Proxy server software is a program that turns the computer it runs on into a proxy: other devices send it their requests, and it fetches the pages from its own address. Free ones include Squid, tinyproxy, Privoxy, 3proxy and Dante. On Windows, 3proxy is free, while CCProxy and WinGate are paid with free tiers. Two facts decide whether the result is any use. Sites see the address of the machine the software runs on, so it gives you no new IP. And a server left open to the internet ends up on public proxy lists, where our own count found 341 working entries on the default port of Squid alone.
What is proxy server software?
A proxy server is a program, not a device. It listens on a port, takes requests from its users and makes them on their behalf. Squid calls itself "a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more."
Two kinds of program carry the word proxy, and they do opposite jobs:
- Server software runs the proxy. Squid, tinyproxy, Privoxy, 3proxy and Dante are servers.
- Client software sends other programs through a proxy that already exists. Proxifier and proxychains-ng are clients.
A reverse proxy is a third thing: a server that stands in front of websites rather than in front of users. Our forward vs reverse proxy explainer shows the difference. This page is about forward proxies, the kind that fetches pages for the people who use it.
The free proxy server programs, compared
Each program below is free, and the ports come from the pages of each project:
Free proxy server programs and their default ports
| Program | Default port | Speaks |
|---|---|---|
| Squid | 3128 | HTTP, HTTPS, FTP |
| tinyproxy | 8888 | HTTP, HTTPS |
| Privoxy | 8118 | Web, with filters |
| 3proxy | 3128, 1080 | HTTP, SOCKS 4/5 |
| Dante | 1080 | SOCKS |
The site, documentation and default configuration of each project, read 26 September 2026. The Dante port is the one in its example configuration.
Squid is the large one: a caching proxy with detailed access rules. Its site says it "runs on most available operating systems, including Windows and is licensed under the GNU GPL." It listens on port 3128, and its default configuration "only allows localhost requests". It serves nobody else until you add a rule for your own network.
Tinyproxy is the small one, "a light-weight HTTP/HTTPS proxy daemon for POSIX operating systems", which means Linux and similar systems, under the GNU GPL version 2 or later. Its default file listens on port 8888 and allows only 127.0.0.1 and ::1.
Privoxy is a filter first: "a non-caching web proxy with advanced filtering capabilities", under the GNU GPLv2 or later. By default it listens only on 127.0.0.1, port 8118. Its manual recommends that for "home users who run Privoxy on the same machine as their browser."
3proxy does the most in one download: HTTP on port 3128, SOCKS 4 and 5 on port 1080, and several other services. Its licence calls it freeware under a BSD-style licence. Version 1.0.0 came out on 22 August 2026, with Windows zip files and deb and rpm packages for Linux.
Dante does one job. It is "a free SOCKS server" that implements RFC 1928, under a BSD/CMU-type licence, and its example configuration listens on port 1080.
Proxy server software for Windows
These four run a proxy server on Windows, two free and two paid:
- 3proxy is free. Its release carries Windows builds, and the README shows how to "Install and start proxy as Windows service".
- Squid is free, and its site says it runs on Windows.
- CCProxy serves HTTP, SOCKS, FTP, mail and more. Its page says it "provides 3-user free version of proxy server", but the Windows versions it lists end at Windows 7 and Windows Server 2008.
- WinGate is an HTTP proxy and SOCKS server, "FREE for 10 users", at version 9.4.11 of 23 September 2026.
Some lists of "free proxy software for Windows" mix these with apps that connect you to servers someone else runs, such as tools for getting past censorship. Those apps are clients of a service, not a server of your own.
SOCKS5 server software
Three free programs serve SOCKS5:
- Dante, the dedicated SOCKS server.
- 3proxy, whose SOCKS server "binds to port 1080".
- OpenSSH, if you can log in to a server over SSH. With
ssh -D, "ssh will act as a SOCKS server" on your own computer, and each connection is then made from the server you logged in to.
Port 1080 is the usual choice, because RFC 1928 says the SOCKS service "is conventionally located on TCP port 1080." What the protocol does is in our SOCKS5 explainer.
Proxy client software
Client software does the opposite job: it sends programs that have no proxy setting of their own through a proxy you already have.
- proxychains-ng runs on Linux, BSD and Mac. It "hooks network-related libc functions", so the connections of another program go through SOCKS or HTTP proxies. Our ProxyChains guide shows it step by step.
- Proxifier is paid, with a 31-day trial, for Windows and macOS. It "allows network applications that do not support working through proxy servers to operate through a SOCKS or HTTPS proxy and chains."
What proxy server software cannot do
It cannot give you a new address. Sites see the address of the machine the software runs on. On your own computer, that is your own address, so the proxy hides nothing from the sites you open. On a rented server, it is the address of that server, in one data centre. Squid states it plainly: "Address selection is performed by the operating system." Its tcp_outgoing_address setting can choose between addresses, but only among the ones the machine already has.
With its default settings, Squid even tells each site who you are. Its documentation lists the default as "forwarded_for on", and in that state Squid adds the address of each user to the requests it forwards, in an X-Forwarded-For header. Setting it to delete removes that header entirely.
Lock it down, or it ends up on public lists
An open proxy is one that anyone on the internet can use, and public proxy lists are full of them. We counted the working entries in our free proxy pool by port on 26 September 2026, at 23:46 UTC. Of 13,909 working entries, 341 answered on port 3128, the default of Squid and of the HTTP side of 3proxy. The four defaults on this page, 3128, 8888, 8118 and 1080, held 778 entries together.
On port 3128, 44.8% of the HTTP entries were transparent: the site at the other end saw the address of the person using the proxy. Across all ports, it was 11.6%. A port does not prove which program answers on it, but the gap fits the Squid default above.
None of these programs ships open. Squid allows only the machine itself, tinyproxy allows only 127.0.0.1 and ::1, and Privoxy listens only on 127.0.0.1. With these programs, an open proxy comes from an edit. Tinyproxy is the sharpest case: once no Allow or Deny line is left in its file, "the default action is ALLOW." A 3proxy build from its Linux Makefile listens on all addresses, and it asks for a login, with no users set up.
Three rules keep a server of your own closed to strangers:
- Allow only your own network, never every address.
- Require a login, or bind the proxy to 127.0.0.1 when only the same machine uses it.
- On Squid, set forwarded_for to delete if the people using it should stay private.
Our open proxy list explainer covers the other side: what happens to people who use such servers.
Searching for a Free Fire proxy server?
Many "proxy server download" searches ask for an Android app, often for the game Free Fire. What those players want, such as the Advance Server, another region or less lag, is not one of the programs on this page. Our Free Fire proxy server guide explains what each of those really is, and why the APKs offered as a fix are a risk.
When you need other addresses
A server of your own gives you one address. When you need addresses in other countries, HProxy residential proxies start at $0.44 per GB on Residential Lite, which targets by country.
How we checked
We read the site, documentation and default configuration of each program on 26 September 2026. We installed none of them, because we do not run third-party code on our machines. The port counts come from one read-only query on our free proxy pool, counted per port with no addresses. Transparent means the test server of our checker saw the address of the checker itself, either as the connecting address or inside a forwarding header such as X-Forwarded-For.
Sources
- The Squid project: home page, and the configuration reference for http_port, http_access, forwarded_for and tcp_outgoing_address.
- Tinyproxy: home page and the default configuration file.
- Privoxy: home page and the user manual, listen-address.
- 3proxy on GitHub: README, licence and release 1.0.0.
- Inferno Nettverk: Dante and its server configuration.
- IETF, RFC 1928: SOCKS Protocol Version 5, March 1996.
- OpenBSD, ssh(1) manual page, option -D.
- proxychains-ng README, version 4.17.
- The home pages of Proxifier, CCProxy and WinGate, read 26 September 2026.
