What is a proxy server? How it works, what it hides, and how to run your own

Short answer: a proxy server is a computer that makes network requests on your behalf. Your browser or app sends its request to the proxy, the proxy forwards it to the website, and the answer comes back the same way — so the website sees the proxy’s IP address, not yours. Proxies are used to control and filter traffic in companies, to cache downloads, to reach services from another location and to keep a client’s address out of server logs.

That kind is a forward proxy: it works for the client. Its mirror image, the reverse proxy, sits in front of servers and works for them. This article is about the forward kind — how it works, what it hides and what it does not, and how to run your own.

How does a proxy server work?

A client has to be told to use a proxy, either in its settings or by the network. Then:

• The client opens a connection to the proxy instead of to the website.
• For plain HTTP it sends the full URL — GET http://example.com/page HTTP/1.1 — and the proxy fetches it and relays the answer, optionally from its cache.
• For HTTPS it sends CONNECT example.com:443. The proxy opens a TCP connection to that host and from then on passes bytes back and forth. The TLS session runs end to end between the client and the website, so the proxy sees the host name and the amount of data, but not the pages, cookies or passwords inside.
• The website sees a connection from the proxy’s IP address. Whether it learns yours depends on the headers the proxy adds, covered below.

What types of proxy servers are there?

You will also see proxies sold by where their IP addresses come from: datacenter proxies use addresses of hosting companies, residential and mobile proxies use addresses of home and mobile connections. The protocol is the same; what differs is how websites rate the address. A proxy you run on your own server is a datacenter proxy with an IP address used by nobody else.

What does a proxy hide, and what does it not?

A proxy changes the source address the website sees. Several things can still give you away:

• Forwarding headers. Many HTTP proxies add X-Forwarded-For, Via or the standard Forwarded header (RFC 7239) with your real address. Proxy lists call proxies that pass your address on “transparent”, ones that only reveal they are a proxy “anonymous”, and ones that add nothing “elite”. Over a CONNECT tunnel the proxy cannot add headers to the encrypted requests, so this mostly affects plain HTTP.
• DNS lookups. With a SOCKS proxy the client may resolve host names itself, through your normal resolver, before connecting. In curl the difference is --socks5 (local lookup) versus --socks5-hostname (the proxy looks it up); in Firefox it is the “Proxy DNS when using SOCKS v5” setting.
• Everything above the network. Cookies, logged-in accounts, browser fingerprinting and WebRTC in browsers identify you regardless of the IP address.
• The proxy operator. Whoever runs the proxy sees which hosts you contact, when and how much — and all content that is not end-to-end encrypted. A free public proxy is a stranger in the middle of your traffic.

A proxy also does not encrypt the hop between you and it unless that hop uses TLS or SSH. An HTTP proxy at http:// carries plain-HTTP requests in the clear across your local network.

Proxy, VPN or reverse proxy?

A proxy is per application and needs no root rights on the client; a VPN moves the whole device, DNS included. If you want everything from a machine to leave through another address, a VPN is the cleaner tool.

How do you use a proxy from the command line?

Most Linux tools read the proxy from environment variables. curl reads http_proxy only in lower case (the upper-case form is ignored for HTTP for security reasons); the other variables work in either case, and lower case wins.

export http_proxy=http://user:pass@proxy.example.net:3128
export https_proxy=http://user:pass@proxy.example.net:3128
export no_proxy=localhost,127.0.0.1,.internal.example.net

curl -x http://proxy.example.net:3128 https://ifconfig.me
curl --socks5-hostname 127.0.0.1:1080 https://ifconfig.me
git config --global http.proxy http://proxy.example.net:3128
pip install --proxy http://proxy.example.net:3128 requests

Acquire::http::Proxy "http://proxy.example.net:3128";
Acquire::https::Proxy "http://proxy.example.net:3128";

https_proxy usually points at an http:// URL: the client talks plain HTTP to the proxy only to send CONNECT, then TLS runs through the tunnel.

How do you run your own proxy server?

Three ways, from least to most setup, on any Linux server you control:

1. An SSH SOCKS proxy — no server software at all. One command on your computer turns an SSH session into a SOCKS5 proxy on a local port:

ssh -D 1080 -N -C user@SERVER_IP
# then point the browser or curl at SOCKS5 127.0.0.1:1080

The connection to the server is SSH-encrypted and nothing new listens on the server’s public interface.

2. Squid as an HTTP proxy, for devices and apps that only speak HTTP proxies. Install it, allow only your own address, and keep the port closed to everyone else:

apt install -y squid
# files in /etc/squid/conf.d/ are read at the line
# "INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS"
cat > /etc/squid/conf.d/allow-me.conf <<'EOF'
acl me src 203.0.113.10/32
http_access allow me
EOF
# Squid listens on port 3128 by default
systemctl restart squid
ufw allow from 203.0.113.10 to any port 3128 proto tcp

Squid evaluates http_access rules top to bottom and the first match wins, so the allow line belongs below the stock denies for unsafe ports and above the final http_access deny all — exactly where that comment and Debian’s conf.d include sit. Put it at the very top instead and it skips those denies for you. On a build without conf.d, add the two lines under the comment in /etc/squid/squid.conf. The stock configuration also refuses CONNECT to ports other than 443 (the SSL_ports ACL), which is why a tunnel to, say, port 8443 fails through Squid until you add the port there. For access from changing addresses, use Squid’s basic authentication instead of an IP allowlist.

3. A SOCKS5 server such as Dante, when several devices need SOCKS without SSH. Configure it with username authentication (RFC 1929) and a firewall rule the same way.

To check what a website sees through your proxy, request an echo service and compare the address and headers with and without it:

curl -x http://SERVER_IP:3128 https://ifconfig.me
curl -x http://SERVER_IP:3128 http://httpbin.org/headers

In a browser set to use the proxy, what is my IP should show the server’s address instead of yours.

Which proxy errors will you meet?

• 407 Proxy Authentication Required — the proxy wants credentials; check the user and password in the proxy URL, and URL-encode special characters.
• 403 or “Access Denied” from Squid — your address is not in an allow rule, or the rule sits below http_access deny all.
• Connection refused on the proxy port — the service is down, listens on another port, or the firewall blocks you; ss -tlnp on the server shows what listens where.
• 502 or 504 from the proxy — the proxy reached out and the target did not answer properly or in time; the problem is behind the proxy, not in front of it.

Running a proxy on a VMHeaven server

VMHeaven’s Acceptable Use Policy lists operating VPNs, proxies and privacy tools for personal use as permitted, on every line. A small Standard KVM plan is plenty for a personal Squid or SOCKS proxy, and every server comes with its own IPv4 address. Keep it closed to everyone but yourself, as above; a proxy shared with the public is a different service with different abuse rules, so ask support first.

Frequently asked