---
title: Using a Squid proxy
description: >-
  Set up Squid as a forward proxy to route Datadog Agent traffic through an
  HTTP/HTTPS proxy server when direct internet access is limited.
breadcrumbs: Docs > Agent > Agent Configuration > Using a Squid proxy
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Using a Squid proxy

[Squid](http://www.squid-cache.org/) is a forward proxy for the web supporting HTTP, HTTPS, FTP, and more. It runs on most available operating systems, including Windows, and is licensed under the GNU GPL license. Squid is a straightforward option if you do not already have a running web proxy in your network. **If you already have an existing proxy server, you do not need to use Squid.** Instead, follow the instructions in [Agent Proxy Configuration](https://docs.datadoghq.com/agent/configuration/proxy.md).

## Proxy forwarding with Squid{% #proxy-forwarding-with-squid %}

To configure Squid to send traffic to Datadog, follow the instructions below to configure Squid, start the squid service, and then configure and restart the Datadog Agent.

### Configure Squid to only send traffic to Datadog{% #configure-squid-to-only-send-traffic-to-datadog %}

Install Squid on a host that has connectivity to both your internal Agents and Datadog. Use your operating system's package manager, or install the software directly from [Squid's project page](http://www.squid-cache.org/).

To configure Squid, edit the configuration file. This file is usually located at `/etc/squid/squid.conf` on Linux or `C:\squid\etc\squid.conf` in Windows. For other operating systems, see [Agent configuration directory](https://docs.datadoghq.com/agent/configuration/agent-configuration-files.md#agent-configuration-directory).

Edit your `squid.conf` configuration file so that Squid is able to accept local traffic and forward it to the necessary Datadog intakes.

The simplest approach uses a wildcard to allow all subdomains of your Datadog site:

```
http_port 0.0.0.0:3128

acl local src 127.0.0.1/32

acl Datadog dstdomain .<YOUR_DATADOG_SITE>

http_access allow Datadog
http_access allow local manager
```

Alternatively, if you require more granular control, you can explicitly list each Datadog endpoint instead of using a wildcard. For the full list of domains and IP ranges the Agent needs to reach, see [Network Traffic](https://docs.datadoghq.com/agent/configuration/network.md#overview). For example:

{% alert level="danger" %}
The example below only includes a subset of Datadog endpoints. Make sure to include all domains required by the Datadog features you use. See [Network Traffic][7] for the complete list.
{% /alert %}

```
http_port 0.0.0.0:3128

acl local src 127.0.0.1/32

acl Datadog dstdomain agent.<YOUR_DATADOG_SITE>
acl Datadog dstdomain process.<YOUR_DATADOG_SITE>
acl Datadog dstdomain logs.<YOUR_DATADOG_SITE>
acl Datadog dstdomain api.<YOUR_DATADOG_SITE>

http_access allow Datadog
http_access allow local manager
```

### Start Squid{% #start-squid %}

Start (or restart) Squid so that your new configurations can be applied.

{% tab title="Linux" %}

```bash
sudo systemctl start squid
```

If Squid is already running, restart Squid instead with the following command:

```bash
sudo systemctl restart squid
```

{% /tab %}

{% tab title="Windows" %}
If you are configuring Squid on Windows, you must first [configure Squid as a system service][4]. You can then run the following in an Administrator command prompt:

```bash
net start squid
```

If Squid is already running, restart Squid instead with the following commands:

```bash
net stop squid
net start squid
```

{% /tab %}

### Configure the Datadog Agent{% #configure-the-datadog-agent %}

{% tab title="Host" %}
Modify the Agent's configuration file (`datadog.yaml`) to include the following:

```yaml
proxy:
  http: http://127.0.0.1:3128
  https: http://127.0.0.1:3128
```

After saving these changes, [restart the Agent][1].
{% /tab %}

{% tab title="Operator" %}
Modify the DatadogAgent CR to include the following:

```yaml
spec:
  global:
    proxy:
      http: http://squid-proxy.proxy-namespace.svc.cluster.local:3128
      https: http://squid-proxy.proxy-namespace.svc.cluster.local:3128
```

{% /tab %}

{% tab title="Helm" %}
Modify your `values.yaml` to include the following:

```yaml
datadog:
  env:
    - name: DD_PROXY_HTTP
      value: http://squid-proxy.proxy-namespace.svc.cluster.local:3128
    - name: DD_PROXY_HTTPS
      value: http://squid-proxy.proxy-namespace.svc.cluster.local:3128
```

{% /tab %}

Verify that Datadog is able to receive the data from your Agent(s) by checking your [Infrastructure Overview](https://app.datadoghq.com/infrastructure).

## Further Reading{% #further-reading %}

- [Agent Proxy Configuration](https://docs.datadoghq.com/agent/configuration/proxy.md)