Install Squid on a supported Linux VPS, restrict its http_access policy to your own client address or authenticated users, expose only the chosen TCP listener, initialize any disk cache, and verify both allowed and denied requests. Squid is a forward HTTP proxy and cache; placing it on a public IP does not make it safe automatically. An unrestricted listener can become an open proxy that strangers use to consume your bandwidth and create abuse complaints.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
The procedure below uses Ubuntu paths and commands where Canonical documents them, then identifies the decisions that change on other distributions. It is suitable for browser traffic and HTTP(S)-based downloads, including many game-launcher updates; it is not a general-purpose tunnel for arbitrary gameplay protocols.
As an Amazon Associate I earn from qualifying purchases.
What Squid does—and why the default is not secure enough
Squid receives web requests from a client, makes the outbound HTTP or HTTPS connection, and returns the response. For HTTPS, the client normally sends a CONNECT request to Squid; Squid then relays encrypted traffic without seeing the page contents unless you deliberately deploy an interception design. It can also retain selected responses in memory or on disk for reuse.
A fresh installation is not a finished security policy. The daemon listens on a TCP port, and a permissive or incorrectly ordered http_access rule can allow any Internet address to use your VPS. The Squid QUICKSTART documentation states, “This is important because it prevents people from stealing your network resources.” Treat that warning as the central design requirement: define who may use the proxy, what destination ports are acceptable, and what happens to every request that does not match.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
Neither a nonstandard port nor a cache makes a proxy private. Privacy comes from access controls, firewall rules, authentication where appropriate, and ongoing log review.
Plan the VPS before installing Squid
Choose a supported image and administrator access
Deploy a currently supported Ubuntu or other Linux image. Apply all security updates before exposing a service, create a named administrator account with sudo, and keep direct root login and password-based SSH disabled when your operating system hardening policy permits. Squid’s upstream quick-start guidance specifically says, “Do not use root, for security reasons.” The package should run under its restricted service account, not as root.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Restrict SSH separately from the proxy. SSH is an administration plane; the proxy listener is an application plane. A rule that opens TCP 3128 (or your selected replacement) must not be treated as permission to administer the VPS. If clients need a stable endpoint, assign a static public address or a DNS name whose address changes are controlled.
Record the network details
- The VPS public address or DNS name clients will use.
- The fixed client address or source range you intend to permit, such as one office public address or a private VPN range.
- The TCP listener port. Squid’s Ubuntu documentation uses 3128 by default.
- The VPS provider’s network-firewall rules, in addition to the Linux host firewall.
If client addresses change frequently, a source-IP ACL will eventually deny legitimate users. In that case, plan an authenticated policy or a controlled VPN path rather than widening the ACL to the whole Internet.
Install the package
Ubuntu
Canonical’s Ubuntu installation instructions use the package named squid:
sudo apt update
sudo apt install squidThe package creates the service, configuration directory, and log locations appropriate to the Ubuntu release. Confirm the installed unit and package version with your distribution’s package tools before making operational assumptions.
Other distributions
Package names are commonly also squid, but the package manager, service unit, default configuration path, service account, and log directory can differ. On a distribution that uses DNF, for example, the installation form is typically:
sudo dnf install squidVerify that command and the resulting unit with that distribution’s documentation. Do not copy Ubuntu’s service paths or firewall syntax blindly. The configuration concepts in this article—http_port, ACLs, http_access, port restrictions, and cache initialization—remain the same, while file locations and service controls may change.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
Back up and inspect squid.conf
On Ubuntu, Squid’s main configuration file is /etc/squid/squid.conf. Make a protected backup before editing:
sudo cp -p /etc/squid/squid.conf /etc/squid/squid.conf.$(date +%Y%m%d-%H%M%S).bak
sudo less /etc/squid/squid.confKeep the backup outside any automated cleanup process and record which version is active. The packaged file often contains explanatory comments and baseline ACLs such as Safe_ports and SSL_ports. Read those sections before adding rules; deleting a protective rule because it looks redundant can broaden access unexpectedly.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteSquid evaluates http_access directives in order. The first rule that determines a request wins, so a broad allow placed above a restrictive rule defeats the restriction. Conversely, a default deny placed too early can make later allow rules unreachable.
Choose and bind the listener
Keep the documented default
Ubuntu documents TCP port 3128 as Squid’s default listener. Keeping it avoids unnecessary client reconfiguration:
http_port 3128Use a custom port when it fits your network
To use another TCP port, add or change the listener line, for example:
http_port 8888A custom number is an organizational choice, not an access-control mechanism. Scanners can discover it, and an Internet-wide listener remains Internet-wide regardless of the number. Open the same port in both the Linux firewall and the VPS provider’s firewall, and remove any obsolete listener so that an unintended port is not still active.
Bind to the intended address
Where the installed Squid version and platform support it, bind the listener to the interface or address that should receive proxy traffic instead of every interface. A public-facing VPS may have loopback, private, and public addresses; binding deliberately reduces accidental exposure. Confirm the result with a socket-listening tool supplied by your distribution, and check that the address is reachable from an authorized client before troubleshooting ACLs.
Build a restrictive access policy
Source-IP ACL: simplest when clients have stable addresses
Define an ACL containing only the address or range that should use the proxy. A single IPv4 client can be represented as a /32:
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
acl trusted_client src 203.0.113.44/32Replace the example with your real address or private range. Do not use a broad network merely because it is convenient; every address in the range becomes a potential proxy client. If your users come through a corporate gateway or VPN, permit that gateway’s egress range, not each hidden workstation address.
Preserve destination-port protections
Retain the packaged Safe_ports and SSL_ports definitions, or create equivalent narrowly defined ACLs if your distribution presents them differently. A typical policy sequence is:
Free tools Windows power users keep installed
One-click scans. No signup required.
acl trusted_client src 203.0.113.44/32
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow trusted_client
http_access deny allThe first deny blocks requests whose destination port is outside the safe list. The second limits HTTPS tunnelling with CONNECT to ports represented by SSL_ports. The trusted source is then allowed, and the final deny closes every unmatched case. Integrate this sequence with the distribution’s existing localhost or cache-manager rules rather than blindly deleting them. If an existing rule allows a much wider source above trusted_client, remove or narrow that rule.
Username/password authentication: useful when source addresses change
Authentication can replace or supplement a source ACL when users roam or share a changing public address. Squid’s model is an authentication helper plus an ACL such as:
acl authenticated proxy_auth REQUIRED
http_access allow authenticated
http_access deny allThis fragment is a policy example, not a complete credential system: the corresponding auth_param helper and its password database must be configured using the helper supplied by your distribution. Put the authenticated allow rule after the safe-port and SSL-port denials, and keep the final deny. Use unique credentials, rotate them, and remove accounts that no longer need access. Never publish a helper configuration that stores passwords in a world-readable file.
Do not create an open proxy
- Do not use
http_access allow allon a public interface. - Do not omit the final
http_access deny allunless an equivalent terminal deny is already present and reachable. - Do not assume that a secret port number protects the service.
- Do not permit destination ports simply because a client application reports an error; investigate the exact protocol and add only a justified port.
- Review access logs after every policy change for unexpected source addresses.
Decide whether caching belongs on this VPS
Caching consumes resources and only helps when the workload repeatedly requests cacheable content. Game updates, software repositories, and large downloads may be delivered with headers that prevent reuse, use unique URLs, or are encrypted; a cache can therefore consume disk without producing a useful hit rate. Squid also uses memory for active objects and metadata. Size storage and memory for the VPS and workload rather than promising a universal speed increase.
Memory-oriented operation
With no disk cache configured, Squid can still proxy traffic and use memory for in-process objects according to its configuration. This reduces disk-management work but does not guarantee that frequently requested content will remain available, especially on a small VPS.
Disk cache
Ubuntu documents this directive form:
cache_dir <Type> <Directory-Name> <Size-in-MB> <L1-Dirs> <L2-Dirs>Its guide gives the following 10,000 MB example with 16 first-level directories and 256 second-level directories:
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
cache_dir ufs /var/spool/squid 10000 16 256That is an example of syntax and layout, not a recommendation that every VPS should allocate 10 GB. Confirm that the filesystem has sufficient free space, account for other services and log growth, and choose a size your backup and replacement procedures can tolerate. A disk cache can increase write activity and recovery time; a memory-only configuration may be preferable for a low-volume relay.
Compare the main implementation choices
| Decision | Option | When it fits | Important trade-off |
|---|---|---|---|
| Client control | Source-IP ACL | Clients emerge from stable, known addresses | Breaks when addresses change; widening the range increases exposure |
| Client control | Username/password authentication | Users move between networks or share changing addresses | Requires an authentication helper, credential lifecycle, and secure secret handling |
| Storage | Memory-oriented operation | Relay use with limited disk or little expected reuse | Less persistent cache space and no guaranteed cache benefit |
| Storage | Disk cache | Workloads repeatedly request cacheable objects and the VPS has suitable storage | Consumes disk and adds initialization, ownership, and maintenance work |
| Listener | TCP 3128 | Clients can use Squid’s documented Ubuntu default | Still must be restricted by ACLs and firewalls |
| Listener | Custom TCP port such as 8888 | Network policy or existing service layout requires another port | Every client and both firewall layers must use the new number; it is not security by itself |
Validate, initialize, and start Squid
Parse the configuration before restarting
Use the validation command provided by the installed package. On installations that provide Squid’s standard command-line parser, run:
sudo squid -k parseFix every syntax error before restarting. A parser success means the file can be read; it does not prove that your ACL expresses the intended security policy. Manually inspect rule order and the effective listener as well.
Initialize a disk cache when one is configured
If cache_dir is enabled and its directory structure does not yet exist, the Squid manpage documents:
sudo squid -zRun this after creating or changing a disk-cache layout as required by your package. Confirm that the cache directory is owned and writable by the package’s restricted Squid account, not by an arbitrary user. Do not run the daemon as root merely to bypass an ownership error; correct the directory permissions.
Recommended Free Tools
Restart and inspect service state
Use the service unit installed by your distribution. On Ubuntu this is normally:
sudo systemctl restart squid
sudo systemctl status squid --no-pagerIf your distribution uses a different unit name or service manager, substitute its documented control. A successful restart should leave one Squid process tree running under the package service account and listening on the selected address and port. If it exits immediately, read the service journal and Squid’s error log before changing additional settings.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Open only the required firewalls
Host firewall
Allow the proxy port only from the trusted source when your host firewall supports source-specific rules. For a single IPv4 client and port 3128, a UFW example is:
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
sudo ufw allow from 203.0.113.44 to any port 3128 proto tcpUse your actual source and listener. If you intentionally allow a private VPN range, specify that range. Do not expose the port to all sources unless an independent network control makes that exposure deliberate and temporary.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Provider firewall
Repeat the same restriction in the VPS provider’s network firewall or security-group interface. Both layers must allow the authorized client, and neither should permit arbitrary Internet sources. Keep SSH rules separate and limited to your administration addresses. After changing either firewall, test from an authorized network and from a deliberately unauthorized one.
Test from an authorized and unauthorized client
Configure the client
Set the proxy host to the VPS public address or DNS name and the port to the exact http_port value. For a command-line test, use:
curl -v -x http://PROXY_HOST:3128 http://example.com/
curl -v -x http://PROXY_HOST:3128 https://example.com/Replace PROXY_HOST and the port with your values. The first command exercises ordinary HTTP proxying. The second exercises the HTTPS CONNECT path; the destination’s certificate should still be validated by the client.
Verify the request in Squid’s logs
Watch the access log while making the request. Ubuntu packages commonly place it under /var/log/squid/access.log, but confirm the active access_log directive on your distribution. The entry should show the authorized source, destination, HTTP method, and a successful status or a clear upstream error. Review cache.log for startup, DNS, permission, and cache-directory problems.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Prove the denial works
Repeat the HTTP and HTTPS tests from a network that is not in the trusted source ACL, or use credentials that should not authenticate. A correctly restrictive policy should reject the request and record the denied source in the access log. If the unauthorized request succeeds, stop exposure at the provider firewall, correct the ACL order, and retest before using the proxy again.
Troubleshoot in the order that saves time
- Listener binding: Confirm Squid is running and listening on the selected address and TCP port. A bind to loopback, the wrong private address, or an old port explains connection refusals before ACLs are evaluated.
- VPS and provider firewalls: Check both rule sets. A cloud firewall can drop traffic even when the Linux service is healthy, while a host firewall can reject traffic that reached the VPS.
- ACL order: Read every
http_accessline from top to bottom. Look for an earlier deny that catches the request or an earlier broad allow that bypasses your trusted ACL. - DNS resolution: Check that the VPS can resolve the requested hostname and that the client can resolve the proxy hostname. Distinguish a DNS failure from an access denial in the logs.
- Service and cache logs: Inspect the system journal and Squid’s
cache.logfor syntax errors, permission failures, authentication-helper errors, and cache-directory problems. - Retest both directions: After each change, test one authorized request and one unauthorized request. A fix that restores your own access but opens the service to everyone is not a fix.
Operate the proxy safely after it works
Monitor access and resource use
Review access logs for unfamiliar source addresses, repeated denied requests, unusual destinations, and unexpected request volume. Watch disk usage if a disk cache is enabled, and include cache directories and logs in your rotation and backup plan. A full filesystem can stop more than Squid, including SSH and monitoring services.
Keep the package and policy current
Apply operating-system and Squid security updates through your distribution’s supported mechanism. Recheck the configuration after package upgrades because a vendor-supplied default may add or change ACL examples. Preserve your known-good backup, but merge security changes rather than replacing a new packaged configuration wholesale.
Separate proxy access from administration
Use a dedicated administrator account with sudo, restrict SSH independently, and avoid editing configuration as an unprivileged user who cannot verify ownership and permissions. Squid should continue running under its restricted service account. Credentials for authenticated users should not be reused for VPS administration.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →When a single VPS is the wrong deployment
A single VPS is appropriate when you control a small, known client population, can maintain the operating system, and need a fixed endpoint. It gives you direct control over ACLs, listener binding, logs, and cache sizing, but you own patching, firewall configuration, monitoring, storage failures, and abuse response.
A managed proxy service can move some operational work elsewhere, but its authentication model, logging, locations, retention, and acceptable-use rules must be evaluated on their own terms. The Squid configuration mechanisms described here do not establish a performance or cost advantage for either model. There is no universal throughput, latency, or cache-hit-rate figure: results depend on the workload, upstream networks, VPS resources, and whether responses are cacheable.
Quick Recap
Configuration checklist
- Supported Linux image installed and security updates applied.
- Named administrator with
sudo; SSH restricted separately. - Static public address or controlled DNS name if clients require a stable endpoint.
- Squid package installed for the chosen distribution.
- Protected backup of
/etc/squid/squid.confor the distribution’s equivalent. - One deliberate listener, bound to the intended address where supported.
- Source-IP or authenticated ACL defined narrowly.
Safe_ports,SSL_ports, and a terminal deny retained.- Disk cache sized for the actual VPS only if the workload benefits from it.
squid -zrun when a new disk-cache structure requires initialization.- Host and provider firewalls restricted to the selected TCP port and trusted sources.
- Authorized HTTP and HTTPS tests succeed; unauthorized tests are denied.
- Access, cache, and service logs reviewed after testing and during operation.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
