Base
Hardened build
minimal ports, security patches applied at build time
Squid + E2guardian Filtering Proxy
Azure
Networking
1 variation
a filtered, caching forward web proxy in one appliance: e2guardian applies url, domain and content policy and returns a block page, while squid caches upstream to cut bandwidth, with a fail closed source allowlist so it is never an open relay
Variations
This product is available in the build below. Open it for the operating system, cloud and version detail, or read its deployment guide.
| Product | Cloud | Operating system | Version | |
|---|---|---|---|---|
| Squid + E2guardian Filtering Proxy | Azure | — | Standard | View · Guide |
Overview
This appliance pairs two mature open source proxies on a single machine to give you a filtered and caching forward web proxy. E2guardian is the content filtering engine: it sits between your users and the internet and applies url, domain, file type and weighted phrase policy to every request, returning a clear block page when a request is refused rather than failing silently. Squid sits behind it as the caching upstream, storing frequently requested content to cut bandwidth and latency. E2guardian is the only client facing listener and it forwards every request to Squid, which fetches from origin or serves from its cache, so one deployment both governs and accelerates outbound browsing and writes a structured access log of every transaction.
It suits schools, managed networks and regulated environments that need outbound browsing to be governed, auditable and cache accelerated inside their own private network, without deploying and hardening two separate proxies.
Why the cloudimg image
cloudimg ships the whole chain assembled, wired and proven, so a filtered caching proxy answers within a minute or two of launch with nothing to compile or configure. Security is designed in for a service that is dangerous when exposed: the client facing port accepts connections only from loopback and private client networks, every other source is dropped, and the filtering service will not start at all if that allowlist cannot be applied or if its caching upstream is unavailable, so the appliance fails closed rather than becoming an open relay. Squid is bound to the loopback interface only, so it is never reachable off the machine. The appliance performs no TLS interception, so no certificate authority key exists in the image or on your instance and there is no shared interception authority to leak. There is no product login and no bootstrap password, so nothing is baked in to leak; administration is over your own key based SSH. A self demonstrating policy ships enabled so you can prove filtering and caching work on your own instance with one command. The base is fully patched with unattended security updates enabled, and every image comes with a step by step deploy guide tested against the exact build and 24/7 cloudimg support.
Common uses
- A governed, auditable outbound web gateway for a school or managed network
- Content filtering plus bandwidth saving cache in one self hosted appliance
- Enforcing and logging acceptable use policy inside your own private network
More in Networking
3P
3proxy
Networking
a tiny, feature rich proxy server with per instance authentication built in
3U
3X-UI
Networking
web management panel for the xray proxy, packaged by cloudimg
Ap
accel-ppp
Networking
a high performance PPP and VPN server, terminating SSTP and L2TP sessions with per session authentication the moment it
AdGuard
Networking
AdGuard Home, a network wide DNS ad and tracker blocker, hardened and ready on Ubuntu 24.04.
AdGuard Home + Unbound
Networking
AdGuard Home paired with a private Unbound resolver: network wide ad and tracker blocking with recursive, DNSSEC validat
Akvorado
Networking
akvorado, an open source network flow collector and visualizer that ingests NetFlow, IPFIX and sFlow, enriches it and ma