I'm renting a dedicated server which I'd like to use to "surf the Web": basically I want to always surf the Web from the same static IP (the one of my dedicated server).

I can do it by running Xvnc/FreeNX on the dedicated server, but this is kinda slow and clumsy (I tried it).

What are the steps needed to install an "elite/high-anonimity" Web proxy on a dedicated (Debian) Linux server knowing that my two requirements are:

  1. I'm the only person that needs access to the proxy
  2. all I want is that my broadband (dynamic) IP is completely hidden (I want to always surf from my dedicated server's IP).

Note that using the static IP people can find my domains and my real name and I'm perfectly fine with that (actually it is what I want). What I don't want is people knowing from which dynamic IP (broadband) I'm connecting.

What are the steps needed to do that?

(basically I don't care about "anonimity", what I want is to appear to surf from a static IP and I think I need what is called an "elite" Web proxy to do that, but I'm not sure)

Technical infos and sample configuration most welcome :)

  • btw I'm not even sure: is Squid the way to go to do what I want? (if so, how should it be configured?) Apr 4 '10 at 2:06

One option for you is to set up a VPN server such as OpenVPN on your server, then add the appropriate configuration options to redirect all of your traffic via the VPN tunnel when it is enabled. This method is probably the most difficult but offers you the added advantage of having a means to encrypt your traffic by redirecting it over the tunnel if you are surfing from a public wifi hotspot. Another option is to set up a dedicated HTTP proxy such as Squid, which supports authentication to prevent unauthorized users from accessing the server. Probably the simplest option however is to use SSH to set up a socks proxy tunnel. If you are using OS X or Linux as your client, you can easily run a command such as "ssh -N -f -D 8080 user@your.server". This command causes SSH to fork into the background and create a tunnel on port 8080 which you can configure as a SOCKS proxy in your browser. You can also use this method on Windows via Cygwin if you install the openssh packages. As with the OpenVPN option, this method will encrypt the traffic between you and the server making it suitable for connecting from an untrusted location.

  • @Ron: ah damn I can't vote you up because I'm new here :) I do want to use a proxy such as Squid, I don't want to set up a VPN (locations are trusted) (btw it's all Linux/Firefox/Iceweasel, no Windows at all). I'm interested in the socks proxy tunnel: what you mean basically if I understand you right is that I could set up Squid that would only accept local ( connection and then a SSH tunnel so that I'm the only one that could access it? (I've got a SSH tunnel as of now through which I'm tunneling Xvnc, but this is too slow). Apr 4 '10 at 5:39
  • @Ron: if Squid listen on port 3128, can't I do something like: ssh -T -N -x -C -L3128: user@myserver.com ? Wouldn't that also work (I've never used the -D -f args). Apr 4 '10 at 5:54

Answering to myself: I got it working quite easily...

I installed Squid on the dedicated server and modified a few things in squid.conf:


 forwarded_for off

And (the following being suggested in the squid.conf file):

header_access Allow allow all
header_access Authorization allow all
header_access WWW-Authenticate allow all
header_access Proxy-Authorization allow all
header_access Proxy-Authenticate allow all
header_access Cache-Control allow all
header_access Content-Encoding allow all
header_access Content-Length allow all
header_access Content-Type allow all
header_access Date allow all
header_access Expires allow all
header_access Host allow all
header_access If-Modified-Since allow all
header_access Last-Modified allow all
header_access Location allow all
header_access Pragma allow all
header_access Accept allow all
header_access Accept-Charset allow all
header_access Accept-Encoding allow all
header_access Accept-Language allow all
header_access Content-Language allow all
header_access Mime-Version allow all
header_access Retry-After allow all
header_access Title allow all
header_access Connection allow all
header_access Proxy-Connection allow all
header_access All deny all

Then I didn't think about simply using an SSH tunnel (Ron's answer pointed me in that direction), which is perfect in my case (because the firewalls where already configured to allow SSH from my ISP's IP range to my dedicated server etc.).

Then the client side:

ssh -T -N -x -C -L3128: user@example.org

And simply setting up 3128 as the proxy in the browser.


2 options that are easy:

  1. Install squid -- there is probably a package for it. Then configure your web browsers proxy settings to point the the squid server. By default its probably going to be on port 3128.

  2. Install a socks proxy. Then in your proxy setting put the socks server address and port. The nice thing about socks is that it will proxy more than just web traffic. (e,g, Pidgin support SOCKS proxies)

  • @Craig: I ended up installing Squid. However by default it does not do what I want, because the originating IP appears quite clearly. I changed a few settings, set up a SSH tunnel, and got it working :) But I cannot give +1 to everybody because I don't have any +votes yet :( Apr 4 '10 at 7:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.