# HOW TO TURN YOUR VPS INTO PROXY USING SQUID

- Author: TechyBros (https://wurk.fun/user/TechyBros)
- Published: 2026-08-18
- Canonical (HTML): https://wurk.fun/blog/how-to-turn-your-vps-into-proxy-using-squid-hardening
- Cover image: https://ik.imagekit.io/wurk/Squid_Proxy_1A4AB2CcB.png

---

![proxy](https://ik.imagekit.io/wurk/proxy_43Di2tLH7.webp)


Let's get it stright. 

Instead of using any 3rd party software, you can turn your VPS into PROXY easily without worrying about your safety.

All you need to have is :

- An Active VPS

**How to do it;**

Step 1: Update the System and Install Squid

First, make sure your system's repositories are up to date, then install Squid along with the Apache utilities (we need htpasswd for password encryption).



`sudo apt update && sudo apt upgrade -y`
`sudo apt install squid apache2-utils -y`


Step 2: Create a Secure Password File (Hardening)

We'll use Bcrypt (via htpasswd) instead of plain text to protect the password. We'll also restrict file permissions so only the system/Squid can read it.

Create the directory and password file:

`sudo mkdir -p /etc/squid/auth`

Create a new user and password:
Replace *user_name* with your desired username. You'll be prompted to enter a new password.


`sudo htpasswd -B -c /etc/squid/auth/passwd user_name`

Hardening note: 
The -B option forces the use of Bcrypt, which is much more secure and resistant to brute-force attacks than standard MD5.

Secure the file permissions:
Change ownership so only the Squid user (the default proxy user) can access it.


`sudo chown proxy:proxy /etc/squid/auth/passwd`
`sudo chmod 600 /etc/squid/auth/passwd`

Step 3: Configure Squid (Hardening & Authentication)

Before editing the configuration file, it's a good idea to back up the original:

`sudo cp /etc/squid/squid.conf /etc/squid/squid.conf.bak`

Now, open the configuration file in a text editor:

`sudo nano /etc/squid/squid.conf`

Clear its contents (or go to the top of the file) and enter the following configuration to enable password authentication and tighten security:

```
# ----------------------------------------------------
# 1. AUTHENTICATION CONFIGURATION (PASSWORD HARDENING)
# ----------------------------------------------------
auth_param basic program /usr/lib/squid/basic_ncsa_auth /etc/squid/auth/passwd
auth_param basic children 5
auth_param basic realm Your Private Proxy Server
auth_param basic credentialsttl 2 hours
auth_param basic casesensitive on

# ----------------------------------------------------
# 2. DEFINE ACL (Access Control List)
# ----------------------------------------------------
acl authenticated_users proxy_auth REQUIRED

# Restrict allowed ports (standard HTTP/HTTPS only)
acl Safe_ports port 80          # http
acl Safe_ports port 443         # https
acl SSL_ports port 443

# Block connections to ports other than the safe ones above
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports

# ----------------------------------------------------
# 3. ACCESS RULES
# ----------------------------------------------------
# Only allow users who successfully authenticate with a password
http_access allow authenticated_users

# Deny all other access (default deny)
http_access deny all

# ----------------------------------------------------
# 4. IDENTITY & PORT
# ----------------------------------------------------
# Squid's default port (can be changed to a custom port, e.g. 8080 or 3128)
http_port 3128

# Additional hardening: hide the client's real IP and Squid's version
via off
forwarded_for off
reply_header_access X-Cache-Lookup deny all
reply_header_access Via deny all
reply_header_access X-Squid-Error deny all
```

Save your changes with Ctrl + O, then Enter, and exit with Ctrl + X.

Step 4: Check the Configuration and Restart Squid

Before restarting, make sure there are no syntax errors in the configuration file:

`sudo squid -k parse`

If no errors appear, your configuration is correct.

Now, restart the Squid service to apply the changes:

`sudo systemctl restart squid`
`sudo systemctl enable squid`

Step 5: Configure the Firewall (UFW)

To make sure your proxy is reachable from outside while remaining secure, open the Squid port (e.g. 3128) in your server's firewall.

`sudo ufw allow 3128/tcp`
`sudo ufw reload`

That is how you turn VPS into PROXY.