Running Proxy.py as a Lightweight HTTP Proxy on EC2

Running Proxy.py as a Lightweight HTTP Proxy on EC2

Running Proxy.py on an EC2 instance and reaching it safely through an SSH tunnel, since the proxy has no authentication of its own.

Takahiro Iwasa
2 min read

Proxy.py is a lightweight HTTP proxy server that runs well on a small EC2 instance for testing or tunneling purposes.

ℹ️ Note

On May 27, 2022, AWS introduced port forwarding to remote hosts. For more information, please refer to the official documentation.

Setting Up

Install Proxy.py:

Terminal window
pip install proxy.py

Start Proxy.py using this command:

Terminal window
proxy --port 8080

To ensure Proxy.py runs even after closing the SSH session, use the following command:

Terminal window
nohup proxy --port 8080 > /dev/null &

After launching, you should see logs similar to this in the terminal:

pid:3330 [I] plugins.load:85 - Loaded plugin proxy.http.proxy.HttpProxyPlugin
pid:3330 [I] tcp.listen:82 - Listening on 127.0.0.1:8080
pid:3330 [I] pool.setup:108 - Started 1 acceptors in threaded mode
...

Testing

Establish an SSH tunnel to your EC2 instance:

Terminal window
ssh -L 8080:localhost:8080 -i .ssh/YOUR_PRIVATE_KEY ec2-user@YOUR_HOST

Test the proxy by sending a request to Google:

Terminal window
curl www.google.com -x http://localhost:8080

If the proxy is working correctly, you should receive an HTML response from Google.

Conclusion

Running Proxy.py on an EC2 instance and reaching it through an SSH tunnel provided a lightweight HTTP proxy without any authentication layer of its own. proxy --port 8080 starts listening with no authentication configured, so the ssh -L 8080:localhost:8080 tunnel isn’t just how the proxy gets reached here — it’s the only thing standing between it and being an open relay if the security group happened to allow inbound traffic on that port. Running it with nohup proxy --port 8080 > /dev/null & keeps it alive after the SSH session ends, which is convenient for a small instance used for testing or tunneling, but it’s worth confirming the process is still bound to 127.0.0.1 and that the security group has no inbound rule for port 8080 before leaving it running unattended.

About the author

Takahiro Iwasa

Takahiro Iwasa

Software Developer

This blog shares technical notes from hands-on projects—architecture, implementation, and AWS service integrations.