Which plan do I need for a proxy?

A dedicated-IP plan, because a proxy has to accept inbound connections on its port — NAT plans don't forward arbitrary ports. Small-IP ($16/mo — 4 vCPU, 4 GB RAM, your own public IPv4) is the comfortable pick when you'll push real traffic or a few users. A single light personal proxy runs fine on Nano-IP ($8/mo).

Is a self-hosted proxy the same as buying residential proxies?

No, and it's important. Your server's IP is a datacenter address, static and yours alone. That's perfect for a fixed exit you control — API allowlists, a stable outbound IP, a private route. It is not a rotating residential pool: some sites block datacenter ranges, and you get one IP, not thousands. For large-scale scraping behind rotation, this isn't the tool.

SOCKS5 or HTTP — which should I run?

SOCKS5 is more general: it forwards any TCP (and UDP) traffic, so it works for more than browsers. HTTP proxies are simpler and fine if you only need web traffic. 3proxy, which we use below, does both from one config, so you don't really have to choose.

Will people be able to abuse my open proxy?

Only if you leave it open. Always require a username and password, and firewall the port. An unauthenticated proxy on a public IP gets found and abused within hours — and abuse from your server is your responsibility. The setup below turns auth on from the start.

No. Email to register, USDC or USDT to pay. A proxy you rent with your real name and card isn't really a private route — so we don't ask for either.

VPS for a Proxy Server (SOCKS5 / HTTP, your own IP)

Run your own SOCKS5 or HTTP proxy on a server with a dedicated IP nobody else uses. A fixed exit address you control — for API allowlists, geo-testing, or a private outbound route. Crypto payment, no KYC, from $16/mo.

A proxy is just a machine that makes requests on your behalf, so the other side sees the proxy's IP instead of yours. Rent a VPS with a dedicated IP, run a proxy daemon on it, and you have a fixed exit address that's yours alone — no monthly per-GB metering, no shared pool, no one else's abuse landing on your IP.

The catch is that a proxy only works if clients can connect to it. That's inbound traffic on a port, which is exactly what a NAT plan won't give you. So this is a dedicated-IP job from the start.

First, is this the proxy you actually want?

Be honest with yourself about the use case, because "proxy" covers two very different needs:

A fixed exit IP you control — this is what a self-hosted proxy is great at. You want a stable outbound address to put on an API allowlist, a private route for your own traffic, a way to test how your app looks from a German IP, or a clean IP you're not sharing with strangers. One static datacenter IP is a feature here, not a limit.

A rotating residential pool for scraping thousands of pages without getting blocked — this is not it. You get one datacenter IP. Some targets block datacenter ranges outright, and there's no rotation. If your job is high-volume scraping behind rotation, a single VPS proxy will get rate-limited fast, and we'd rather tell you now than take $16 for the wrong thing.

If the first one is you, read on.

What you need

A dedicated-IP plan. The proxy listens on a port your clients dial in to; NAT plans don't forward arbitrary ports. Small-IP ($16/mo — 4 vCPU, 4 GB RAM, your own public IPv4) handles real traffic and several clients comfortably. A single personal proxy is fine on Nano-IP ($8/mo).
Unmetered traffic, which every plan here has — a proxy that bills you per GB is a proxy you stop using.
Ubuntu 24.04 and five minutes.

The setup: 3proxy (SOCKS5 + HTTP, one daemon)

3proxy is tiny, does both SOCKS5 and HTTP, and has clean auth. Install it, then write a minimal config:

apt update && apt install -y 3proxy

Create /etc/3proxy/3proxy.cfg:

# resolve names, keep a small log
nserver 1.1.1.1
nscache 65536
log /var/log/3proxy/3proxy.log D
rotate 7

# ONE user — change these
users proxyuser:CL:a-long-random-password

# require that login for every connection
auth strong

# SOCKS5 on 1080, HTTP on 3128
socks -p1080
proxy -p3128

Start it:

mkdir -p /var/log/3proxy
systemctl enable --now 3proxy

Now point your client at your.server.ip:1080 (SOCKS5) or :3128 (HTTP) with that username and password. curl is the quickest test:

curl -x socks5://proxyuser:PASSWORD@YOUR.SERVER.IP:1080 https://ifconfig.me

If it prints your server's IP, you're routing through your own proxy.

Lock it down — this part is not optional

An open proxy on a public IP is found by scanners within hours and turned into someone else's spam relay. Two rules:

Auth on, always. The auth strong line above means no login, no connection. Keep it.
Firewall the ports to the IPs that actually use them. If it's just you:

ufw allow 22/tcp
ufw allow from YOUR.HOME.IP to any port 1080 proto tcp
ufw allow from YOUR.HOME.IP to any port 3128 proto tcp
ufw --force enable

If your clients roam and you can't pin an IP, at least keep auth strong and a long password, and watch the log. Abuse coming out of your server is on you — no-KYC means we don't ask who you are, not that anything goes.

Where this beats a commercial proxy

You control the box, so there's no third party logging which sites you route through it. The IP is static and yours, which is the whole point for an allowlist or a stable outbound route. And you pay for it in crypto with an email address — a proxy tied to your real name and card isn't much of a private route.

The trade-off, again, honestly: it's one IP, and it's a datacenter IP. Perfect as a fixed exit you own; wrong as a rotating scraping pool. If that's the exit you want, Small-IP at $16/mo is the sweet spot — or Nano-IP at $8 for a single light personal proxy.

Related: a personal VPN if you want to tunnel all your traffic instead of per-app, and bypassing censorship if a plain proxy gets fingerprinted where you are.