To run Squid safely on a Linux VPS, install the package, restrict its http_access policy to your own client address or authenticated users, expose only the proxy port in both firewalls, initialize any configured disk cache, and test from an authorized and an unauthorized client. Squid is a forward HTTP proxy and optional cache; installing it does not make an internet-facing server safe by itself.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
The procedure below uses Ubuntu commands where they are established. Other Linux distributions may use different package names, service units, file locations, and authentication helpers, so confirm those details against the distribution documentation before applying commands unchanged.
As an Amazon Associate I earn from qualifying purchases.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →What Squid does—and what it does not do
Squid accepts web requests from configured clients, makes the outbound request, and returns the response. It can also retain objects in memory or on disk for later requests. That makes it useful as a controlled forward proxy, but it is not a VPN, an automatic anonymity system, or a security boundary that protects an unrestricted internet listener.
An accidentally permissive configuration can turn a VPS into an open proxy. Unrelated users could consume your bandwidth, storage, CPU, and provider quota. Squid’s own quick-start guidance stresses that restricting clients prevents people from stealing your network resources. Treat the access policy and firewall as mandatory parts of deployment, not optional tuning.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Plan the VPS before installing Squid
Choose a supported Linux image
Provision a supported Ubuntu release or another maintained Linux distribution. Apply security updates before installing application software. Create an administrator account with sudo rather than using the root account for routine work. Squid’s documentation specifically advises not running the service as root; package defaults normally provide a restricted service account.
Separate SSH access from proxy access
SSH administration and proxy traffic should have separate firewall rules. Restrict SSH to your administration address or management network where practical. The proxy listener must not be used as a substitute for SSH protection. If clients require a stable endpoint, assign a static public address and record the address you will place in the client ACL.
Record the deployment values
- VPS address: the public address clients will use.
- Client source: one public address (
/32) or a narrowly defined trusted network range. - Listener port: Ubuntu’s documented default is TCP
3128; you may select another port for operational reasons. - Firewall locations: the VPS host firewall and the provider’s cloud firewall or security group, if present.
A nonstandard port can reduce accidental scans, but it is not an access-control mechanism. A listener on an unusual port is still open if the ACL and firewalls allow everyone.
Install Squid on Ubuntu
Update packages and install the package
- Connect over SSH using your administrator account.
- Refresh package metadata and apply available updates:
sudo apt update
sudo apt upgrade- Install Squid from Ubuntu’s package repositories:
sudo apt install squidUbuntu’s package creates the Squid service and its configuration under /etc/squid/. The primary configuration file is /etc/squid/squid.conf. On another distribution, confirm the package name, service unit, configuration path, log path, and service account before substituting commands.
Back up the configuration before editing
Make a protected copy so you can restore a known file if a change prevents startup:
sudo cp -a /etc/squid/squid.conf /etc/squid/squid.conf.backup.$(date +%Y%m%d-%H%M%S)Keep the backup readable only by administrators. Avoid editing while another automation process is rewriting the file, and preserve a copy of every intentional change in your normal server change log.
Free tools Windows power users keep installed
One-click scans. No signup required.
Choose and bind the listener port
Ubuntu’s guide documents TCP 3128 as the default listener. In /etc/squid/squid.conf, a line such as the following uses that default explicitly:
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
http_port 3128To use port 8888 instead, replace it with:
http_port 8888Use the same port in the client configuration and in both firewall layers. Where your Squid build supports an address-qualified listener, bind it to the intended interface or address rather than every interface. Binding alone is not a replacement for an ACL: a publicly reachable interface still needs an explicit allow policy.
Build a restrictive access policy
Source-IP ACL for a fixed client
If the client has a stable public address, a source ACL is the simplest policy. Add an ACL for the exact address, then allow only that ACL. The following pattern illustrates the order; adapt the address and retain the safety rules already present in the packaged file:
acl trusted_client src 203.0.113.25/32
# Keep Squid's Safe_ports and SSL_ports protections above this policy.
http_access allow trusted_client
http_access deny allReplace 203.0.113.25/32 with the real client address. A /32 matches one IPv4 address. If you must support a private network, specify the smallest range that contains the clients; do not use a broad internet range. If the client’s address changes, the request will stop matching until you update the ACL.
Authentication for changing client addresses
Username/password authentication can be preferable when clients move between networks or when several people need separate credentials. Squid combines an authentication ACL with http_access, but the credential helper, password database, file permissions, and authentication method depend on the distribution and your chosen backend. Configure and test that helper according to the package documentation, then permit the authenticated ACL rather than opening the listener by address.
Authentication does not make unsafe destinations safe. Keep the protected-port rules and deny unmatched requests even when users supply valid credentials. Rotate credentials, remove departed users, and protect the password database as carefully as any other secret.
Preserve Safe_ports and SSL_ports restrictions
Squid’s packaged configuration commonly defines ACLs named Safe_ports and SSL_ports. They restrict ordinary requests to approved destination ports and restrict the CONNECT method used for TLS tunnelling. Keep the corresponding deny rules ahead of your client allow rule. A safe ordering is:
- Deny requests whose destination port is not in
Safe_ports. - Deny
CONNECTrequests whose destination port is not inSSL_ports. - Allow only your trusted source ACL or authenticated users.
- Deny everything else with a final
http_access deny all.
http_access is evaluated in order. Squid stops processing when a rule matches, so placing a broad allow all before the safety checks or trusted-client rule can defeat the entire policy. Read the complete file after editing; do not assume that a snippet replaces the distribution’s other ACLs.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Example policy for one fixed address
In a typical configuration, the relevant portion can look like this (the exact surrounding ACL names vary by package):
acl trusted_client src 203.0.113.25/32
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow trusted_client
http_access deny allDo not copy this fragment over the whole file without checking the existing definitions. The names used in the rules must exist, and your trusted ACL must be declared before it is referenced.
Configure caching only for a suitable workload
Squid can cache in memory and on disk, but caching is not guaranteed to improve speed. Results depend on the request mix, cacheable content, object freshness, available memory, disk performance, and the bandwidth of the VPS and destination sites. There is no universal cache size, throughput, latency, or cache-hit-rate value that applies to every deployment.
Memory-only operation
A memory-focused configuration avoids disk initialization and disk wear, but cached data is lost when the service restarts and the amount of useful content is limited by the memory allocated to Squid and the operating system. This can be appropriate for short-lived or low-volume workloads where persistence is not important.
Disk cache with cache_dir
When disk caching is enabled, Ubuntu documents the syntax:
cache_dir <Type> <Directory-Name> <Size-in-MB> <L1-Dirs> <L2-Dirs>Ubuntu’s guide gives this as a 10,000 MB example with 16 first-level directories and 256 second-level directories:
cache_dir ufs /var/spool/squid 10000 16 256The figure is an example of syntax and layout, not a recommendation for every VPS. Confirm that the selected filesystem has enough free space for the cache plus logs, updates, and normal operating headroom. A small VPS should not sacrifice the space needed for the operating system merely to create a large cache.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Initialize the cache directories
After adding or changing a disk cache_dir, create the required swap-directory structure before starting normal traffic:
sudo squid -zRun this command when the service is stopped or during the package’s documented initialization procedure. If it reports a path or permission error, verify the directory exists, has the ownership expected by the packaged Squid service account, and has sufficient free space. Do not run the daemon as root to bypass an ownership problem.
Open only the required firewall port
Host firewall
Permit the selected TCP port only from the client address or network. For example, with a host firewall that supports source-restricted rules, allow TCP 3128 from 203.0.113.25, and do not add a world-wide rule unless your policy genuinely requires it. Keep a separate, restricted SSH rule so you do not lock yourself out while changing proxy rules.
Provider firewall
Many VPS platforms apply a second firewall, security group, or network access list outside the operating system. Add an inbound rule for the same source and port there. A connection can fail when the host firewall is correct but the provider firewall drops the packet, or vice versa. Remove temporary broad rules after testing.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsOutbound traffic
Squid must be able to reach destination web servers and DNS services from the VPS. If you apply egress filtering, permit only the DNS and web traffic required by your policy. The exact egress rules depend on your network design; do not assume that opening the inbound listener automatically permits outbound requests.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Start, validate, and operate the service
Check the configuration before serving clients
After editing /etc/squid/squid.conf, validate the syntax using the validation command provided by your installed Squid package, then restart the service through the distribution’s service manager. On Ubuntu, the service controls are:
sudo systemctl restart squid
sudo systemctl status squid --no-pagerIf the service does not become active, inspect the status output and the system journal before changing additional settings:
sudo journalctl -u squid --no-pager -n 100Common causes are a misspelled directive, an ACL referenced before it is defined, an invalid port value, a missing cache directory, insufficient permissions, or another process already listening on the selected port.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Confirm the service account
Check the running process and package defaults to ensure Squid operates under its restricted service identity rather than root. Correct ownership of cache and log directories instead of granting broad write access. The upstream guidance explicitly warns against using root for security reasons.
Review logs
After a test request, inspect Squid’s access log and cache log in the locations configured by your distribution. Ubuntu packages commonly use /var/log/squid/; verify the active paths in your configuration. An access-log entry confirms that Squid received and processed the request, while service and cache logs help distinguish policy, DNS, connection, and storage failures.
Test from an authorized client
Configure the client
Set the proxy host to the VPS public address and the port to the value in http_port. For a one-command test with a command-line client, use the proxy URL form:
curl -x http://VPS_PUBLIC_ADDRESS:3128 http://example.com/Replace VPS_PUBLIC_ADDRESS with the real address. Use a domain and URL appropriate to your test policy. Then test an HTTPS destination through the same HTTP proxy:
Recommended Free Tools
curl -x http://VPS_PUBLIC_ADDRESS:3128 https://example.com/The HTTPS request uses the proxy’s CONNECT method; it does not mean Squid can read the encrypted payload. The destination port still has to satisfy the SSL_ports rule.
Verify the request in the log
Immediately after each test, inspect the configured access log and confirm the client address, destination, result, and status. If the request succeeds but no entry appears in the file you are watching, you may be viewing the wrong log path or a rotated file.
Test an unauthorized source
Repeat the request from a machine whose address is not in the trusted ACL, or temporarily use a controlled test address outside the permitted range. The request should be denied and recorded as such. Never use an open internet scanner to test this; a deliberate, authorized test protects other networks and avoids generating unwanted traffic.
Troubleshoot failures in a fixed order
- Listener binding: confirm Squid is running and listening on the configured address and TCP port.
- VPS firewall: verify that the host firewall permits the test source to the selected port.
- Provider firewall: check the cloud firewall or security group for the same source and destination port.
- ACL order: read
http_accessfrom top to bottom. Ensure the trusted or authenticated rule is reachable and that the final deny rule has not been placed first. - DNS and outbound access: verify that the VPS can resolve the destination and establish the required outbound connection.
- Logs: inspect the Squid access log, cache log, service status, and journal for the exact failure.
- Cache storage: if disk caching is enabled, rerun initialization only after correcting path, ownership, or free-space problems.
This order separates network reachability from Squid policy. It also prevents weakening the ACL merely because a firewall or DNS problem is being mistaken for an authorization failure.
Quick Recap
Choose the implementation that matches your clients
| Decision | Option | Advantages | Trade-offs and limits |
|---|---|---|---|
| Client control | Source-IP ACL | Simple, low overhead, and easy to audit when addresses are stable. | Breaks when client addresses change; a shared address can represent more users than intended. |
| Client control | Username/password authentication | Works across changing networks and supports individual credential management. | Requires an authentication helper, protected credential storage, rotation, and additional testing. |
| Cache storage | Memory-focused | No disk-cache initialization and no persistent cache files. | Content is lost on restart and useful capacity is limited by available memory. |
| Cache storage | Disk cache | Provides persistent storage across normal process restarts when configured correctly. | Consumes planned disk space, needs squid -z initialization, and does not guarantee faster responses. |
| Listener | TCP 3128 | Matches Ubuntu’s documented default and avoids client-side ambiguity. | Still needs strict ACL and firewall rules. |
| Listener | Custom port such as 8888 | Fits an existing port plan or avoids a local conflict. | Every client and both firewall layers must use the new value; the port itself is not security. |
| Deployment | Self-managed VPS | Direct control over policy, logs, storage, and network rules. | You maintain updates, hardening, monitoring, availability, and incident response. |
| Deployment | Managed proxy service | Can reduce day-to-day server administration. | Features, trust model, logging, geography, performance, and pricing vary by provider; no universal comparison is established here. |
Operational checklist
- Security updates are applied and SSH is restricted separately.
- The Squid package and service unit are confirmed for the chosen distribution.
/etc/squid/squid.confis backed up before editing on Ubuntu.- The listener is bound to the intended interface and uses the documented or deliberately selected TCP port.
- A narrow source ACL or working authentication policy is defined.
- Safe destination-port rules remain ahead of the client allow rule.
- A final
http_access deny allblocks unmatched requests. - The selected port is allowed only from intended sources in the host and provider firewalls.
- Disk cache directories are initialized when
cache_diris enabled. - The service runs under its restricted package account, not root.
- Authorized HTTP and HTTPS tests appear in the access log.
- An unauthorized-source test is denied.
- Logs, disk usage, updates, and ACL changes are reviewed regularly.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
