Squid Proxy Server with Web Filtering & Management Software | CloudInfra
CloudInfra Proxy Manager
Enterprise Squid Proxy Management Made Simple
Deploy a production-ready Squid Proxy Server with a modern web dashboard for access control, URL filtering, traffic monitoring, reporting, caching, health monitoring and configuration management.
Squid Proxy Server Management Made Simple
Deploy a self-hosted Squid proxy server on Azure, AWS and Google Cloud with a full management console. Filter and block websites, control outbound internet access, authenticate users against Active Directory or LDAP, cache repeated downloads, and see every request your network makes – with configuration changes that validate before they deploy and roll back automatically if they fail. Everything runs inside your own cloud account. No traffic data ever leaves your network.
Deploy On Azure
Coming soon..
Deploy On AWS
Deploy Squid Proxy on Ubuntu on AWS
Deploy On GCP
Coming soon..
CloudInfra Proxy Manager - Powered by Squid Proxy Server
Full Web Interface Dashboard to Manage Self Hosted Squid Proxy
Squid is the forward proxy that carries a large share of the internet’s outbound traffic. It is free, fast and extremely capable, and it gives you a configuration file, a log file and nothing else. Teams running it usually end up with a proxy nobody wants to touch and traffic nobody can account for.
CloudInfra Proxy Manager adds the management layer Squid never had:
- Web filtering and URL filtering — allow or block websites by domain, for HTTP and HTTPS
- Access control by client, network, user or group
- Live traffic monitoring and searchable request history
- Rule attribution — every blocked request names the rule that blocked it
- Proxy authentication against Active Directory, Entra Domain Services or OpenLDAP
- Web caching with a measured hit rate, not a guess
- Validated deployment with automatic rollback
- Configuration history, diff and one-click restore
- Health monitoring, audit trail, backup and restore
Common Use Cases for a Cloud Proxy Server
Centralised egress control
Give instances in private subnets controlled internet access through one auditable point, instead of an unrestricted NAT gateway.
Block websites by category
Stop access to social media, file sharing, streaming, webmail or unapproved SaaS - by domain, for HTTP and HTTPS alike.
Allowlist-only outbound access
Permit a short, explicit list of destinations and deny everything else. Common in PCI DSS, ISO 27001 and other regulated environments.
Evidence for auditors
Answer "what did that server reach, and when" with a searchable record rather than a shrug. Every configuration change is attributed too.
Server patching and package caching
Cache operating system updates and package repository downloads once and serve them to the whole fleet, cutting repeated egress.
Microsoft 365 traffic
Allow Microsoft 365 endpoints using Microsoft's own published feed, refreshed automatically as those endpoints change.
Staff and contractor browsing
Authenticate users against your directory so rules name people and groups, and the traffic record shows who made each request.
Third-party and vendor networks
Give a partner network tightly scoped outbound access without giving it a route to everything.
Bandwidth and cost visibility
See which clients and destinations consume your egress, then decide what to block, cache or leave alone.
Replacing an unmanaged Squid box
Already running Squid on a VM somebody built years ago? This is the same engine with policy, visibility and a safety net.
Fixed egress IP for allowlisting
Route outbound traffic through one appliance so partners and SaaS providers can allowlist a stable, known address.
Air-gapped and restricted subnets
Instances with no internet route of their own reach only what policy permits, through the proxy.
CloudInfra Proxy Manager for Squid Features
Web Filtering and Access Control
Access rules are written in the console and compiled into valid Squid configuration. You never edit ACL syntax, and you never guess at rule order.
What you can match on:
- Destination domain — a single site, or a domain and all its subdomains
- Domain lists — reusable named sets, referenced from as many rules as you like
- Destination network — CIDR ranges and addresses, IPv4 and IPv6
- Source client — a single address, a range, or a named network group
- Signed-in user or directory group, once authentication is enabled
- Allow or deny, evaluated top to bottom with the order shown on screen
Rules you can read before you deploy them
The review step shows a sentence, not a configuration fragment: “Allow clients in 10.20.0.0/16 to reach Microsoft 365 at all times.” That is how you catch a rule that does the opposite of what you intended, before it reaches the proxy.
Unreachable rules are detected for you
Squid evaluates rules top to bottom and stops at the first match, so a broad rule silently makes any narrower rule below it dead, and Squid will not warn you, because the configuration is perfectly valid. It just does not do what you drew on screen.
Because the console owns the policy model rather than parsing a config file, it can prove when one rule covers another and tell you which of your rules can never fire. The analysis is deliberately conservative: it reports shadowing only when containment is provable, because a false warning on an access-control screen teaches people to ignore it.
Squid Traffic Monitoring, Reporting and Analytics
Live traffic, including connections still open
Squid writes its log entry when a transaction finishes, so an HTTPS tunnel held open for forty minutes appears once, forty minutes late. Live Traffic merges the log with in-flight connections read from Squid’s own Cache Manager, so you see what is happening now – not what finished.
What the dashboard reports
- Requests, bandwidth, blocked requests and active connections
- Traffic over time, with a breakdown by result
- Top destinations and top clients, by requests and by bytes
- Recent blocked requests, each naming the rule responsible
- Cache hit rate, calculated over cacheable requests only — not diluted by encrypted tunnels that could never have been cached
Search, filter and inspect
Search the history by client, destination or URL, filter to blocked requests only, and open any request to see the full detail – timing, bytes, result code, user, and the rule that decided it.
History that goes back far enough to be useful
Raw request records are kept for three days, per-minute rollups for a week and hourly rollups for ninety days, all adjustable. That is enough to answer “what changed last month” without storing every URL your users visited for a year.
Your existing tooling still works
Squid’s native access log is written alongside the structured one, so SIEM forwarders, log shippers and runbooks that already parse it are unaffected.
Web Caching and Bandwidth
Squid is a caching proxy, and the cache is fully configurable from the console: enable or disable it, set the cache size on disk, the memory cache, and the maximum object size.
Be realistic about what caching gives you on the modern web. Encrypted responses cannot be cached by any proxy that is not decrypting traffic, so general HTTPS browsing sees little benefit. Where caching still pays is repetition, and cloud fleets are full of it:
- Operating system updates and package repositories — fifty instances pulling the same packages fetch them once
- Container and image layers served over plain HTTP
- Software distribution and agent installers rolled out across a fleet
- Repeatedly fetched static assets in build and CI environments
The console reports the hit rate over cacheable requests, so you can see whether it is helping you rather than assuming it is. If it is not, turn it off.
Squid Proxy Authentication and Identity
By default the proxy identifies clients by address. Turn on authentication and it identifies people.
- Active Directory, on-premises or anything sharing its schema
- Microsoft Entra Domain Services — the supported path for Microsoft 365 identities, since Entra ID itself exposes no LDAP endpoint
- OpenLDAP and derivatives
- Group-based rules, with membership cached so your domain controllers are not queried per request
- Usernames recorded in the traffic log, so reports show who rather than which IP address
TLS is on by default and the port decides how: 636 is encrypted from the first byte, while 389 upgrades through StartTLS and fails rather than quietly falling back to clear text.
Configuration Changes That Cannot Break the Proxy
The failure mode of a hand-edited squid.conf is a typo, a dead proxy and a support call. This is the part that makes that structurally unlikely.
Validate. The generated configuration is parsed before anything on disk is touched. An invalid configuration never replaces a working one.
Snapshot. The running configuration is kept, version by version.
Install and reload without dropping established connections.
Prove it. A real request is put through the proxy to confirm it is serving.
Roll back automatically if it is not — restoring the previous configuration without being asked.
Configuration history and diff
Every version is kept with who applied it and whether it succeeded. Compare any version with the one before it and see the difference in policy terms – which rules were added, changed or removed – rather than as a diff of a config file. Restore any earlier version in one action.
Backup and restore
Export the whole policy — rules, lists and settings — and restore it onto another appliance or after a rebuild.
Nothing is applied until you say so
Changes are staged. The console shows exactly what is pending and what it will do, and the proxy carries on unaffected until you apply.
Squid Proxy Health Monitoring and Operations
- Explainable health checks — not a green tick, but what was found and what it costs you
- Proxy service, listener, configuration validity and the result of the last change
- Cache directory writability, disk and memory pressure, DNS and routing
- Log rotation, clock synchronisation and pending security updates
- Log viewer in the console — read the access and cache logs without an SSH session
- Audit trail of every administrative action, and a login history including failed attempts
CloudInfra Proxy Manager Security and Architecture
Your traffic data never leaves your cloud account
Request history is stored on the appliance’s own disk inside your VPC or VNet. There is no CloudInfra service behind this product — nothing phones home, and there is no account to create. That is a real difference from a cloud-hosted secure web gateway, where your organisation’s browsing history sits in somebody else’s datastore under their retention policy.
The console does not run as root
The web interface runs as an unprivileged account. Everything privileged goes through a separate helper that accepts a small, fixed set of instructions — so a flaw in the web layer stays in the web layer rather than becoming control of the machine.
Every appliance is unique from first boot
The TLS certificate and the administrator password are generated on your instance the first time it starts, and the password must be changed at first sign-in. Nothing is baked into the image and shared between customers.
Manage certificates from the console
Both certificates an appliance needs are handled here rather than over SSH. Upload your own certificate for the console and the browser warning goes away: the pair is checked before anything is written, takes effect on the next connection without a restart, and if it fails to load the previous one is put straight back. The certificate authority behind your directory is installed the same way, which is what lets authentication work over LDAPS against an internal CA.
Hardened by default
The console is HTTPS-only with modern password hashing, CSRF protection, session controls, rate limiting and account lockout. The proxy ships closed to the internet and open only to private address space, which you narrow to your own networks from the console.
The Full Squid Engine, Not a Cut-Down Build
The console manages the settings most people need. Underneath is a complete Squid 7 build compiled from source, and a customer override file the console never overwrites, so anything Squid can do, you can still do by hand, and it survives every update.
Compiled in and available:
- Authentication helpers — LDAP, Active Directory, RADIUS, NCSA password files, PAM, SASL, POP3, Kerberos and Negotiate
- External ACL helpers — LDAP groups, Kerberos LDAP groups, Unix groups, session tracking, time quotas, SQL sessions, user-IP mapping
- Cache stores — UFS, AUFS and Rock, with LRU and heap replacement policies
- Delay pools for bandwidth throttling
- Cache digests and HTCP for peering with other caches
- ZPH / QoS marking, EUI address matching, and large file support
- OpenSSL and the certificate generator, plus Linux netfilter support
- URL rewrite and StoreID helper interfaces
The generated squid.conf is ordinary, readable Squid configuration. You can open it, understand it, and take it elsewhere. There is no lock-in.
FAQ
| Question | Answer |
|---|---|
| Does it proxy HTTPS traffic? | Yes — out of the box, on the same port as HTTP. Nothing to configure. |
| Can it block HTTPS websites? | Yes, by domain. Blocking facebook.com blocks it over HTTPS as well as HTTP. |
| Can it block one page or path on an HTTPS site? | No. The path is inside the encrypted session and never reaches any proxy that is not decrypting traffic. |
| Does it do SSL inspection / HTTPS decryption? | No. That means installing a certificate authority on every device and breaks applications that pin certificates. We have chosen not to. |
| Can it block ChatGPT and other AI tools? | Yes — add the domains to a list and write one rule, the same as any other site. Ready-made starter lists you can add and then edit yourself are on the roadmap. |
| Will that block Copilot in Microsoft 365? | Not by default. Copilot lives inside the Microsoft 365 endpoints most customers allowlist, so blocking it and allowing Microsoft 365 are contradictory. The console flags rules that cancel each other out. |
| Can I require users to sign in? | Yes — Active Directory, Entra Domain Services or OpenLDAP, with rules naming users and groups. |
| Does it work with Microsoft 365? | Yes — Microsoft's published endpoint list is fetched and kept current automatically. |
| Does it support IPv6? | Yes, for clients and destinations. |
| Does it cache? | Yes, and reports the hit rate over cacheable requests. Expect the benefit on repeated downloads rather than general HTTPS browsing. |
| Can I run several for high availability? | Partly. Several work behind a network load balancer, but each is configured separately — central multi-appliance management is not here yet. |
| Does it work as a transparent proxy? | No. Clients are pointed at it explicitly, by Group Policy, PAC file or environment variable. |
| Is it a full secure web gateway? | No. No malware scanning, data-loss prevention or commercial URL category feeds. |
| Can I still edit Squid configuration by hand? | Yes — there is a customer override file the console never overwrites. |
| Does any traffic data leave my network? | No. There is no service behind it. Nothing phones home. |
| Which clouds is it available on? | Azure, AWS and Google Cloud, from each marketplace. |
Documentation & Support
Full documentation is public before you buy. Setup, client configuration for Windows, macOS and Linux, per-cloud networking, authentication, troubleshooting and the limitations above are all published at proxydocs.cloudinfrastructureservices.co.uk.
