Port reference
Port 3128 (TCP) – Squid HTTP Proxy
Default listening port for the Squid caching/forwarding HTTP proxy.
Quick facts
- Transport
- tcp
- Category
- Registered
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
Open on hosts running Squid. Often bound to all interfaces and left as an open proxy when ACLs are misconfigured.
What is port 3128 used for?
Port 3128 is the default listening port for Squid, a widely used caching and forwarding HTTP/HTTPS proxy. Organizations and home users point their browsers or devices at Squid so it fetches web pages on their behalf, caching content to save bandwidth, filtering or logging outbound traffic, and centralizing internet access. Some other proxy and content-filter products reuse 3128 as well.
When would you open it?
You open 3128 on the machine running Squid so the clients meant to use it can connect. In nearly all cases you allow it only to your own internal network — the devices behind the proxy — rather than to the public internet.
Is it safe to open?
A proxy open to the internet becomes an "open proxy" that strangers can relay traffic through, and can be tricked into reaching internal systems. Keep it on internal interfaces, deny by default in the ACLs, and require proxy authentication. See the security notes below.
How to check if this port is open
ss -tulpn | grep :3128
nmap -p 3128 <target>netstat -ano | findstr :3128
Test-NetConnection <host> -Port 3128lsof -i :3128
nmap -p 3128 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 3128 to your device's local IP, internal port 3128, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 3128/tcpsudo firewall-cmd --permanent --add-port=3128/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 3128 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 3128" -Direction Inbound -Protocol TCP -LocalPort 3128 -Action AllowSecurity & risks
Common attacks
- Open-proxy abuse to relay traffic, spam, and anonymize attacks
- Internal SSRF and pivoting to reach intranet-only services
- Scanning for proxies to bypass egress filtering and IP allowlists
- Exploiting unpatched Squid parsing/RCE bugs
Hardening
- Bind Squid to internal interfaces only; never expose 3128 to the internet
- Enforce strict http_access ACLs and deny by default
- Require proxy authentication for outbound use
- Restrict reachable destinations to block SSRF/pivoting
- Keep Squid patched against parsing and RCE vulnerabilities
How to block this port
sudo ufw deny 3128/tcpsudo firewall-cmd --permanent --remove-port=3128/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 3128 -j DROPNew-NetFirewallRule -DisplayName "Block 3128" -Direction Inbound -Protocol TCP -LocalPort 3128 -Action Blocknmap snippet
nmap -p3128 --script http-open-proxy <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- What is an open proxy on port 3128?
- A Squid proxy with permissive ACLs that forwards requests for anyone. Attackers use it to anonymize traffic, bypass IP allowlists, and reach internal services.
- How is Squid different from a SOCKS proxy on 1080?
- Squid on 3128 is an HTTP/HTTPS forwarding proxy with caching and ACLs. SOCKS on 1080 is a lower-level, protocol-agnostic relay. Both are abused as open proxies when unauthenticated.