Set Up a Squid Forward Proxy Server on Linux

A forward proxy fetches web content on behalf of clients. Squid is the classic open-source proxy server, used for access control, caching and giving a team a fixed outbound IP address. This guide sets up a private Squid forward proxy on a Linux VPS.

Before you start

A Linux VPS with root access.
The public IP addresses of the clients that will use the proxy.
Check your provider's acceptable use policy; you are responsible for traffic sent through your proxy.

Important: Never run an open proxy. Within hours it will be found and abused for spam and attacks, and your IP will be blocklisted.

Install Squid

Ubuntu/Debian: sudo apt install -y squid apache2-utils
AlmaLinux/Rocky: sudo dnf install -y squid httpd-tools && sudo systemctl enable squid

The config file is /etc/squid/squid.conf. Back it up first: sudo cp /etc/squid/squid.conf /etc/squid/squid.conf.bak.

Allow only your IP addresses

Add these lines near the top of the access rules, before the final http_access deny all:

acl office src 198.51.100.25/32
http_access allow office

Squid processes http_access rules in order and stops at the first match.

Add password authentication (optional)

Create a password file:

sudo htpasswd -c /etc/squid/passwd alice

Add to the config, before the deny rule (use /usr/lib64/squid/basic_ncsa_auth on AlmaLinux):

auth_param basic program /usr/lib/squid/basic_ncsa_auth /etc/squid/passwd
auth_param basic realm Proxy
acl authusers proxy_auth REQUIRED
http_access allow authusers

Basic auth credentials travel unencrypted between client and proxy, so combine it with an IP allow-list or use the proxy over a VPN or SSH tunnel.

Block domains

Create /etc/squid/blocked.txt with one domain per line, for example .example-blocked.com.

Add above your allow rules:

acl blocked dstdomain "/etc/squid/blocked.txt"
http_access deny blocked

Basic settings

http_port 3128
cache_mem 256 MB
cache_dir ufs /var/spool/squid 2000 16 256
forwarded_for delete
via off

HTTPS sites are tunnelled with CONNECT and are not cached or inspected – which is what you want for privacy.

Apply and open the port

Check the config: sudo squid -k parse.
If you added cache_dir, initialise it: sudo squid -z.
Restart: sudo systemctl restart squid.
Allow port 3128 only from your client IPs in the firewall, for example sudo ufw allow from 198.51.100.25 to any port 3128 proto tcp.

Test the proxy

curl -x http://alice:password@your-server-ip:3128 https://ifconfig.me

The response should show the proxy server's IP. You can also check it with the MdmHost IP checker in a browser configured to use the proxy.

Troubleshooting

TCP_DENIED/403 in /var/log/squid/access.log: your client IP or credentials do not match an allow rule, or a rule order problem.
Connection refused: Squid is not running or the firewall blocks 3128.
Slow browsing: check DNS resolution on the proxy server and the server's location relative to the sites you visit.

FAQ: Squid proxy server

Is a Squid proxy the same as a VPN?

No. A proxy handles traffic from applications configured to use it; a VPN routes all traffic from the device.

Can Squid be used as a reverse proxy?

Yes, Squid supports reverse proxy (accelerator) mode, though Nginx, LiteSpeed or HAProxy are more common for that today.

Does Squid cache HTTPS pages?

Not without SSL interception, which requires installing a custom CA on every client and raises privacy issues.

Next steps

Was this guide helpful?

Still stuck?

Ask MdmHost AI for a quick answer, or open a ticket and our team will take a look. We are here 24/7.

Ask MdmHost AI Open a ticket