Running a Proxy on your VPS
If you want to control your own internet traffic, hide your real IP, or share one connection across multiple devices,
running your own proxy on a VPS is a popular option — cheaper and easier to control than a paid third-party proxy
service.
This guide covers:
- Installing and configuring an HTTP proxy (Squid) on your VPS
- Testing it from another machine
- Setting up an encrypted SOCKS5 proxy instead (Shadowsocks)
- Fixing the most common problems
Prerequisites:
You must have a VPS running Ubuntu or Debian
You must have root or sudo access on the VPS
You must know the public IP address of your VPS
You can connect to your VPS via SSH using:
ssh [email protected]
Part 1 — Installing Squid (HTTP proxy)
Step 1 – Update the system
sudo apt update && sudo apt upgrade -y
Step 2 – Install Squid
sudo apt install squid -y
Once installed, Squid starts automatically as a service.
Step 3 – Back up the default configuration file
Always keep a copy of the original before editing it:
sudo cp /etc/squid/squid.conf /etc/squid/squid.conf.bak
Step 4 – Choose who is allowed to use the proxy
squid.conf is a long file (1000+ lines, mostly comments), so rather than scrolling through it, jump straight to the part
you need.
Open the file and search instead of scrolling:
sudo nano /etc/squid/squid.conf
Press CTRL + W, type http_access deny all, then Enter — this line blocks every connection by default, and is what you'll
be adding your own rule in front of.
Pick one of the three options below and add it right above that http_access deny all line.
Option 1 – Allow everyone (quickest, least secure)
Good for a quick test. Not recommended to leave running long-term — see the warning below.
http_access allow all
Option 2 – Allow only your own IP (recommended if your IP is fixed)
Replace Your.Client.IP.Address with the public IP of the machine you'll connect from:
acl allowed_ips src Your.Client.IP.Address/32
http_access allow allowed_ips
Option 3 – Require a username and password (recommended if you connect from different places)
Install the password tool:
sudo apt install apache2-utils -y
Create a user (you'll be asked to set a password):
sudo htpasswd -c /etc/squid/passwords Your.Username
Then add these lines near the top of squid.conf (not necessarily next to http_access deny all, but anywhere before it):
auth_param basic program /usr/lib/squid/basic_ncsa_auth /etc/squid/passwords
auth_param basic realm proxy
acl authenticated proxy_auth REQUIRED
http_access allow authenticated
⚠️ Why this matters: Option 1 lets anyone who finds your IP and port use your proxy for free — including for spam or
attacks, which get traced back to your VPS. Only use it briefly for testing, then switch to Option 2 or 3.
Once you've added your chosen option, save and exit: CTRL + X, then Y, then Enter.
Tip – editing without opening nano at all: if you'd rather skip the editor, this one-liner inserts Option 1's rule
automatically:
sudo sed -i '/^http_access deny all/i http_access allow all' /etc/squid/squid.conf
Verify it landed in the right place:
sudo grep -n "http_access allow all\|http_access deny all" /etc/squid/squid.conf
Step 5 – Restart Squid and enable it on boot
sudo systemctl restart squid
sudo systemctl enable squid
enable makes sure Squid starts automatically after every VPS reboot. Confirm it's running:
sudo systemctl status squid
You should see active (running).
Step 6 – Open the port on the VPS's firewall
If your VPS uses UFW:
sudo ufw allow 3128/tcp
sudo ufw reload
If UFW is inactive, this step doesn't apply to you — see the Troubleshooting section if you still can't connect.
Part 2 — Testing the proxy from another machine
From the client machine (not the VPS) — this can be your laptop, another VPS, or your phone.
If the client has a terminal (Linux, Mac, WSL)
curl -x http://Your.VPS.IP.Address:3128 https://ifconfig.me
If it's working, the IP address returned will be your VPS's IP, not the client's.
If you set up Option 3 (username/password):
curl -x http://Your.Username:[email protected]:3128 https://ifconfig.me
If you'd rather use a browser (works on any device, including phones)
Windows: Settings → Network & Internet → Proxy → Manual proxy setup → enter your VPS IP as the address and 3128 as the
port.
Mac: System Settings → Network → Wi-Fi/Ethernet → Details → Proxies → tick "Web Proxy (HTTP)" and "Secure Web Proxy
(HTTPS)" → enter the IP and port.
iOS/Android: Wi-Fi settings → edit the network → set proxy to Manual → enter the IP and port.
Then visit https://ifconfig.me in the browser. If you set up Option 3, the browser will prompt for the username and
password automatically.
Part 3 — Using an encrypted SOCKS5 proxy instead (Shadowsocks)
Squid is a plain HTTP/HTTPS proxy. If you need something that also encrypts the connection itself — for example to
bypass network restrictions — use Shadowsocks instead.
Step 1 – Install Shadowsocks-libev
sudo apt install shadowsocks-libev -y
Step 2 – Configure it
sudo nano /etc/shadowsocks-libev/config.json
Example content:
{
"server":"0.0.0.0",
"server_port":8388,
"password":"Your.Strong.Password",
"timeout":300,
"method":"chacha20-ietf-poly1305"
}
Step 3 – Start the service
sudo systemctl restart shadowsocks-libev
sudo systemctl enable shadowsocks-libev
Step 4 – Open the port on the firewall
sudo ufw allow 8388
sudo ufw reload
Use the server address, port, password, and method above in any Shadowsocks client on your computer or phone.
Troubleshooting
Problem: the connection just hangs (no response at all)
This means something between the client and Squid is silently dropping the traffic — usually a firewall. Work through
these in order:
1. Check you're using the right IP. This is the single most common cause. On the VPS, run:
ip addr show
Look for the inet line under your main interface (usually eth0) — that's the real public IP. It must match exactly what
you're using on the client. If it doesn't, that alone explains the hang, no firewall involved.
2. Check UFW on the VPS:
sudo ufw status
If it's inactive, it's not the cause — move to step 3. If it's active, make sure port 3128 is allowed (see Step 6
above).
3. Check raw iptables/nftables on the VPS:
sudo iptables -L -n -v
sudo nft list ruleset
If all chains show policy ACCEPT with no rules listed, the OS itself isn't blocking anything.
4. Check the VPS provider's network firewall. Many providers run a separate firewall in their control panel (Firewall /
Security Group / Network Rules), outside the operating system entirely. If steps 1–3 all check out clean, this is almost
always the cause. Log in to your provider's dashboard, find that section, and add an inbound rule: TCP, port 3128,
Allow. If your provider's panel has no such section, the restriction may be applied at their network level and you'll
need to ask their support team to open it.
5. Confirm the port is reachable with a raw connection test:
nc -vz Your.VPS.IP.Address 3128
- Hangs → firewall is still blocking it somewhere.
- "Connection refused" → Squid isn't running or isn't listening — check sudo systemctl status squid and sudo ss -tulnp
| grep 3128.
- "succeeded" → the port is open; any remaining issue is inside Squid's access rules, not the network.
Problem: curl connects but returns 403 Forbidden / CONNECT tunnel failed
This means the network path is fine — Squid is reachable, but it's rejecting the request because no access rule allows
it. Go back to Step 4 and confirm one of the three options was actually added and saved:
sudo grep -n "http_access" /etc/squid/squid.conf | grep -v "^\s*#"
You should see your allow rule listed just above http_access deny all. If it's missing, the edit either wasn't saved or
Squid wasn't restarted afterward — repeat Step 4 and Step 5.
To see exactly which rule is rejecting a specific request, watch the log while you test:
sudo tail -f /var/log/squid/access.log
Security notes
- Never leave the proxy open to everyone long-term. Use Option 2 (IP restriction) or Option 3 (authentication) instead
of Option 1.
- Change the default port if you want to reduce the chance of being picked up by automated scans.
- Monitor the logs at /var/log/squid/access.log to spot unusual activity.
- Keep the system updated regularly with sudo apt update && sudo apt upgrade -y to patch security issues.
