Getting Started with Squid Proxy on AWS

The CloudSOE Squid image gives you a ready-to-use caching forward proxy on a hardened Ubuntu base. Squid listens on port 3128 with a curated configuration: private-network ACLs, safe-port rules, a structured key=value access log and nightly log rotation. There are no credentials to retrieve and no first-boot setup to wait for — the proxy is serving as soon as the instance is up.

What you’ll need

• An AWS account subscribed to the CloudSOE Squid listing on AWS Marketplace
• An EC2 key pair in your target region (SSH is key-based only; password login is disabled)
• About five minutes

Step 1 — Launch the instance

1. Open the Squid listing on AWS Marketplace and click Continue to Subscribe, then Continue to Configuration.
2. Pick your region and click Continue to Launch → Launch through EC2.
3. Choose an instance type. t3.small handles a small office or a fleet of servers doing apt/yum traffic; scale up for heavy caching workloads.
4. Select your key pair. Launch the instance into the VPC whose clients it will serve — the shipped configuration only allows clients from private address space.

Prefer the CLI? Once subscribed:

aws ec2 run-instances \
  --image-id <ami-id-from-the-listing> \
  --instance-type t3.small \
  --key-name my-key \
  --security-group-ids sg-xxxxxxxx \
  --subnet-id subnet-xxxxxxxx \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=squid-01}]'

Step 2 — Open the firewall ports (carefully)

Never open 3128 to 0.0.0.0/0. An internet-reachable proxy port gets found by scanners and abused within hours — for spam, credential stuffing and worse, all billed to your account. The shipped Squid config is a second line of defence (it only allows clients from RFC 1918, carrier-grade NAT and link-local ranges), but your security group should be the first: allow 3128 only from your VPC CIDR or your office ranges.

Step 3 — Point a client at the proxy

From an instance in the same VPC, use the proxy’s private IP:

curl -x http://<squid-private-ip>:3128 -sI https://www.example.com/

A HTTP/1.1 200 Connection established line followed by the site’s headers means the proxy is working. To route a whole shell session through it:

export http_proxy=http://<squid-private-ip>:3128
export https_proxy=http://<squid-private-ip>:3128

Step 4 — Watch the log

SSH in as ubuntu and tail the structured access log:

ssh ubuntu@<public-ip>
sudo tail -f /var/log/squid/access.log

Each request is one line of key=value pairs (url=, status=, src_ip=, bytes=, …) — see tips & tricks for reading it.

Next steps

• Configure Squid — the shipped squid.conf, ACLs, authentication and cache sizing
• Tips & tricks — log analysis, cache tuning and monitoring