If you already rent servers, it is tempting to make proxy on VPS instead of buying one. The software is free, the setup takes a few minutes, and you control everything. For some jobs that is genuinely the right call. For others, the hidden costs (one IP per server, hosting-range addresses, maintenance and the risk of running an open proxy) make a ready-made dedicated proxy the simpler choice. This article sketches a correct, locked-down Squid setup and then compares the two paths honestly.
When a self-hosted proxy makes sense
Running your own proxy is a good fit when:
- You need one or two fixed exit IPs in a specific city, for example to reach an allowlisted API or admin panel.
- You want the proxy next to other workloads on the same server.
- You are comfortable with Linux administration and want full control over logs and configuration.
- You need a location where proxies are not sold but servers are. Cloudj cloud servers run in 14 countries, while Cloudj proxies cover 7 countries; the VPS locations guide lists them.
It is a poor fit when you need many IPs, IPs registered to an ISP rather than a hosting provider, or no maintenance at all.
How to make proxy on VPS with Squid
The example below uses Ubuntu or Debian and Squid as an HTTP proxy. Replace 198.51.100.25 with the public IP you will connect from. You can find it by running curl https://ifconfig.me/ip from that machine.
1. Install Squid
sudo apt update
sudo apt install -y squid
sudo cp /etc/squid/squid.conf /etc/squid/squid.conf.bak2. Write a minimal, restricted configuration
Replace the contents of /etc/squid/squid.conf with:
http_port 3128
acl me src 198.51.100.25/32
acl SSL_ports port 443
acl Safe_ports port 80 443
acl CONNECT method CONNECT
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow me
http_access deny all
forwarded_for delete
via offWhat it does: only your IP may use the proxy, only ports 80 and 443 can be reached, and the final deny all refuses everyone else. forwarded_for delete and via off stop Squid from adding headers that reveal your original IP or that a proxy is in use. Add more acl me src lines if you connect from several fixed IPs.
3. Check and restart
sudo squid -k parse
sudo systemctl restart squid
sudo systemctl enable squidsquid -k parse reports configuration errors before they take the service down.
4. Restrict the port in the firewall as well
Defence in depth: even with the ACL, the port should not be reachable from everywhere.
sudo ufw allow OpenSSH
sudo ufw allow from 198.51.100.25 to any port 3128 proto tcp
sudo ufw enableAllow SSH before enabling the firewall so you do not lock yourself out. The UFW firewall guide covers the details.
5. Test from your machine
curl -x http://YOUR_VPS_IP:3128 https://ifconfig.me/ipThe output should be the VPS's IP. Run the same command from another network and it should be refused. The curl testing guide explains timing and errors.
Optional: password authentication
If your own IP changes often, add a password instead of relying only on the source IP. Install apache2-utils, create a password file with sudo htpasswd -c /etc/squid/passwords myuser, and add these lines above http_access allow me:
auth_param basic program /usr/lib/squid/basic_ncsa_auth /etc/squid/passwords
acl authed proxy_auth REQUIRED
http_access allow authedKeep the firewall rule in mind: if you open the port to everyone for password access, strong passwords and log monitoring become essential. Basic authentication sends credentials in an easily decoded form, so avoid using it over networks you do not trust.
If you need SOCKS5 rather than HTTP, lightweight servers such as 3proxy can do it; the same rule applies of restricting access to your IP or to strong credentials. The SOCKS5 vs HTTP proxy guide helps you decide whether you need it. Squid's own documentation at squid-cache.org lists every directive.
The trade-offs nobody mentions in tutorials
One server, usually one IP
A VPS normally comes with one public IPv4 address. If you need ten exit IPs, you need ten servers, each with its own setup, updates and monitoring. That changes the cost picture quickly.
The IP is a hosting IP
A proxy on your VPS exits from the server's address, which belongs to a hosting provider's range, the same kind of IP that datacenter proxies use. That is fine for allowlisting, API access and many monitoring jobs. Cloudj's dedicated proxies are different: they are static IPv4 addresses registered to an ISP, assigned to one customer only. The datacenter vs static ISP comparison explains the distinction. No IP type guarantees access to a given site.
Maintenance is yours
You own OS updates, Squid updates, log rotation, disk space and monitoring. If the proxy stops at night, nobody else notices. The new VPS security checklist is a good baseline.
Abuse risk is real
An open proxy, one that accepts connections from anyone, is found by automated scanners quickly and then used for spam, attacks and fraud. The abuse reports land on your server and your account, and the IP's reputation suffers. The source-IP ACL and firewall rule above are not optional.
Traffic counts against your server
Proxy traffic is server traffic. On a monthly plan it uses the included traffic allowance, which depends on the location and plan; check the pricing page for the location you pick. On hourly billing, traffic is charged per GB used, and hourly servers are charged for as long as they exist, running or stopped.
Side-by-side comparison
| Proxy on your own VPS | Cloudj dedicated proxy | |
|---|---|---|
| IP type | The server's hosting IP | Static IPv4 registered to an ISP; static residential ISP in the US and Vietnam |
| IPs | One per server | 1 to 1,000 per order |
| Locations | 14 countries | 7 countries |
| Setup | Install, configure, firewall, test | Ready in a few minutes in the console |
| Maintenance | You | Provider; you manage credentials and whitelist |
| Protocols | Whatever you install | HTTP or SOCKS5 where the location supports it |
| Access control | Your ACLs and firewall | Password or a whitelist of up to 20 IPs |
| Other uses | The server can run other workloads too | Proxy only |
How to think about cost
Compare like for like. For a self-hosted proxy, the cost is the server (see the pricing page), its traffic, and your time to set it up and keep it patched. For dedicated proxies, the price is per IP per month, with lower per-IP prices on larger orders, shown live in the console. As a rule of thumb, one or two IPs in a city where you already run a server favours self-hosting; anything beyond a handful of IPs, or a need for ISP-registered addresses, favours a dedicated proxy. The dedicated vs shared proxy guide covers what to look for if you buy.
FAQ
Is it legal to run a proxy on a VPS?
Running a proxy is a normal administration task. What you route through it must follow the law, your provider's terms and the rules of the sites you access.
Why restrict Squid to my IP if it has a password?
An IP restriction stops scanners from even trying credentials, and protects you if a password leaks. Use both when you can.
Can one VPS give me several proxy IPs?
A server normally has one public IPv4 address, so one exit IP. For several IPs, run several servers or buy a proxy order with the quantity you need.
Squid or 3proxy?
Squid is a mature HTTP proxy with detailed access control. 3proxy is a small server that also supports SOCKS5. Pick based on the protocol your tools need.
Pick the path that fits
If you need one fixed IP next to an existing workload, deploy a small server in the console and lock Squid down as shown. If you need several addresses or ISP-registered IPs without upkeep, see the dedicated proxy overview and live prices on the pricing page.