Port 3128 – Squid Proxy

TCP

Port 3128 is the default Squid HTTP proxy port. Squid provides caching, access control, and content filtering for outbound web traffic. Open proxies on port 3128 are abused for anonymization and spam – always configure authentication and ACLs. Squid also supports HTTPS interception (SSL bump) for TLS traffic inspection.

Port Number

3128

Protocol

TCP

Service

Squid HTTP Proxy

Range

IANA Registered (1024–49151)

Description

Squid on port 3128 is the most widely deployed HTTP caching proxy. It sits between clients and the internet, caching frequently accessed content, enforcing access policies, and logging web activity. Squid supports HTTP, HTTPS (via CONNECT), FTP, and HTTPS interception (SSL bump with dynamic certificate generation). A misconfigured Squid on port 3128 that allows unrestricted access becomes an open proxy – attackers route traffic through it to hide their origin. Configure http_access rules to restrict to internal networks, require authentication for external access, and use ssl_bump carefully (it breaks certificate pinning and may violate privacy regulations). Monitor cache hit ratios – a proxy with no cache hits is just adding latency.

Security risks

1CVE-2023-46846: Squid HTTP request smuggling – allows cache poisoning and bypassing access controls via crafted Content-Length / Transfer-Encoding headers (CVSS 9.3)
2CVE-2023-46847: Squid buffer overflow in HTTP Digest auth – unauthenticated RCE via crafted Digest authentication headers (CVSS 9.8)
3Open proxy abuse: misconfigured Squid without ACLs becomes an open proxy within hours – used for spam, credential stuffing, ad fraud, and anonymizing attacks. Your IP ends up on blacklists
4HTTPS interception (SSL bump): Squid's ssl_bump feature generates certificates on-the-fly, breaking end-to-end encryption. If the CA cert leaks, attacker can MITM all proxied traffic
5Cache poisoning: attacker sends crafted responses that get cached by Squid, serving malicious content to subsequent users requesting the same URL

Firewall guidance

NEVER allow port 3128 connections from the internet – it will become an open proxy. In squid.conf: restrict via http_access allow localnet (define localnet as your internal CIDR only). For outbound-only proxies: bind to internal interface (http_port 10.0.0.1:3128). For transparent proxying: use port 3129 with iptables REDIRECT, still restrict source IPs.

Diagnosis commands

Test proxy connectivity (shows the proxy's external IP)

shell

curl -x http://proxy:3128 http://ifconfig.me

Squid cache statistics (hit rate, memory usage)

shell

squidclient -h localhost -p 3128 mgr:utilization

Audit Squid access control rules

shell

grep -v '^#' /etc/squid/squid.conf | grep -v '^$' | grep 'http_access'

Watch blocked requests in real-time

shell

tail -f /var/log/squid/access.log | grep DENIED

Usage examples

Port 3128 – Squid Proxy

shell

export http_proxy=http://proxy:3128
curl -x http://proxy:3128 http://example.com
squidclient -h proxy -p 3128 mgr:info

Common services on this port

SquidPrivoxytinyproxyApache Traffic ServerVarnish (caching, different purpose)

Related ports

3128

Squid HTTP proxy (this port)

3129

Squid intercept (transparent mode)

8080

HTTP proxy alternate

1080

SOCKS proxy

History

Squid was created in 1996 as a fork of the CERN httpd caching proxy, funded by the NSF (National Science Foundation) to reduce internet bandwidth usage. Port 3128 became the conventional default (not IANA-registered). Squid dominated web caching through the dial-up and early broadband era. Today it's used for: corporate web filtering, SSL inspection, content caching at ISPs, and as a forward proxy for containerized applications needing controlled internet access.

FAQ

How do I prevent my Squid from becoming an open proxy?

In squid.conf: (1) Define allowed networks: acl localnet src 10.0.0.0/8 192.168.0.0/16. (2) Allow only those: http_access allow localnet, http_access deny all (deny MUST be last). (3) Bind to internal interface only: http_port 10.0.0.1:3128. (4) Test from external IP: curl -x http://your-ip:3128 http://example.com should get 403. (5) Monitor: check access.log for unexpected source IPs.

Squid vs nginx reverse proxy vs Varnish?

Squid: forward proxy (clients → internet), web filtering, SSL bump inspection, bandwidth management. Best for: corporate egress control. nginx: reverse proxy (internet → your servers), load balancing, TLS termination, static content serving. Best for: application delivery. Varnish: HTTP accelerator (caching layer in front of app servers), VCL configuration language. Best for: high-traffic website caching. They serve different architectural positions.

Specification

RFC 7230 – Port 3128 specification →