Skip to contentSquid proxy setup and configuration
Squid is the classic Linux HTTP/HTTPS caching proxy, powering countless corporate gateways. Here is a clean install, an access-controlled squid.conf, authentication, and the CONNECT rule that lets HTTPS through.
What Squid is for
Squid is a mature, feature-heavy caching proxy for HTTP and HTTPS. Unlike the tiny 3proxy or a SOCKS-only Dante, Squid is built around web traffic: it can cache responses, filter by access-control lists, authenticate users, and log in detail. That makes it the default choice for a corporate outbound gateway, a caching layer for a busy network, or a controlled HTTP CONNECT proxy. It does not do SOCKS — for that you would use 3proxy or Dante (see build your own proxy).
The two things newcomers always trip over are access control (Squid denies everything by default) and HTTPS (which needs the CONNECT method allowed). The config below handles both.
A secured squid.conf
Authenticated forward proxy on port 3128 with an ACL, CONNECT allowed for HTTPS, and safe ports restricted. Adjust paths for your distro.
apt update && apt install -y squid apache2-utils # create a password file for basic auth: htpasswd -c /etc/squid/passwd USER # prompts for password cat > /etc/squid/squid.conf <<'CFG' http_port 3128 # --- authentication --- auth_param basic program /usr/lib/squid/basic_ncsa_auth /etc/squid/passwd auth_param basic realm s4m-proxy acl authenticated proxy_auth REQUIRED # --- safe ports / CONNECT for HTTPS --- acl SSL_ports port 443 acl Safe_ports port 80 443 21 1025-65535 acl CONNECT method CONNECT http_access deny !Safe_ports http_access deny CONNECT !SSL_ports # --- allow only authenticated users, deny the rest --- http_access allow authenticated http_access deny all # --- small cache --- cache_dir ufs /var/spool/squid 1000 16 256 coredump_dir /var/spool/squid CFG squid -k parse # validate config systemctl restart squid # test: curl -x http://USER:[email protected]:3128 https://api.ipify.org
ACLs, HTTPS and honest limits
Squid's power is its ACL model: you allow or deny by source IP, destination, port, time of day or authenticated user, and rules are evaluated top to bottom with the first match winning. The http_access deny all line at the end is essential — without a default-deny, a misconfigured Squid becomes an open relay. For HTTPS, remember Squid uses CONNECT to tunnel encrypted traffic it cannot read; the SSL_ports ACL restricts which ports that tunnel may reach. (Squid can also do TLS interception with a local CA, but for a plain forward proxy you do not want that.)
Running Squid yourself gives you a controlled datacenter exit and rich logging, at the cost of maintaining it. If you just need an authenticated HTTP exit without operating a server, that is exactly what the s4m HTTP proxy on proxy.s4m.online:3128 provides, with a dedicated IP option and API. If a request returns 407, check credentials — see the 407 guide.
Questions, answered
Why does Squid block all my traffic after install?
Squid denies everything by default until you add http_access allow rules. You need an ACL that matches your users or source IPs and an allow line above the final deny all. The default-deny is a safety feature that stops Squid becoming an open relay.
How does Squid handle HTTPS?
Through the CONNECT method: Squid opens a raw tunnel to the destination on port 443 and relays encrypted bytes without reading them. You must allow CONNECT to your SSL_ports ACL. Squid can also intercept TLS with a local CA, but a plain forward proxy does not need that.
Skip the maintenance
Run Squid for full control, or point your client at the authenticated s4m HTTP proxy on port 3128 for a managed datacenter exit — with a dedicated IP and API when you need them.
People found this page by searching for
- Squid proxy setup and configuration
- socks5 proxy for beginners
- datacenter vs residential vs mobile proxies
- socks5 proxy
- best free proxy list 2026
- openvpn
- proxy for scraping with crypto payment
- WireGuard vs OpenVPN
- free proxy list by country
- the HTTP CONNECT method explained
Real search phrases this page answers — the linked ones open the page that covers them in depth.