To establish a secure web proxy on an Ubuntu VPS, install the Squid package, configure squid.conf with strict access control lists (ACLs) that restrict traffic to your specific IP rather than allowing all local networks, and restart the service. This setup enables anonymous browsing while maintaining server security against unauthorized usage.
Prerequisites and Installation
Before configuring the proxy server, ensure you have root or sudo privileges on your Ubuntu Virtual Private Server (VPS). The most reliable open-source solution for this task is Squid, which handles HTTP, HTTPS, and FTP requests efficiently. Begin by updating your package repository to ensure you are installing the latest stable version of the software.
sudo apt update
sudo apt install squid -yOnce installed, it is critical to understand that the default configuration file is located at /etc/squid/squid.conf. Before making any changes, create a backup of this file. This allows you to revert to the original state if a syntax error prevents the service from starting.
sudo cp /etc/squid/squid.conf /etc/squid/squid.conf.bakConfiguring Access Control Lists (ACLs)
The previous iteration of this guide contained a critical security flaw: the ACL configuration allowed all local network traffic. In a production VPS environment, this exposes your bandwidth to abuse and potential malicious activity. You must define exactly who can use your proxy. Typically, this means restricting access to your own public IP address or a specific range of trusted IPs.
Open the configuration file using a text editor such as nano or vim.
sudo nano /etc/squid/squid.confLocate the section labeled # INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS. You will need to modify two key areas: the ACL definition and the http_access rule.
First, define an ACL named after your connection, for example, mynetwork. Replace YOUR_PUBLIC_IP with the actual IP address assigned to your client machine. If you want to allow multiple devices, you can add multiple lines or use a CIDR notation if they share a subnet.
acl mynetwork src YOUR_PUBLIC_IP/32Next, find the http_access directives. The order matters in Squid; the first matching rule wins. Ensure that your new ACL is permitted before the general deny rules. It should look like this:
http_access allow mynetwork
http_access deny allDo not use allow all or reference localnet unless you fully understand the implications of exposing the proxy to your entire local network segment. For a personal VPS proxy, restricting to your static IP is the safest practice.
Correcting the http_port Directive
Squid requires precise syntax for the http_port directive to bind correctly to the network interface. A common error involves omitting the interface binding or using incorrect parameters that prevent external connections.
In the squid.conf file, locate the line starting with http_port. The default is often http_port 3128. To make the proxy accessible from outside localhost, you should explicitly bind it to all interfaces or your specific IP.
http_port 0.0.0.0:3128Using 0.0.0.0 tells Squid to listen on all available network interfaces. If you prefer tighter security, replace 0.0.0.0 with your VPS's public IP address. Ensure that port 3128 is open in your UFW firewall or cloud provider's security group settings. Without this step, even a correct configuration will fail to accept connections.
sudo ufw allow 3128/tcpHandling SSL Bumping Correctly
Previous drafts mentioned SSL bumping without providing setup steps, leading to confusion. SSL bumping allows Squid to inspect and modify HTTPS traffic, which is useful for logging but complex to configure. For basic anonymity and speed, it is recommended to leave SSL bumping disabled unless you specifically require deep packet inspection. If you do enable it, you must generate certificates and configure ssl_bump directives, which is beyond the scope of a standard privacy proxy. Disabling it avoids certificate errors in modern browsers and simplifies maintenance.
Testing and Maintenance
After saving your changes, test the configuration syntax before restarting the service. This command checks for errors without applying the changes.
sudo squid -k parseIf the output indicates no errors, restart the Squid daemon.
sudo systemctl restart squidVerify the status to ensure it is running.
sudo systemctl status squidYou can now configure your browser or operating system to use the proxy at YOUR_VPS_IP:3128. Use a site like whatismyipaddress.com to verify that your traffic is routing through the VPS.
For related infrastructure management, see Protecting Ubuntu VPS from DDoS Attacks Using UDP Packets to safeguard your new proxy from abuse, and IP Rule Not Respected on Linux VPS if you encounter routing issues.
Frequently Asked Questions
Why is my proxy connection refused?
This usually happens because the firewall is blocking port 3128 or Squid is not listening on the correct interface. Verify that http_port 0.0.0.0:3128 is set in the config and that UFW allows TCP traffic on that port.
Can I use this proxy for streaming services?
While technically possible, many streaming platforms detect and block known data center IP addresses associated with VPS providers. Additionally, unencrypted HTTP traffic will work, but HTTPS sites may require proper DNS resolution which can sometimes be filtered by the proxy depending on your configuration.
How do I update the allowed IP address?
Edit /etc/squid/squid.conf, find the acl mynetwork src line, and replace the IP address with your new public IP. Then run sudo systemctl reload squid to apply the changes without dropping existing connections.
Is it safe to leave the proxy open to the world?
No. Allowing unrestricted access turns your VPS into an open relay, which can be used for spamming, hacking, or illegal activities. Always restrict the ACL to your specific IP address to prevent unauthorized usage and potential legal liability.
What is the difference between HTTP and SOCKS proxies?
Squid is primarily an HTTP/HTTPS proxy, meaning it only handles web traffic. A SOCKS proxy operates at a lower level and can route any type of traffic, including gaming or P2P applications. For general web surfing, Squid is sufficient and easier to manage securely.