How to Set Up Squid Proxy on Ubuntu (Step-by-Step)

Squid is a robust, full-featured caching proxy daemon that provides high-performance access to web resources by caching frequently visited content and managing traffic through sophisticated ACLs (Access Control Lists). Learning how to configure this on a Linux server is essential for network administrators aiming to reduce bandwidth usage, improve response times, and implement security policies across a local area network. This guide covers the end-to-end installation and optimization of Squid on Ubuntu 22.04 and 24.04 LTS environments.

Understanding Squid Proxy Architecture

Before diving into the command line, it is vital to understand how Squid interacts with your network stack. Unlike a simple SOCKS5 tunnel, Squid acts as an intermediary for HTTP, HTTPS, and FTP protocols, inspecting headers and determining whether to serve a cached copy of a resource or fetch a fresh version from the origin server. This process is governed by the "Squid Cache Manager," which handles memory allocation and disk storage for cached objects.

When a client sends a request to the Squid server, the daemon checks its local cache (typically stored in /var/spool/squid). If the object is present and still valid according to the TTL (Time to Live) settings, Squid serves the request immediately. This reduces external traffic, making it a favorite for enterprise environments where multiple users access the same software updates or static assets. For those who need pre-configured solutions, checking 10 free datacenter proxies can be a great starting point for testing connectivity before building your own infrastructure.

The Role of ACLs and Authentication

Access Control Lists are the backbone of Squid’s security model. You can define rules based on the client's source IP address, the destination domain, the specific time of day, or even the browser user-agent. Advanced configurations often involve integrating Squid with LDAP or Active Directory, allowing user-based authentication rather than just IP-based white-listing.

Why Ubuntu for Proxy Hosting?

Ubuntu remains the preferred choice for this setup due to its stable repository updates and the ubiquity of documentation. Whether you are deploying on a local machine or a remote cloud instance from providers listed on vpsrated.com/proxy, the process remains consistent. The apt package manager ensures you are getting a version of Squid compiled with standard modules, including SSL-Bump and various authentication helpers.

Step 1: Installing Squid on Ubuntu

To begin, ensure your Ubuntu system is up to date. This prevents dependency conflicts during the installation of the Squid daemon and its supporting libraries.

sudo apt update && sudo apt upgrade -y
sudo apt install squid -y

Once the installation completes, the Squid service starts automatically. You can verify its status using systemctl. It is important to note that by default, Squid listens on port 3128 and denies all incoming traffic for security reasons.

sudo systemctl status squid

Essential File Locations

• Configuration File: /etc/squid/squid.conf
• Access Logs: /var/log/squid/access.log
• Cache Logs: /var/log/squid/cache.log

Before editing the primary configuration, always create a backup. This allows you to revert quickly if a syntax error causes the service to fail. Use sudo cp /etc/squid/squid.conf /etc/squid/squid.conf.bak.

Step 2: Configuring Access Control and Ports

The default configuration file is massive, often exceeding 5,000 lines because it includes extensive documentation. To make it manageable, many admins choose to clear it and start with a minimal functional config or search for specific keywords like http_access.

To allow your local network to use the proxy, you must define an ACL for your IP range. For example, if your local network is 192.168.1.0/24, you would add the following to your /etc/squid/squid.conf:

acl localnet src 192.168.1.0/24
http_access allow localnet
http_access allow localhost
# And finally deny all other access
http_access deny all

Changing the Default Port

For improved security or to avoid port collisions, you might want to change port 3128 to something custom, like 8080 or 9000. Look for the http_port directive:

# Change this line
http_port 3128
# To this
http_port 8888

After making these changes, restart the service with sudo systemctl restart squid. If you are using a firewall like UFW, ensure the new port is open: sudo ufw allow 8888/tcp.

Step 3: Implementing Basic Authentication

In a production environment, simply white-listing IPs is often insufficient, especially if IPs are dynamic. Squid supports htpasswd files for basic authentication. First, you need the apache2-utils package:

sudo apt install apache2-utils
sudo touch /etc/squid/passwords
sudo chown proxy: /etc/squid/passwords
sudo htpasswd /etc/squid/passwords myusername

Now, modify your squid.conf to include the authentication helper:

auth_param basic program /usr/lib/squid/basic_ncsa_auth /etc/squid/passwords
auth_param basic children 5
auth_param basic realm Squid Proxy Server
auth_param basic credentialsttl 2 hours
acl authenticated proxy_auth REQUIRED
http_access allow authenticated

This configuration forces users to enter a username and password before they can browse through the proxy. For high-volume scraping or heavy data tasks, sourcing datacenter proxies from 1.75 per IP is often more efficient than maintaining a large private authentication list manually.

Network Traffic Flow and Cache Logic

Understanding how the request flows through the Squid architecture helps in debugging performance bottlenecks. The following diagram illustrates a standard request-response cycle.

Squid uses a specific algorithm called "Least Recently Used" (LRU) to manage what stays in the cache. When the allocated disk space is full, Squid purges the oldest, least accessed files to make room for new content.

Step 4: Configuring SSL-Bump for HTTPS Inspection

Modern web traffic is almost entirely encrypted via HTTPS (TLS). By default, Squid acts as a "blind" tunnel for HTTPS, meaning it cannot see or cache the encrypted content. "SSL-Bump" is a feature that allows Squid to decrypt the traffic, inspect/cache it, and re-encrypt it. Note: This requires installing a self-signed CA certificate on all client devices to avoid security warnings.

1. Generate a Private Key and Certificate:

   openssl req -new -newkey rsa:2048 -days 365 -nodes -x509 -keyout squidCA.pem -out squidCA.pem

2. Initialize the SSL DB: Squid uses a dedicated database to track generated certificates for target sites.

   sudo /usr/lib/squid/security_file_certgen -c -s /var/lib/squid/ssl_db -M 4MB
   sudo chown -R proxy:proxy /var/lib/squid/ssl_db

SSL-Bump Directives

In squid.conf, you will need to add directives to handle the step-by-step handshake. This is advanced and should be tested in a staging environment first to ensure it doesn't break websites using HSTS (HTTP Strict Transport Security).

Comparison of Proxy Services and Self-Hosted Squid

While self-hosting Squid on Ubuntu offers maximum control, it lacks the massive IP rotation capabilities of residential providers. Below is a comparison of how a self-hosted Squid instance stacks up against enterprise providers found on proxytrust.site.

For users looking to bridge the gap, you can configure Squid as a "Forward Proxy" that sends its outbound traffic to a provider like Oxylabs or Smartproxy. This gives you local caching benefits combined with a massive residential IP pool.

Step 5: Anonymizing the Proxy

By default, Squid adds headers like X-Forwarded-For, which informs the destination server that a proxy is being used and reveals the original client's IP address. To create an "Elite" or "High Anonymity" proxy, you must strip these headers.

Add these lines to the bottom of your configuration:

forwarded_for off
request_header_access Allow allow all
request_header_access Authorization allow all
request_header_access Proxy-Authorization allow all
request_header_access Proxy-Connection allow all
request_header_access Cache-Control allow all
request_header_access Content-Encoding allow all
request_header_access Content-Length allow all
request_header_access Content-Type allow all
request_header_access Date allow all
request_header_access Expires allow all
request_header_access Host allow all
request_header_access If-Modified-Since allow all
request_header_access Last-Modified allow all
request_header_access Location allow all
request_header_access Pragma allow all
request_header_access Accept allow all
request_header_access Accept-Charset allow all
request_header_access Accept-Encoding allow all
request_header_access Accept-Language allow all
request_header_access Content-