Squid Proxy Server - Caching Forward Proxy, Web Filter & Gateway

Squid Proxy Server is a production-ready, caching forward and reverse proxy for the web, supporting HTTP, HTTPS, FTP, and more. It reduces bandwidth usage and improves response times by caching and reusing frequently requested content, while providing powerful access controls that make it an ideal secure web gateway, content filter, and outbound internet proxy for your AWS workloads.

Squid is trusted by thousands of organizations worldwide as part of the open-source Squid project community, which has been actively maintained for over two decades.

• Domain-level filtering and user authentication - Gain granular control with advanced access controls, user authentication, and content filtering beyond basic outbound connectivity.
• Cost efficiency at scale - Reduce data egress costs through intelligent caching of repeated requests.
• Pre-hardened and preconfigured - Eliminate hours of manual setup with sensible security defaults, optimized caching configuration, and ready-to-use ACL templates.

• Outbound internet control for private subnets - Give EC2 instances in a private VPC controlled, audited internet access without exposing them directly to the internet.
• Web content filtering - Block or allow websites, domains, and content types to enforce compliance and acceptable-use policies.
• Bandwidth saving and acceleration - Cache static and dynamic content to reduce data egress costs and latency.
• Reverse proxy / server accelerator - Offload and accelerate origin web servers.
• User authentication and auditing - Require LDAP, Active Directory, RADIUS, or POP3 login and log all access for visibility and reporting.

Caching and Performance

• Cache frequently accessed websites, files, media, and dynamic content
• DNS lookup caching
• Load balancing with other Squid proxies
• SMP CARP clustering for scale and high availability

Access Control and Content Filtering

• ACL-based rules for networks, domains, IP ranges, MIME types, and time-of-day
• Block or allow instant messaging, coin-mining, and torrents
• Webwasher integration for virus filtering and adult content blocking

Authentication

• User authentication via LDAP, Active Directory, RADIUS, POP3, database, and more

Transparent and Intercepting Proxy

• Traffic interception with WCCPv2 and TPROXYv2
• Multiple interception ports, NAT on private networks
• Adaptation protocol support (C-ICAP / eCAP) and PHP redirectors

Security and Privacy

• Hide users' internal IP addresses from external servers
• SSL/TLS interception and caching of HTTPS requests
• Hardened CentOS Stream 9 base with unnecessary services disabled

• Operating System: CentOS Stream 9, preconfigured and hardened
• Minimum Instance: t3.small (2 vCPU, 2 GB RAM) for light workloads up to 50 concurrent users
• Recommended Instance: t3.medium or m5.large for production workloads with 200+ concurrent users
• Disk: Minimum 20 GB root volume; allocate additional EBS storage proportional to desired cache size (e.g., 50-100 GB for active caching)
• Ports: Default proxy on port 3128 (configurable); SSH on port 22
• Networking: Place in a public or private subnet depending on architecture; configure security groups to allow inbound on port 3128 from your VPC CIDR

This AMI is built on CentOS Stream 9 with the following hardening measures applied:

• Unnecessary services and packages removed
• Firewall rules configured to restrict access to essential ports only
• SSH hardened with key-based authentication (password auth disabled)
• Regular security patches applied at build time

1. Launch the AMI from AWS Marketplace and select your instance type
2. Configure your security group to allow inbound TCP 3128 from your VPC
3. SSH into the instance and edit /etc/squid/squid.conf to define your ACLs
4. Restart Squid and configure your clients or route tables to use the proxy
5. Verify connectivity and review access logs at /var/log/squid/access.log

Full post deployment setup guide is below under vendor resources.