How to Make Your Own Proxy Server: VPS with Squid or 3proxy and Raspberry Pi

The guide covers three platforms: Squid on a VPS for an HTTP/HTTPS proxy, 3proxy on a VPS for SOCKS5 and HTTP, and Squid on a Raspberry Pi for a proxy with your home IP address. The last section compares what each setup costs with renting proxies.

How to make a Squid proxy server on a VPS (Ubuntu)

Squid on an Ubuntu 24.04 or 26.04 LTS VPS works as a private HTTP/HTTPS proxy on TCP port 3128 that serves only clients with a valid username and password.

1. Rent a Linux VPS with a public IPv4 address

In your hosting provider’s control panel, create a server with Ubuntu 24.04 LTS or 26.04 LTS, at least 1 vCPU, 1 GB of RAM and a public IPv4 address. When the server is ready, the panel shows its IPv4 address and the login details for root. To compare plans by CPU, RAM and traffic limits, read our guide on how to choose a VPS.

2. Connect to the server over SSH

On your computer, open Terminal on macOS or Linux, or PowerShell on Windows, and run the command below with your server’s address. Type yes to accept the host key, then enter the password; the prompt changes to the server’s hostname.

ssh root@SERVER_IP

3. Install Squid and the password utility

In the SSH session, run the command below. apt installs Squid as a system service that starts automatically and listens on port 3128, plus the htpasswd tool from the apache2-utils package.

sudo apt update && sudo apt install -y squid apache2-utils

4. Create a proxy user

Run htpasswd with the -c flag to create the password file and the first user, then type the password twice. The file stores the user name and a password hash; leave out -c when you add more users, because the flag overwrites the file.

sudo htpasswd -c /etc/squid/passwords proxyuser

5. Turn on password authentication

Open a new configuration file with sudo nano /etc/squid/conf.d/auth.conf, paste the four lines below, then press Ctrl+O, Enter and Ctrl+X to save and exit. Squid reads files from /etc/squid/conf.d/ before its final http_access deny all rule, so authenticated clients get through and everyone else is refused.

auth_param basic program /usr/lib/squid/basic_ncsa_auth /etc/squid/passwords

auth_param basic realm proxy

acl authenticated proxy_auth REQUIRED

http_access allow authenticated

6. Check the configuration and restart Squid

Run the parser first: when its output contains no ERROR lines, the syntax is valid. Then restart the service to apply the new rules.

sudo squid -k parse

sudo systemctl restart squid

7. Open port 3128 in the firewall

Allow SSH before you enable UFW so your session stays open, then allow the proxy port and answer y when UFW warns about SSH connections. If your provider’s panel has its own cloud firewall, add an inbound rule for TCP 3128 there as well.

sudo ufw allow 22/tcp

sudo ufw allow 3128/tcp

sudo ufw enable

8. Check that traffic leaves through the VPS

On your own computer, run the curl command below with your user name, password and server IP. The proxy works when the output is your VPS’s IPv4 address, not your home IP.

curl -x http://proxyuser:PASSWORD@SERVER_IP:3128 https://api.ipify.org

How to set up a 3proxy SOCKS5 server on a VPS

3proxy is a lightweight proxy daemon that runs a SOCKS5 server on port 1080 and an HTTP proxy on port 3128 on the same VPS, which suits apps that accept only SOCKS5.

1. Log in to a Debian or Ubuntu VPS

Rent a VPS with a public IPv4 address and Debian 12 or newer, or Ubuntu 22.04 or newer: these are the releases the official 3proxy repository supports. From Terminal or PowerShell on your computer, connect with the command below and enter the password.

ssh root@SERVER_IP

One VPS gives you SOCKS5 in one country only. For exits in 20+ countries without a server to maintain, rent SOCKS5 proxies from Proxys.io: each IP is dedicated and works with a login and password.

2. Add the official 3proxy repository

Paste the commands below into the SSH session: they download the project’s signing key and register its signed apt repository in the current channel, which carries the 3proxy 1.0 branch. On a minimal Debian image without sudo or curl, first run apt install -y sudo curl as root.

sudo curl -fsSL https://3proxy.org/repo/3proxy-release-key.asc -o /usr/share/keyrings/3proxy.asc

sudo tee /etc/apt/sources.list.d/3proxy.sources <<EOF

Types: deb

URIs: https://3proxy.org/repo/deb

Suites: current

Components: main

Signed-By: /usr/share/keyrings/3proxy.asc

EOF

3. Install 3proxy

Refresh the package list and install the package. By default 3proxy starts SOCKS on 0.0.0.0:1080 and the HTTP proxy on 0.0.0.0:3128 with password authentication and no users, so no client can connect yet.

sudo apt update && sudo apt install -y 3proxy

4. Add a proxy user

Run the add3proxyuser script with a user name and password; two optional arguments set a daily traffic limit in MB and a bandwidth cap in bits per second. If the shell reports “command not found”, call the script by its full path, /etc/3proxy/conf/add3proxyuser.sh.

sudo add3proxyuser proxyuser PASSWORD

5. Restart 3proxy and check the ports

Enable the service at boot and restart it so it loads the new user. The ss command then lists 3proxy in the LISTEN state on ports 1080 and 3128, plus 8080 for the package’s web admin page; keep 8080 closed in the firewall.

sudo systemctl enable 3proxy

sudo systemctl restart 3proxy

sudo ss -tlnp | grep 3proxy

6. Allow the proxy ports in the firewall

Install UFW, which Debian does not ship by default, allow SSH first, then both proxy ports, and answer y when ufw enable asks for confirmation. Repeat the TCP 1080 and 3128 rules in your provider’s cloud firewall if the panel has one.

sudo apt install -y ufw

sudo ufw allow 22/tcp

sudo ufw allow 1080/tcp

sudo ufw allow 3128/tcp

sudo ufw enable

7. Check that SOCKS5 traffic exits through the VPS

On your computer, run curl through the SOCKS5 port; the socks5h scheme also sends DNS lookups through the server. The setup works when the command prints the VPS’s IPv4 address.

curl -x socks5h://proxyuser:PASSWORD@SERVER_IP:1080 https://api.ipify.org

How to build a proxy server on a Raspberry Pi

A Raspberry Pi running Squid turns your home internet connection into a proxy, so every request sent through it carries the residential IP address your ISP assigned to your router.

1. Choose the board, OS and card in Raspberry Pi Imager

Open Raspberry Pi Imager 2.0 on your computer with the microSD card in a card reader. In the Device step select your Raspberry Pi model, in OS choose Raspberry Pi OS Lite (64-bit), and in Storage select the card with Exclude system drives left ticked. Imager then moves to the Customisation step.

2. Preconfigure the login and SSH

In Customisation, enter a name such as proxypi in Hostname, pick your capital city in Localisation, create a user name and password in User, and enter your network name and password in Wi-Fi unless the Pi uses Ethernet. In Remote access, turn on Enable SSH and select Use password authentication; click Next after each sub-step, including Raspberry Pi Connect.

3. Write the card and start the Pi

In the Writing step, check the list under Customisations to apply, click Write and confirm the warning that the card will be erased. After verification finishes, insert the card into the Pi and connect power; the first boot takes 2–3 minutes while the system applies your settings.

4. Connect to the Pi over SSH

From a computer on the same network, run the command below with the user name and hostname you set, then enter the password. The prompt changes to USERNAME@proxypi.

ssh USERNAME@proxypi.local

5. Install Squid and create a remote user

Install Squid with the htpasswd tool, then create a password for connections from outside your home. Devices on your home network will connect without it.

sudo apt update && sudo apt install -y squid apache2-utils

sudo htpasswd -c /etc/squid/passwords homeuser

6. Allow your home network and password logins

Run hostname -I to see the Pi’s LAN address, for example 192.168.1.50, which puts it in the 192.168.1.0/24 subnet. Open sudo nano /etc/squid/conf.d/home.conf, paste the lines below with your subnet, and save with Ctrl+O, Enter, Ctrl+X. The last command validates the file and restarts Squid.

acl home_lan src 192.168.1.0/24

auth_param basic program /usr/lib/squid/basic_ncsa_auth /etc/squid/passwords

auth_param basic realm proxy

acl authenticated proxy_auth REQUIRED

http_access allow home_lan

http_access allow authenticated

sudo squid -k parse && sudo systemctl restart squid

7. Reserve the Pi’s address and forward the port on your router

In your router’s admin page, reserve the Pi’s current LAN IP (DHCP reservation) and create a port-forwarding rule from external TCP 3128 to that IP; menu names depend on the router model. Skip forwarding if you use the proxy only at home, and note that it will not work behind carrier-grade NAT (CGNAT), where the router has no public IP.

If your ISP uses CGNAT, rent Proxys.io ISP proxies instead: static IPs from residential ranges of real internet providers in 25 countries, from $3 per IP, with HTTP(S) and SOCKS5.

8. Check that requests use your home IP

On a laptop connected to your home Wi-Fi, run the first command with the Pi’s LAN address; it prints your home public IP. From outside your network, the second command with the password and your public IP must print the same address.

curl -x http://192.168.1.50:3128 https://api.ipify.org

curl -x http://homeuser:PASSWORD@HOME_PUBLIC_IP:3128 https://api.ipify.org

When buying proxies is cheaper than making your own

A rented dedicated IPv4 proxy costs less per month than a VPS of your own, so a self-hosted proxy pays off only when the server already exists or when a home Raspberry Pi carries enough traffic to replace paid residential gigabytes.

Each VPS gives you one datacenter IPv4 address for about $3–6 per month, while one rented dedicated IPv4 proxy costs $2.10–2.30 per month and about $1.50–1.60 per IP from five IPs upward. Five exit IPs therefore cost $15–30 as five VPS plans and about $8 as rented proxies. A Raspberry Pi 5 with 2 GB of RAM costs $77.50 for the board alone, the price of about 19 GB of rented residential traffic at $4 per GB.

Make your own proxy server if:

• you already pay for a VPS with spare capacity, so the proxy adds no cost;
• you need full control over logs, ports and software on the exit server;
• you send a lot of traffic through one home IP, where a Raspberry Pi replaces per-GB residential billing.

Buy proxies if:

• you need several IPs or IPs in several countries at once;
• target sites block datacenter ranges and you need rotating residential addresses;
• you cannot spend time on OS updates, monitoring and abuse reports.

Need several dedicated IPs today? Rent private proxies from Proxys.io: each IP is assigned to one user, works over HTTP, HTTPS and SOCKS5, and the purchase can be returned within 24 hours.

Wrapping up

You set up your own proxy server on three platforms: Squid with password authentication on an Ubuntu VPS, a SOCKS5 and HTTP server with 3proxy on Debian or Ubuntu, and a home proxy on a Raspberry Pi prepared in Raspberry Pi Imager 2.0.

If target sites start blocking your self-hosted IP or it slows down under load, replace the IP instead of rebuilding the server: Proxys.io datacenter proxies give you dedicated IPs with unlimited bandwidth, and a free test proxy lets you check them first.

FAQ

Is a self-hosted proxy anonymous?

Only partially: websites see the server’s IP instead of yours, but that IP is registered to your VPS account or home internet contract, so the provider can link the traffic to you.

What happens if I leave the proxy open without a password?

Scanners find open proxies and route spam and attacks through them, which gets the server’s IP blacklisted and can make your hosting provider suspend the VPS.

Which port should my proxy server use?

Squid listens on TCP 3128 by default and SOCKS5 servers conventionally use 1080, but any free port works once you set it in the server config, the firewall and the client.

Can Squid and 3proxy run on the same VPS?

Yes, after you move one of them off port 3128, because both use it for HTTP by default. In Squid, change the http_port line in /etc/squid/squid.conf, for example to http_port 8888.

Why does my proxy return error 407?

Error 407 means the proxy requires authentication and the client sent no credentials or wrong ones. Re-enter the user name and password exactly as you created them; client-side fixes are collected in our guide to the HTTP 407 proxy error.

Is a Raspberry Pi fast enough for a proxy?

For a few users, yes: the limit is usually your home upload speed, because every page you load through the Pi from outside travels up your home connection.

Do I need a static IP for a Raspberry Pi proxy?

Only for access from outside your home: most ISPs change home IP addresses from time to time, so use a static IP from your ISP or a dynamic DNS name that follows the changes.