Home VPS Running a Proxy on your VPS

Running a Proxy on your VPS

Last updated on Aug 26, 2026

If you want to control your own internet traffic, hide your real IP, or share one connection across multiple devices, running your own proxy on a VPS is a popular option — cheaper and easier to control than a paid third-party proxy service.

This guide covers:

  • Installing and configuring an HTTP proxy (Squid) on your VPS

  • Testing it from another machine

  • Setting up an encrypted SOCKS5 proxy instead (Shadowsocks)

  • Fixing the most common problems

Prerequisites:

You must have a VPS running Ubuntu or Debian

You must have root or sudo access on the VPS

You must know the public IP address of your VPS

You can connect to your VPS via SSH using:

ssh [email protected]

Part 1 — Installing Squid (HTTP proxy)

Step 1 – Update the system

sudo apt update && sudo apt upgrade -y

Step 2 – Install Squid

sudo apt install squid -y

Once installed, Squid starts automatically as a service.

Step 3 – Back up the default configuration file

Always keep a copy of the original before editing it:

sudo cp /etc/squid/squid.conf /etc/squid/squid.conf.bak

Step 4 – Choose who is allowed to use the proxy

squid.conf is a long file (1000+ lines, mostly comments), so rather than scrolling through it, jump straight to the part you need.

Open the file and search instead of scrolling:

sudo nano /etc/squid/squid.conf

Press CTRL + W, type http_access deny all, then Enter — this line blocks every connection by default, and is what you'll be adding your own rule in front of.

Pick one of the three options below and add it right above that http_access deny all line.

Option 1 – Allow everyone (quickest, least secure)

Good for a quick test. Not recommended to leave running long-term — see the warning below.

http_access allow all

Option 2 – Allow only your own IP (recommended if your IP is fixed)

Replace Your.Client.IP.Address with the public IP of the machine you'll connect from:

acl allowed_ips src Your.Client.IP.Address/32
http_access allow allowed_ips

Option 3 – Require a username and password (recommended if you connect from different places)

Install the password tool:

sudo apt install apache2-utils -y

Create a user (you'll be asked to set a password):

sudo htpasswd -c /etc/squid/passwords Your.Username

Then add these lines near the top of squid.conf (not necessarily next to http_access deny all, but anywhere before it):

auth_param basic program /usr/lib/squid/basic_ncsa_auth /etc/squid/passwords
auth_param basic realm proxy
acl authenticated proxy_auth REQUIRED
http_access allow authenticated

⚠️ Why this matters: Option 1 lets anyone who finds your IP and port use your proxy for free — including for spam or attacks, which get traced back to your VPS. Only use it briefly for testing, then switch to Option 2 or 3.

Once you've added your chosen option, save and exit: CTRL + X, then Y, then Enter.

Tip – editing without opening nano at all: if you'd rather skip the editor, this one-liner inserts Option 1's rule automatically:

sudo sed -i '/^http_access deny all/i http_access allow all' /etc/squid/squid.conf

Verify it landed in the right place:

sudo grep -n "http_access allow all\|http_access deny all" /etc/squid/squid.conf

Step 5 – Restart Squid and enable it on boot

sudo systemctl restart squid
sudo systemctl enable squid

enable makes sure Squid starts automatically after every VPS reboot. Confirm it's running:

sudo systemctl status squid

You should see active (running).

Step 6 – Open the port on the VPS's firewall

If your VPS uses UFW:

sudo ufw allow 3128/tcp
sudo ufw reload

If UFW is inactive, this step doesn't apply to you — see the Troubleshooting section if you still can't connect.

Part 2 — Testing the proxy from another machine

From the client machine (not the VPS) — this can be your laptop, another VPS, or your phone.

If the client has a terminal (Linux, Mac, WSL)

curl -x http://Your.VPS.IP.Address:3128 https://ifconfig.me

If it's working, the IP address returned will be your VPS's IP, not the client's.

If you set up Option 3 (username/password):

curl -x http://Your.Username:[email protected]:3128 https://ifconfig.me

If you'd rather use a browser (works on any device, including phones)

Windows: Settings → Network & Internet → Proxy → Manual proxy setup → enter your VPS IP as the address and 3128 as the port.

Mac: System Settings → Network → Wi-Fi/Ethernet → Details → Proxies → tick "Web Proxy (HTTP)" and "Secure Web Proxy (HTTPS)" → enter the IP and port.

iOS/Android: Wi-Fi settings → edit the network → set proxy to Manual → enter the IP and port.

Then visit https://ifconfig.me in the browser. If you set up Option 3, the browser will prompt for the username and password automatically.

Part 3 — Using an encrypted SOCKS5 proxy instead (Shadowsocks)

Squid is a plain HTTP/HTTPS proxy. If you need something that also encrypts the connection itself — for example to bypass network restrictions — use Shadowsocks instead.

Step 1 – Install Shadowsocks-libev

sudo apt install shadowsocks-libev -y

Step 2 – Configure it

sudo nano /etc/shadowsocks-libev/config.json

Example content:

{
    "server":"0.0.0.0",
    "server_port":8388,
    "password":"Your.Strong.Password",
    "timeout":300,
    "method":"chacha20-ietf-poly1305"
}

Step 3 – Start the service

sudo systemctl restart shadowsocks-libev
sudo systemctl enable shadowsocks-libev

Step 4 – Open the port on the firewall

sudo ufw allow 8388
sudo ufw reload

Use the server address, port, password, and method above in any Shadowsocks client on your computer or phone.

Troubleshooting

Problem: the connection just hangs (no response at all)

This means something between the client and Squid is silently dropping the traffic — usually a firewall. Work through these in order:

1. Check you're using the right IP. This is the single most common cause. On the VPS, run:

ip addr show

Look for the inet line under your main interface (usually eth0) — that's the real public IP. It must match exactly what you're using on the client. If it doesn't, that alone explains the hang, no firewall involved.

2. Check UFW on the VPS:

sudo ufw status

If it's inactive, it's not the cause — move to step 3. If it's active, make sure port 3128 is allowed (see Step 6 above).

3. Check raw iptables/nftables on the VPS:

sudo iptables -L -n -v
sudo nft list ruleset

If all chains show policy ACCEPT with no rules listed, the OS itself isn't blocking anything.

4. Check the VPS provider's network firewall. Many providers run a separate firewall in their control panel (Firewall / Security Group / Network Rules), outside the operating system entirely. If steps 1–3 all check out clean, this is almost always the cause. Log in to your provider's dashboard, find that section, and add an inbound rule: TCP, port 3128, Allow. If your provider's panel has no such section, the restriction may be applied at their network level and you'll need to ask their support team to open it.

5. Confirm the port is reachable with a raw connection test:

nc -vz Your.VPS.IP.Address 3128

  • Hangs → firewall is still blocking it somewhere.

  • "Connection refused" → Squid isn't running or isn't listening — check sudo systemctl status squid and sudo ss -tulnp | grep 3128.

  • "succeeded" → the port is open; any remaining issue is inside Squid's access rules, not the network.

Problem: curl connects but returns 403 Forbidden / CONNECT tunnel failed

This means the network path is fine — Squid is reachable, but it's rejecting the request because no access rule allows it. Go back to Step 4 and confirm one of the three options was actually added and saved:

sudo grep -n "http_access" /etc/squid/squid.conf | grep -v "^\s*#"

You should see your allow rule listed just above http_access deny all. If it's missing, the edit either wasn't saved or Squid wasn't restarted afterward — repeat Step 4 and Step 5.

To see exactly which rule is rejecting a specific request, watch the log while you test:

sudo tail -f /var/log/squid/access.log

Security notes

  • Never leave the proxy open to everyone long-term. Use Option 2 (IP restriction) or Option 3 (authentication) instead of Option 1.

  • Change the default port if you want to reduce the chance of being picked up by automated scans.

  • Monitor the logs at /var/log/squid/access.log to spot unusual activity.

  • Keep the system updated regularly with sudo apt update && sudo apt upgrade -y to patch security issues.