The safest way to run a private proxy on a Linux VPS is to install one proxy daemon, bind it to an intentional address and port, restrict clients with network ACLs or strong authentication, enforce the same policy in the VPS firewall, and test rejection from an unapproved source. Squid is usually the simplest choice for an HTTP forward proxy, 3proxy is a compact option when you need HTTP and SOCKS together, and Dante is designed around SOCKS4/SOCKS5. A proxy that is reachable from the Internet without those controls is an open proxy and can quickly be abused.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What a VPS proxy actually does
A forward proxy sits between your applications and the public Internet. The application connects to the VPS, the proxy daemon makes the outbound request, and the destination sees the VPS address rather than the client’s address. The VPS provides a stable Internet-reachable IPv4 or IPv6 address; the daemon provides HTTP or SOCKS behavior; access-control lists (ACLs) and authentication decide who may use it; and the cloud firewall plus the Linux host firewall limit which ports can be reached.
As an Amazon Associate I earn from qualifying purchases.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
This is different from a reverse proxy. A reverse proxy publishes your own web service to visitors. The procedure below is for a forward proxy that makes outbound connections on behalf of authorized clients.
- HTTP forward proxy: Clients send HTTP requests, and usually HTTPS requests through the HTTP CONNECT method, to the proxy listener.
- SOCKS proxy: Clients ask the daemon to open TCP connections (and, depending on the implementation and rules, UDP associations) to destinations.
- Authorization layer: Source-IP rules, usernames and passwords, certificates, or a combination determine who can connect.
- Enforcement layer: Cloud security-group rules, the VPS firewall, daemon ACLs, and log review prevent accidental public exposure.
A proxy does not automatically encrypt every leg of traffic. It protects the connection between a client and the proxy only when the protocol and client support encryption; HTTPS then protects the connection from the proxy to the HTTPS destination. Treat credentials and the VPS itself as security-sensitive infrastructure.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
Choose the daemon before opening a port
Install one primary daemon first. Running several listeners while you are still designing the firewall makes it easier to leave an unintended service exposed.
| Daemon | Primary protocol | Best fit | Access control and authentication | Notable capabilities |
|---|---|---|---|---|
| Squid | HTTP forward proxy | Web traffic where filtering, policy, and caching are important | Client-network ACLs; authentication can be added through the supported helpers and configuration | Canonical describes it as a filtering and caching mechanism that can optimize bandwidth and performance; Ubuntu’s example changes the listener from TCP 3128 to 8888 |
| 3proxy | HTTP and SOCKS services | A small, multi-protocol deployment with detailed ACLs | auth iponly for IP-based authorization and auth strong for username/password authentication, followed by ordered allow/deny rules |
Separate internal and external addresses, destination/port/time matching, TLS-encrypted proxy connections, and mutual TLS support |
| Dante | SOCKS4/SOCKS5 | SOCKS-centric clients, including deployments that need UDP behavior | Separate client and SOCKS rule stages; clientmethod and socksmethod can use username/PAM, none, or other documented methods |
Rule-based routing and configurable logging; its reference warns that some compatibility options have security implications |
Squid is the natural starting point if every client speaks HTTP proxy. Choose 3proxy when one compact service must offer both HTTP and SOCKS. Choose Dante when SOCKS semantics are the requirement and you want its separate client/SOCKS rule model. The projects’ official documentation does not establish a universal performance ranking, adoption figure, or cost advantage, so select on protocol and policy needs rather than an assumed benchmark.
Recommended Free Tools
Plan the deployment and close the common exposure gaps
Record the addresses and intended clients
Write down the VPS public IPv4 and IPv6 addresses, the administration source addresses, and every client network that should be allowed. A fixed office address can be restricted with an IP ACL. Roaming clients may require username/password or certificate authentication instead, because allowing an entire mobile carrier range is usually too broad.
Decide the listener deliberately
Pick a TCP port that is not already used, then bind the daemon only to the intended interface or address. The port number itself is not an access-control mechanism. A non-default port can reduce casual scanning, but it does not replace ACLs, authentication, or a firewall.
Keep the administrative path separate
Use SSH keys and a non-root administrator for routine work. Keep SSH available only from administration addresses where possible. Apply operating-system updates before exposing the proxy, and use the distribution’s guidance for firewall, AppArmor, authentication, and account-management hardening.
Step-by-step: an Ubuntu VPS running Squid
The commands below use Ubuntu’s package layout. Package names, service names, configuration defaults, and firewall syntax vary by distribution, so check the corresponding release documentation if you are not on Ubuntu.
1. Provision and update the host
- Create the VPS with a supported Ubuntu release and note its public addresses.
- Create a non-root administrator and install its SSH public key. Do not perform routine administration by logging in directly as root.
- Connect over SSH, update the package index and installed packages, and reboot if the update requires it. Apply the provider’s security-group policy before opening a proxy listener.
- Decide the allowed client addresses before you create the daemon ACL. If you cannot name an address, plan to use strong authentication and a narrowly scoped firewall rule instead of allowing the whole Internet.
2. Install Squid and preserve the original configuration
Canonical’s Ubuntu guide installs Squid from the distribution repository:
sudo apt update
sudo apt install squidBefore editing, make a protected copy of the stock file:
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
sudo cp /etc/squid/squid.conf /etc/squid/squid.conf.original
sudo chmod 600 /etc/squid/squid.conf.originalKeep the backup owned by root and outside any directory that untrusted users can write. If a later change breaks startup, this copy gives you a known reference for restoring individual settings.
3. Set an explicit listener
Ubuntu documents TCP port 3128 as Squid’s default and shows an example that changes the listener to 8888. Use an explicit value so firewall and client documentation cannot drift:
Free tools Windows power users keep installed
One-click scans. No signup required.
http_port 8888Do not assume that changing the port makes the service private. In the same configuration, bind to the intended local address when your host has multiple interfaces, and make sure the cloud firewall and host firewall allow that port only for approved sources.
4. Define client ACLs before allowing requests
Replace the example address below with the real public address or network of an authorized client. Keep specific allow rules above the final deny rule. Squid configurations contain many defaults; inspect the complete file and remove or override rules that would broaden access unexpectedly.
acl allowed_clients src 203.0.113.10/32
http_access allow allowed_clients
http_access deny allThe 203.0.113.10/32 value is documentation space, not a usable client address. For a small office subnet, use the exact subnet and prefix you control rather than a broad private or carrier range. If several clients are approved, create separate source entries or a deliberately scoped network ACL.
Place the deny-all behavior after the specific allows. Test the resulting order; an earlier broad allow can make a later restriction ineffective. Do not publish a listener while the configuration still contains an unreviewed rule that permits arbitrary sources.
5. Add authentication when source IPs are not stable
IP restrictions are strongest when client addresses are fixed. If users roam, authenticate them with a supported Squid authentication helper and protect the credential store so only the proxy service and administrators can read it. Use long, unique passwords, do not reuse an SSH password, and rotate credentials when a device or employee leaves the authorized group.
Authentication is an additional control, not a reason to allow every source at the firewall. Keep the proxy port limited to the smallest practical set of networks, and retain a final deny rule for failed or missing credentials.
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
6. Validate the configuration and start the service
Use the distribution’s Squid configuration-checking facility before restarting. If the check reports a syntax or permission error, fix that first rather than repeatedly restarting the daemon. Then start the service, enable it at boot, and inspect its status and logs. On Ubuntu systems using systemd, the service is commonly managed as follows:
sudo systemctl enable --now squid
sudo systemctl status squidConfirm that the process is listening only on the address and port you selected. The exact socket-inspection command depends on the tools installed on the image; use the system’s listening-socket utility and verify that no unexpected proxy port is open.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Alternative deployment: 3proxy
3proxy is useful when the same VPS must serve HTTP and SOCKS clients without deploying two separate daemons. Its How-To makes an important warning explicit: if no internal interface is specified, the proxy acts as an open proxy.
Bind internal and external addresses
Configure the client-facing address with internal (or the -i option) and the outbound address with external (or -e). Use the internal address that should accept client connections, not a wildcard, unless your firewall and ACL design intentionally cover every interface.
Choose the authorization model
auth iponlysuits a controlled list of client addresses. It is simple, but it depends on those addresses remaining trustworthy and stable.auth strongenables username/password authentication. Store the configuration and credential material in a root-owned path with restrictive permissions.- Write allow rules for the intended client, destination, port, and time conditions, then add an explicit deny rule. 3proxy evaluates rules in order, so a broad rule placed first can defeat a later restriction.
3proxy can also provide TLS-encrypted proxy connections and mutual TLS. When using certificates, the project documentation requires the certificate’s Subject Alternative Name to contain the proxy hostname or IP that clients validate. Plan certificate issuance, renewal, private-key permissions, and client trust before enabling that mode.
Install and supervise it without guessing the package layout
Some distributions provide a package and others require a project release or build procedure. Follow the release instructions for your exact distribution, place the configuration in a root-owned directory, and use the distribution service manager or a reviewed unit file to start it at boot. Do not copy a service unit from an unrelated distribution without checking its user, paths, capabilities, and log destinations.
Alternative deployment: Dante for SOCKS
Dante is the SOCKS-oriented choice when applications need SOCKS4/SOCKS5 behavior, including possible UDP cases. Its danted.conf reference separates server settings, client rules, SOCKS rules, and routes. Treat those as separate policy stages rather than assuming that authenticating one stage automatically secures the other.
Build the rule set in two stages
- Configure the server addresses, listening port, logging destination, and outbound route.
- Define
clientmethodfor how a connecting client is identified. - Define
client passandclient blockrules for approved source addresses and explicitly rejected sources. - Define
socksmethodfor the authentication required when a client requests a SOCKS connection. - Define SOCKS pass/block rules for destination addresses, ports, and commands. End with a deny rule that rejects anything not expressly allowed.
The reference documents username, PAM, and no-authentication methods. Use no authentication only when a separate, tightly restricted source-IP policy makes that choice intentional. The documentation also warns that some compatibility settings can have security consequences; leave those options disabled unless a specific client requirement has been evaluated and the exposure is understood.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
Keep logging useful and bounded
Choose a log destination that administrators can read but untrusted users cannot alter. Configure rotation so a busy proxy cannot fill the disk. Record enough information to investigate authentication failures and abuse while applying your organization’s privacy and retention requirements.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Firewall the VPS and the provider edge
Apply the same allow-list at two layers: the cloud provider’s security group or network firewall and the Linux host firewall. A mismatch can either lock you out or expose a service you thought was protected.
Typical Ubuntu UFW policy
The following is an example policy. Replace the administration and client addresses, and confirm the SSH rule before enabling UFW so you do not lock yourself out:
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow from 198.51.100.25 to any port 22 proto tcp
sudo ufw allow from 203.0.113.10 to any port 8888 proto tcp
sudo ufw enable
sudo ufw status verboseThe example allows SSH from one administration address and Squid’s example port from one client address. Add IPv6 rules when IPv6 is enabled and intentionally used. If the provider firewall already filters IPv6 separately, mirror the policy there as well. Do not open the proxy port to 0.0.0.0/0 or ::/0 unless you have a compelling, documented reason and robust authentication, monitoring, and abuse controls.
Test both success and failure paths
Test an approved HTTP client
From an authorized machine, configure the application to use the VPS address and port. For a command-line check against an HTTPS site, a typical HTTP-proxy request looks like:
curl --proxy http://VPS_ADDRESS:8888 https://example.com/If authentication is enabled, supply credentials through the client’s supported proxy-authentication option rather than placing reusable secrets in shell history. Confirm that the request succeeds, that the destination sees the VPS egress address, and that Squid or the selected daemon records the request.
Test an approved SOCKS client
For Dante or 3proxy’s SOCKS service, configure a SOCKS5-capable client and test both DNS behavior and the destination connection. A client option such as --socks5-hostname makes the proxy resolve the hostname; use the mode that matches your DNS-leak and routing requirements. Verify that the daemon’s log records the connection and the intended authentication result.
Prove that unauthorized use fails
- Run the same request from a source address not in the ACL. It must be rejected at the firewall or by the daemon.
- From an allowed source, retry with an invalid or missing credential. It must fail authentication.
- Probe the VPS from an external network and verify that only SSH from the administration source and the chosen proxy port from approved clients are reachable.
- Inspect logs for both rejected attempts. A successful request from an unlisted source is a deployment failure, not a testing inconvenience.
Repeat these tests after every ACL, firewall, listener, package, or certificate change. Test IPv4 and IPv6 separately if both are enabled; an IPv6 listener accidentally left unrestricted can bypass an IPv4-only firewall policy.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
Operate the proxy as a service
Monitor the signals that indicate abuse
- Bandwidth and outbound transfer volume
- Concurrent connections and file-descriptor pressure
- Authentication failures and repeated attempts from new addresses
- Unexpected destinations, port scans, or sudden traffic spikes
- Log size, rotation success, and available disk space
- Provider abuse notices and complaints linked to the VPS address
Set alerts appropriate to your normal workload. A sudden increase in traffic, authentication failures, or destination diversity can indicate stolen credentials or a rule that became broader than intended.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minutePatch and review on a schedule
Apply operating-system and proxy updates from trusted distribution or project channels. Review ACLs whenever a client, office address, certificate, or administrator changes. Remove unused listeners and old credentials. Recheck cloud security groups after infrastructure changes, because a provider-level rule can silently override the assumptions in your host firewall.
Protect and rotate secrets
Keep configuration files, password databases, private keys, and backups readable only by root and the service account that needs them. Rotate credentials after suspected disclosure, revoke certificates that are no longer trusted, and avoid storing secrets in shell history, issue trackers, or world-readable backup archives.
Troubleshooting by symptom
| Symptom | Likely cause | Checks and corrective action |
|---|---|---|
| Connection times out | Provider firewall, UFW, or the daemon is not listening on the expected address | Check the cloud rule, host-firewall status, service status, and listening socket. Confirm the client is using the correct address family and port. |
| Connection is refused | No process is bound to that port, or the daemon failed to start | Read the service status and logs, validate the configuration, and confirm that another process is not occupying the port. |
| Allowed client receives an access-denied response | ACL order, source address mismatch, or missing authentication | Check the address seen by the VPS, move the specific allow rule ahead of the final deny, and verify the client is sending the required credentials. |
| Unauthorized client succeeds | Wildcard listener, broad ACL, permissive provider rule, or an allow rule above the intended restriction | Immediately stop or firewall the listener, inspect all daemon rules and both firewall layers, add an explicit deny, rotate credentials, and retest from an external network. |
| HTTPS fails while HTTP works | Client is not using the HTTP CONNECT method correctly, proxy authentication is not supplied for CONNECT, or destination-port rules block 443 | Check the client’s proxy mode, authentication behavior, and destination-port ACL. Do not work around the problem by allowing every destination port without review. |
| SOCKS client connects but applications fail | Application does not support SOCKS, DNS is being resolved locally, or Dante rules do not permit the requested command or destination | Use a SOCKS-capable client, select remote hostname resolution where appropriate, and inspect both client and SOCKS rule stages. |
| Disk fills unexpectedly | Verbose logs are not rotating or a busy proxy is generating more traffic than expected | Check log destinations and rotation, lower unnecessary verbosity, preserve evidence needed for incident review, and investigate the traffic source. |
Security checklist before you hand over the address
- One intended daemon is installed and its configuration is root-owned.
- The listener is bound to the planned address and port; no wildcard listener was enabled accidentally.
- Specific client ACLs or strong authentication are configured, followed by an explicit deny-all rule.
- The cloud firewall and host firewall allow SSH only from administration sources and the proxy only from intended clients.
- IPv4 and IPv6 policies match, or unused address families are disabled.
- Credentials and private keys are protected, unique, and documented for rotation.
- Logs are enabled, access-controlled, rotated, and monitored for failures and abuse.
- An approved client succeeds, an unlisted client fails, invalid credentials fail, and only the expected ports are externally reachable.
- Updates, ACL reviews, abuse handling, and credential rotation have an assigned owner.
Which setup should you use?
Use Squid when your applications are HTTP-proxy clients and you need mature filtering and caching controls. Use 3proxy when minimizing daemon count matters and clients require both HTTP and SOCKS, or when its detailed ACL and TLS/mTLS features fit your policy. Use Dante when SOCKS4/SOCKS5 is the central requirement, especially where its client-rule and SOCKS-rule separation helps you express policy. In every case, the decisive design is the access policy: a correctly chosen daemon is still unsafe if its listener, firewall, and deny rules permit the public Internet.
Frequently Asked Questions
Can I make the proxy private by choosing a non-default port?
No. A different port may reduce casual scanning, but privacy comes from source restrictions, authentication, firewall rules, and a final deny policy.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Should I run Squid, 3proxy, and Dante together?
Usually not. Start with the one protocol your clients require; additional listeners increase firewall, patching, and monitoring work.
What should I do if an unauthorized client can connect?
Treat it as an exposure incident: restrict or stop the listener, inspect provider and host firewall rules plus daemon ACL order, rotate credentials, and repeat tests from an external network before restoring service.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
