HOW TO TURN YOUR VPS INTO PROXY USING SQUID

Let's get it stright.

Instead of using any 3rd party software, you can turn your VPS into PROXY easily without worrying about your safety.

All you need to have is :

• An Active VPS

How to do it;

Step 1: Update the System and Install Squid

First, make sure your system's repositories are up to date, then install Squid along with the Apache utilities (we need htpasswd for password encryption).

sudo apt update && sudo apt upgrade -y sudo apt install squid apache2-utils -y

Step 2: Create a Secure Password File (Hardening)

We'll use Bcrypt (via htpasswd) instead of plain text to protect the password. We'll also restrict file permissions so only the system/Squid can read it.

Create the directory and password file:

sudo mkdir -p /etc/squid/auth

Create a new user and password: Replace user_name with your desired username. You'll be prompted to enter a new password.

sudo htpasswd -B -c /etc/squid/auth/passwd user_name

Hardening note: The -B option forces the use of Bcrypt, which is much more secure and resistant to brute-force attacks than standard MD5.

Secure the file permissions: Change ownership so only the Squid user (the default proxy user) can access it.

sudo chown proxy:proxy /etc/squid/auth/passwd sudo chmod 600 /etc/squid/auth/passwd

Step 3: Configure Squid (Hardening & Authentication)

Before editing the configuration file, it's a good idea to back up the original:

sudo cp /etc/squid/squid.conf /etc/squid/squid.conf.bak

Now, open the configuration file in a text editor:

sudo nano /etc/squid/squid.conf

Clear its contents (or go to the top of the file) and enter the following configuration to enable password authentication and tighten security:

# ----------------------------------------------------
# 1. AUTHENTICATION CONFIGURATION (PASSWORD HARDENING)
# ----------------------------------------------------
auth_param basic program /usr/lib/squid/basic_ncsa_auth /etc/squid/auth/passwd
auth_param basic children 5
auth_param basic realm Your Private Proxy Server
auth_param basic credentialsttl 2 hours
auth_param basic casesensitive on

# ----------------------------------------------------
# 2. DEFINE ACL (Access Control List)
# ----------------------------------------------------
acl authenticated_users proxy_auth REQUIRED

# Restrict allowed ports (standard HTTP/HTTPS only)
acl Safe_ports port 80          # http
acl Safe_ports port 443         # https
acl SSL_ports port 443

# Block connections to ports other than the safe ones above
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports

# ----------------------------------------------------
# 3. ACCESS RULES
# ----------------------------------------------------
# Only allow users who successfully authenticate with a password
http_access allow authenticated_users

# Deny all other access (default deny)
http_access deny all

# ----------------------------------------------------
# 4. IDENTITY & PORT
# ----------------------------------------------------
# Squid's default port (can be changed to a custom port, e.g. 8080 or 3128)
http_port 3128

# Additional hardening: hide the client's real IP and Squid's version
via off
forwarded_for off
reply_header_access X-Cache-Lookup deny all
reply_header_access Via deny all
reply_header_access X-Squid-Error deny all

Save your changes with Ctrl + O, then Enter, and exit with Ctrl + X.

Step 4: Check the Configuration and Restart Squid

Before restarting, make sure there are no syntax errors in the configuration file:

sudo squid -k parse

If no errors appear, your configuration is correct.

Now, restart the Squid service to apply the changes:

sudo systemctl restart squid sudo systemctl enable squid

Step 5: Configure the Firewall (UFW)

To make sure your proxy is reachable from outside while remaining secure, open the Squid port (e.g. 3128) in your server's firewall.

sudo ufw allow 3128/tcp sudo ufw reload

That is how you turn VPS into PROXY.