Port 3128: Squid proxy

What uses port 3128

Squid, the most common open source caching proxy, listens on 3128. Corporate networks use it to filter and cache web traffic, and developers use it to give isolated machines internet access. Clients point HTTP_PROXY and HTTPS_PROXY at http://proxy:3128.

Should port 3128 be open to the internet?

Keep private. Never expose this port to the internet. Keep it on localhost, a private network or behind a VPN or SSH tunnel.

• Restrict Squid with http_access rules to your own networks; an open proxy is abused within days.

Check what is listening on port 3128

sudo ss -ltnp 'sport = :3128'

sudo lsof -nP -iTCP:3128 -sTCP:LISTEN

Get-NetTCPConnection -LocalPort 3128 -State Listen
netstat -ano | findstr :3128

No output means nothing is listening. If a service should be, check that it is running and which address it binds to: 127.0.0.1 only accepts local connections, 0.0.0.0 or :: accepts them on every interface.

Fix “address already in use” on port 3128

Another process already holds the port. Find it with the commands above, then stop that service properly, or end the process:

sudo kill $(sudo lsof -t -iTCP:3128 -sTCP:LISTEN)

Stop-Process -Id (Get-NetTCPConnection -LocalPort 3128 -State Listen).OwningProcess

Allow port 3128 from trusted networks only

The examples allow 3128 only from 10.0.0.0/8; replace it with your own private network, office IP or VPN range.

sudo ufw allow from 10.0.0.0/8 to any port 3128 proto tcp
# Close it again:
sudo ufw delete allow from 10.0.0.0/8 to any port 3128 proto tcp

sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.0.0/8" port port="3128" protocol="tcp" accept'
sudo firewall-cmd --reload

New-NetFirewallRule -DisplayName "Squid proxy 3128/TCP" -Direction Inbound -Protocol TCP -LocalPort 3128 -Action Allow -RemoteAddress 10.0.0.0/8

On AWS, Google Cloud and Azure, also allow the port in the security group or network firewall rules; host firewalls and cloud firewalls are separate.

Port 3128 with Docker

# Publish on localhost only. Docker's port rules bypass ufw and firewalld,
# so -p 3128:3128 would expose the port to the whole network.
docker run -d -p 127.0.0.1:3128:3128 ubuntu/squid

The format is -p host_port:container_port. Containers on the same Docker network reach each other on the container port directly, without publishing it. Convert a long docker run command into a Compose file with docker run to compose.

Test port 3128 from another machine

nc -zv example.com 3128

Test-NetConnection example.com -Port 3128

Related ports

• Port 8080 (HTTP alternate): the most common alternate HTTP port, used by proxies, app servers and dev tools.
• Port 1080 (SOCKS proxy): the conventional port for SOCKS proxies.
• Port 80 (HTTP): the default port for HTTP, unencrypted web traffic.

More network services ports

53 (DNS) , 67 (DHCP server) , 68 (DHCP client) , 88 (Kerberos) , 123 (NTP) , 135 (Microsoft RPC) , 137 (NetBIOS Name Service) , 179 (BGP) . See all ports in the port lookup.

Sources

• IANA port registry: 3128

Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.

Frequently asked questions