How to Configure a VPS as a Forward Proxy with Squid

Kunnskapsbase

A forward proxy routes outbound requests through your VPS, useful for accessing geo-restricted content, testing applications from a specific IP/region, or centralizing outbound traffic through a controlled point.

What a Forward Proxy Does (vs Reverse Proxy)

A reverse proxy (like Nginx in front of a web app) sits in front of servers, handling incoming requests on their behalf. A forward proxy sits in front of clients, handling their outbound requests to the wider internet on their behalf — different direction, different use case.

Prerequisites

Ubuntu 22.04/24.04 or Debian 11/12 VPS
Root or sudo access

Step 1 — Install Squid

sudo apt update
sudo apt install squid -y

Step 2 — Back Up the Default Configuration

sudo cp /etc/squid/squid.conf /etc/squid/squid.conf.orig

Step 3 — Configure Basic Access Control

sudo nano /etc/squid/squid.conf

acl allowed_ips src YOUR_HOME_IP/32
http_access allow allowed_ips
http_access deny all

http_port 3128

Restricting access by source IP is essential — an open, unauthenticated proxy will quickly be discovered and abused by others for unrelated traffic.

Step 4 — Restart Squid

sudo systemctl restart squid

Step 5 — Allow the Proxy Port Through the Firewall

sudo ufw allow from YOUR_HOME_IP to any port 3128

Step 6 — Configure a Client to Use the Proxy

In your browser or system network settings, set the proxy server to YOUR_SERVER_IP:3128.

Adding Authentication (For Access from Varying IPs)

sudo apt install apache2-utils -y
sudo htpasswd -c /etc/squid/passwords proxyuser

auth_param basic program /usr/lib/squid/basic_ncsa_auth /etc/squid/passwords
auth_param basic realm proxy
acl authenticated proxy_auth REQUIRED
http_access allow authenticated
http_access deny all

sudo systemctl restart squid

Restricting Access to Specific Destination Sites (Optional)

acl allowed_sites dstdomain .example.com
http_access allow allowed_ips allowed_sites
http_access deny all

Logging

sudo tail -f /var/log/squid/access.log

Common Errors

"Access Denied" from the proxy — verify your current IP matches the acl allowed_ips rule; note that dynamic home IPs change periodically, requiring config updates.

Proxy is slow — check your VPS's own network performance and consider whether Squid's caching features (disabled by default in a pure forwarding setup) could help for repeated requests to the same resources.

Best Practices

Never run an open proxy without IP restriction or authentication — it will be discovered and abused
Use authentication if accessing from varying/dynamic IP addresses
Monitor access logs periodically for unexpected usage patterns

Continue Reading

Browse more articles in Advanced Networking & VPN.

Kunnskapsbase

Kategorier

Kategorier