Getting Started with Squid Proxy on Azure

The CloudSOE Squid image gives you a ready-to-use caching forward proxy on a hardened Ubuntu base. Squid listens on port 3128 with a curated configuration: private-network ACLs, safe-port rules, a structured key=value access log and nightly log rotation. There are no credentials to retrieve and no first-boot setup to wait for — the proxy is serving as soon as the VM is up.

What you’ll need

• An Azure subscription
• An SSH public key (password login is disabled in the image)
• About five minutes

Step 1 — Create the VM

1. Find the CloudSOE Squid offer in the Azure Marketplace and click Create.
2. Choose a resource group, region and VM name.
3. Pick a size — Standard_B2s handles a small office or a fleet of servers doing package traffic; scale up for heavy caching workloads.
4. Under Administrator account, select SSH public key, pick a username (e.g. azureuser) and paste your key.
5. Deploy into the virtual network whose clients it will serve — the shipped configuration only allows clients from private address space. If the proxy must be reachable across networks, make the public IP Static so client configurations don’t break on stop/start.

Step 2 — Open the firewall ports (carefully)

In the VM’s network security group, allow inbound:

Never open 3128 to the internet. An internet-reachable proxy port gets found by scanners and abused within hours — for spam, credential stuffing and worse, all billed to your subscription. The shipped Squid config is a second line of defence (it only allows clients from RFC 1918, carrier-grade NAT and link-local ranges), but your NSG should be the first: allow 3128 only from your VNet address space or your office ranges.

Step 3 — Point a client at the proxy

From a VM in the same virtual network, use the proxy’s private IP (note: an Azure VM often cannot reach its own public IP from inside, so always test from another machine):

curl -x http://<squid-private-ip>:3128 -sI https://www.example.com/

A HTTP/1.1 200 Connection established line followed by the site’s headers means the proxy is working. To route a whole shell session through it:

export http_proxy=http://<squid-private-ip>:3128
export https_proxy=http://<squid-private-ip>:3128

Step 4 — Watch the log

SSH in with the admin username you chose at deployment and tail the structured access log:

ssh <admin-user>@<public-ip>
sudo tail -f /var/log/squid/access.log

Each request is one line of key=value pairs (url=, status=, src_ip=, bytes=, …) — see tips & tricks for reading it.

Next steps

• Configure Squid — the shipped squid.conf, ACLs, authentication and cache sizing
• Tips & tricks — log analysis, cache tuning and monitoring