 1 1
delay_parameters 1 2000000/2000000
delay_access 1 allow authenticated

This example caps aggregate throughput at roughly 2 MB/s. Adjust for your needs.

Logging and privacy

Squid logs every request to /var/log/squid/access.log, including URLs for HTTP and hostnames for HTTPS CONNECT. If privacy matters:

• Rotate logs frequently (logrotate is configured by default on most systems).
• Reduce retention.
• Or disable access logging with access_log none (you lose debugging ability).

Turning your server into a SOCKS5 proxy instead

For a quick SOCKS5 proxy without extra software, an SSH dynamic tunnel works:

ssh -N -D 1080 user@your-vps

Your local machine then has a SOCKS5 proxy at 127.0.0.1:1080 that exits from the VPS. For a permanent multi-user SOCKS5 server, use Dante or 3proxy. See SOCKS5 proxies.

Self-hosted vs bought: cost comparison

For anything beyond one or two IPs, buying is usually simpler and cheaper. See cheap datacenter proxies and best datacenter proxies.

Security hardening checklist

• [ ] Authentication or strict IP ACLs enabled
• [ ] Firewall allows the proxy port only from trusted IPs
• [ ] SSH key authentication; password login disabled
• [ ] Automatic security updates enabled
• [ ] Only safe ports allowed (80/443) for outbound proxying
• [ ] Logs reviewed periodically for abuse

Encrypting the connection to your Squid proxy

By default, clients talk to Squid in plain text, so proxy credentials travel unencrypted between client and server. Squid can also accept TLS connections on an https_port, which protects them:

https_port 3130 tls-cert=/etc/letsencrypt/live/proxy.example.com/fullchain.pem tls-key=/etc/letsencrypt/live/proxy.example.com/privkey.pem

You'll need a hostname pointing at the server and a certificate for it; a free Let's Encrypt certificate works. Make sure the user Squid runs as can read the key, open the new port in your firewall, and reload Squid whenever the certificate renews. If Squid rejects the line, your build may lack the TLS support it needs; on Debian and Ubuntu, the squid-openssl package is the usual fix.

Clients then use an https:// proxy URL:

curl -x https://USER:PASS@proxy.example.com:3130 https://api.ipify.org

curl and Chrome both support HTTPS proxies; some libraries and tools don't, so keep the plain port available on a restricted basis if you need it.

This is the same "TLS to the proxy" idea explained in HTTP vs HTTPS proxies, and it's especially worth doing if you'll connect from laptops on public Wi-Fi. The https_port directive is documented in the Squid configuration reference. For authentication options, see proxy authentication methods.

Key takeaways

• A Squid proxy on a VPS gives you one private datacenter IP with full control, at the cost of server administration.
• Always require authentication or strict IP rules, and firewall the proxy port; open proxies are abused within hours.
• forwarded_for delete, via off and header rules keep the proxy from revealing client IPs.
• Self-hosting is good for whitelisting, testing and learning, not for protected targets, because the IP is clearly a hosting address.
• Beyond one or two IPs, buying proxies is usually cheaper and simpler. See cheap datacenter proxies.

FAQ

Can I run SOCKS5 instead?

Squid is an HTTP proxy. For SOCKS5, use tools like Dante or 3proxy.

How many IPs can I have?

One per VPS, unless your provider sells additional IPs.

Will my self-hosted proxy work on protected sites?

Probably not, because it's a datacenter IP. See residential vs datacenter proxies.