iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
To set up Squid on a Linux VPS, install the package, restrict its http_access policy to known clients or authenticated users, expose only the listener port through both firewalls, initialize any configured disk cache, and test from an authorized and an unauthorized network. Squid listens on TCP port 3128 by default, but the port itself is not a security control.
Squid is a forward HTTP proxy and cache. It can relay ordinary HTTP requests and HTTPS connections through the CONNECT method, but it is not automatically private, anonymous, or safe when placed on a public address. An unrestricted installation can become an open proxy that strangers use to consume your bandwidth and VPS resources.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWhat Squid does—and what it does not do
A forward proxy sits between clients and destination web servers. The client sends a request to Squid; Squid applies its access rules, connects to the destination, and returns the response. For HTTPS, the client normally asks Squid to create a tunnel with CONNECT; Squid does not decrypt the site’s TLS traffic merely because it is forwarding the connection.
- Access control: ACLs can limit requests by source address, destination port, authentication state, and other attributes.
- Caching: Squid can retain eligible responses in memory and on disk, reducing repeated downloads for workloads that actually reuse cacheable content.
- Logging: Access and cache logs provide evidence of requests, denials, errors, and cache activity.
- No automatic anonymity: A public listener with permissive rules is an open proxy. A custom port does not prevent discovery or misuse.
- No guaranteed acceleration: Latency, bandwidth, object cacheability, storage speed, memory, and client geography determine whether a cache helps. There is no universal speed, hit-rate, or VPS-size figure.
Prepare and harden the Linux VPS
Use a supported Ubuntu or other Linux image and apply its security updates before installing proxy software. Create an administrator account with sudo rather than using the root account for routine work. Restrict SSH independently of the proxy listener: SSH administration and client proxy access are separate firewall decisions.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
If clients need a stable endpoint, assign a static public address or an equivalent reserved address from your VPS provider. Provider selection, region, uptime, and pricing are deployment choices rather than Squid settings; verify those details separately.
Pre-install checklist
- Record the VPS public address and the public source address or network range that should be allowed to use the proxy.
- Decide whether access will be restricted by source IP, username and password, or both.
- Choose whether you need disk caching. Do not allocate a cache directory simply because the example configuration contains one.
- Confirm that you can reach the VPS by SSH before changing firewall rules.
- Plan the provider-level firewall rule as well as the firewall on the VPS itself.
Install Squid
Ubuntu
On Ubuntu, the package is named squid. Update package metadata and install it with:
sudo apt update
sudo apt install squidUbuntu places the main configuration at /etc/squid/squid.conf. The package creates a service managed by the distribution’s service system. After installation, check its state with:
sudo systemctl status squidIf your Ubuntu release uses a different service presentation, use the unit name and controls shown by that release’s package. Do not assume that a command copied from another distribution has the same unit name or file locations.
Other Linux distributions
Squid is packaged by many Linux distributions, but package names, repository enablement, service-unit names, default paths, and authentication helpers can differ. Confirm the distribution’s official package documentation before replacing Ubuntu’s apt command with a command for a different package manager. Keep the configuration and firewall steps below, but substitute the paths and service controls supplied by that distribution.
Back up the configuration before editing
Make a protected, timestamped copy of the configuration. On Ubuntu, for example:
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →sudo cp -p /etc/squid/squid.conf /etc/squid/squid.conf.bak.$(date +%F-%H%M%S)Keep the backup outside your editor’s temporary files and record which version is active. When diagnosing a failed restart, comparing the edited file with this backup is usually faster than reconstructing a working policy from memory.
Choose and expose the listener port
Canonical’s Ubuntu guidance documents TCP port 3128 as Squid’s default listener. The basic directive is:
http_port 3128To use another port, such as 8888, change the directive to:
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
http_port 8888A custom port can avoid collisions with another service, but it is not an access-control mechanism. Internet scanners can find nonstandard ports, so the ACL and firewall policy must remain restrictive. Where your package and network layout support it, bind the listener to the intended local address rather than every interface; verify the resulting socket with ss after restarting.
Whichever port you select must be consistent in four places:
- The
http_portdirective insquid.conf. - The client proxy setting.
- The VPS host firewall.
- The VPS provider’s network firewall or security-group rule.
Open only TCP for the selected listener. Keep SSH on its own narrowly scoped rule and do not expose administrative ports to the entire internet unless that is an intentional, controlled policy.
Build a restrictive access policy
Squid’s http_access directives are evaluated in order. The first matching allow or deny determines the result, so rule order is as important as the individual ACLs. The upstream Squid QUICKSTART emphasizes that restricting the client network prevents people from stealing your network resources.
Allow one known source address
If one office, home connection, or managed egress address should use the proxy, define a source ACL for that address. The following uses documentation-only addresses; replace them with the actual client address or CIDR range you control:
acl trusted_client src 198.51.100.10/32
# Keep the Safe_ports and SSL_ports ACLs supplied by the package.
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow trusted_client
http_access deny allA /32 permits one IPv4 address. Use the smallest range that covers your managed clients. If your public address changes, the ACL will stop matching until you update it; that is safer than silently broadening it to the whole internet.
Ubuntu’s sample configuration commonly contains a localnet ACL and associated allows. Review every existing http_access line. Remove or narrow any rule that permits a broader network than intended, and ensure no earlier http_access allow all or similarly broad rule bypasses your restriction.
Allow a controlled network range
For a private office or VPN egress range, use the network in CIDR notation, for example:
acl office_net src 198.51.100.0/24
http_access allow office_netOnly use a range whose ownership and routing you understand. A cloud provider’s internal subnet is not automatically the same as the public source address that Squid sees; test from the real client path.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
Use authentication instead of—or in addition to—source IP
Username and password authentication is useful when clients move between networks or when several users share an egress address. Authentication requires an auth_param helper and credentials configured according to the package and distribution. Do not paste an authentication ACL into an otherwise unconfigured installation and assume it protects anything.
Once a working helper is configured, the policy pattern is:
acl authenticated proxy_auth REQUIRED
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow authenticated
http_access deny allYou can combine authentication with a source ACL when credentials should work only from a trusted network. Keep the final deny rule, and test both valid and invalid credentials. Store credential files with permissions that prevent ordinary users from reading them, following the authentication helper’s documentation.
Retain port-safety protections
Safe_ports limits destination ports for ordinary requests, while SSL_ports limits ports that may be used with CONNECT. Keep the package’s definitions unless you have a documented business requirement to change them. If you add an allowed destination port, review why it is needed and include it in the matching ACL deliberately; do not solve a failed request by allowing every port.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Configure caching only when the workload benefits
Squid can cache in memory and on disk. A disk cache consumes storage and requires initialization; it is not a universal performance upgrade. Dynamic pages, personalized responses, cache-control headers, and one-time downloads may provide little reusable content. A small VPS with limited I/O may perform better with a conservative cache than with an oversized directory competing with the operating system.
Ubuntu documents the directive form:
cache_dir <Type> <Directory-Name> <Size-in-MB> <L1-Dirs> <L2-Dirs>Its example is:
cache_dir ufs /var/spool/squid 10000 16 256This example allocates a nominal 10,000 MB cache with 16 first-level and 256 second-level directories. It is syntax and an illustration, not a recommendation for every VPS. Choose a size that fits available disk space after reserving room for the operating system, logs, updates, and monitoring. If you do not need persistent disk caching, omit or disable the cache_dir line according to your distribution’s configuration rather than allocating storage by default.
Validate, initialize, and restart Squid
After editing, validate the configuration using the Squid binary supplied by your package. Many installations support:
sudo squid -k parseIf the command reports an error, fix the first reported file, line, or directive before restarting. A later error may simply be a consequence of the first one.
When a disk cache is configured, create missing swap and cache directory structures before starting normal traffic:
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
sudo squid -zThe Squid man page documents squid -z for this initialization. Run it after changing the cache directory or layout when your package requires it.
Restart through the distribution’s service controls, then inspect the state:
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →sudo systemctl restart squid
sudo systemctl status squidConfirm that the process runs under the restricted service account created by the package. The upstream QUICKSTART explicitly warns: “Do not use root, for security reasons.” If a custom launch method runs the daemon as root, stop and correct that deployment rather than treating it as normal.
Configure both firewall layers
The listener should be reachable only where your policy expects it. First create a rule in the VPS provider’s firewall for the selected TCP port and the authorized source addresses. Then create the corresponding host-firewall rule inside Linux. A restrictive Ubuntu UFW example for one client is:
sudo ufw allow from 198.51.100.10 to any port 3128 proto tcpAdapt the port and source range to your configuration. If you use a custom listener, do not leave an old port open. Check the effective rules rather than assuming that a control-panel change reached the VPS:
sudo ufw status numberedSome distributions use a different firewall tool, and some images start with no host firewall enabled. Use the tool supported by your image. A provider firewall cannot compensate for an unrestricted Squid ACL if the listener is reachable from an allowed network, and a host firewall cannot help when the provider firewall blocks all legitimate clients.
Recommended Free Tools
Test from an authorized client
Check the socket on the VPS
After restarting, verify that Squid is listening on the intended address and port:
sudo ss -ltnp | grep 3128For a custom port, replace 3128 with that port. A socket bound only to a loopback address will not accept remote clients; a socket bound to all interfaces must be protected by both ACLs and firewalls.
Request HTTP and HTTPS through the proxy
From an authorized client, use a proxy-aware client such as curl. The following examples use the documentation address 198.51.100.20 for the VPS:
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
curl -x http://198.51.100.20:3128 http://example.com/ -I
curl -x http://198.51.100.20:3128 https://example.com/ -IThe HTTPS request should establish a CONNECT tunnel through Squid. A successful response alone is not sufficient proof of correct policy: verify that the request appears in Squid’s access log and that the client is using the intended listener.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteConfirm that an unauthorized source is denied
Repeat the test from a network that is not in the source ACL, or with credentials that should fail. The request should be rejected by Squid or blocked before it reaches the service. Check the access log for a denial and confirm that the unauthorized source cannot use the proxy to reach an external site. Never test an open listener by publishing its address or credentials.
Review logs immediately after each test
Package defaults commonly place Squid’s access and cache logs under /var/log/squid/, although paths can vary by distribution. Follow the files configured by your installation:
sudo tail -f /var/log/squid/access.log
sudo tail -f /var/log/squid/cache.logAccess entries help distinguish an ACL denial from a destination failure. Cache logs usually reveal configuration, permission, DNS, storage, and startup errors. Stop following the logs with Ctrl-C; it does not stop Squid.
Troubleshoot in a fixed order
Connection refused or timed out
- Check that the service is active and the configuration parsed successfully.
- Confirm the listener address and port with
ss -ltnp. - Check the VPS host firewall and then the provider firewall.
- Verify that the client is using the same port configured in
http_port. - Only after those checks, investigate DNS or the destination site.
Squid starts but every request is denied
Inspect the ACL source address as Squid sees it. A client behind NAT may present the gateway’s public address, not its private address. Check the order of http_access lines: an earlier deny or a missing matching allow will decide the request before a later rule is considered. Also verify that the destination port is covered by Safe_ports or, for HTTPS, SSL_ports.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsAn unauthorized client succeeds
Treat this as an incident. Look for a broad localnet or http_access allow rule above your restrictions, an ACL that contains an unintended range, and a provider or host firewall rule that exposes the listener more widely than planned. Add or restore the final http_access deny all, reload, and retest from outside the trusted network.
Disk-cache initialization fails
Check that the directory named in cache_dir exists, has the ownership expected by the Squid service account, and has enough free space. Run squid -z again after correcting the path or permissions, then inspect the cache log. Do not work around a permission error by running the daemon as root.
HTTPS fails while HTTP works
Check that the client is using an HTTP proxy URL for both tests and that the requested destination port is allowed by SSL_ports. A firewall that permits the listener but blocks outbound connections can also cause this symptom. The cache log and the access-log result for the CONNECT request distinguish an ACL denial from a network or destination error.
Choose the implementation that matches your environment
| Decision | Advantages | Trade-offs and safeguards |
|---|---|---|
| Source-IP ACL | Simple, no credential database, easy to audit for a fixed egress address. | Breaks when the client address changes; never use a broad range merely for convenience. |
| Username/password authentication | Works for users who move between networks and supports individual credential revocation. | Requires an authentication helper, secure credential storage, and testing of failed logins. |
| Both source ACL and authentication | Provides two independent conditions for sensitive deployments. | More administration and more ways for rule order or helper configuration to block legitimate clients. |
| Memory-focused caching | Lower disk overhead and simpler operation for small or short-lived deployments. | Content disappears on restart and available memory limits the useful working set. |
| Disk caching | Can retain reusable objects across memory pressure and restarts when responses are cacheable. | Consumes storage and I/O; requires cache_dir sizing, permissions, and squid -z initialization. |
| Default port 3128 | Matches package documentation and makes client setup straightforward. | Must still be protected by ACLs and firewalls. |
| Custom listener such as 8888 | Avoids a local port collision or fits an existing network design. | Does not provide security; every client, firewall, monitoring rule, and test must use the new port. |
| Single VPS | Direct control over software, policy, logs, and storage. | You maintain updates, availability, firewalling, credentials, and capacity. |
| Managed proxy service | May reduce server maintenance responsibilities. | Policy, logging, regions, authentication, and pricing depend on the service contract; those values are not determined by Squid configuration. |
Operate the proxy safely after deployment
- Apply operating-system and Squid package updates through your normal maintenance process.
- Review access logs for unexpected source addresses, unusual destinations, repeated denials, and traffic spikes.
- Rotate or protect logs so they do not consume the VPS disk.
- Recheck source ACLs whenever a client network, NAT gateway, or VPN route changes.
- Keep the configuration backup and document why each non-default ACL or cache setting exists.
- Monitor free disk space when
cache_diris enabled. - Re-test an authorized HTTP request, an authorized HTTPS request, and an unauthorized request after firewall or policy changes.
- Confirm periodically that the daemon still runs under its restricted service account and is not being launched as root.
A correctly deployed Squid VPS is therefore a narrowly reachable, explicitly authorized forward proxy—not simply a package listening on a public port. The secure outcome comes from the combination of ordered ACLs, Safe_ports and SSL_ports protections, two-layer firewall rules, careful cache initialization, and repeated log-backed testing.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
