Securely Access a Private Web Server Using a Proxy Server + P2P Tunnel

August 18, 2026

You likely use a VPN or similar setup to access a private web server located either at your office or at home from an external PC. In particular, when accessing a private web server within a corporate environment, you have likely established a VPN setup using dedicated server hardware and software. However, a significant security challenge has emerged: standard VPN environments are susceptible to attacks that exploit their inherent vulnerabilities. To address this, I would like to propose an alternative approach for securely accessing a private web server from an external location: a setup that combines a proxy server with a P2P tunnel.

Why "Proxy Server + P2P"?

In a typical corporate VPN environment, a combination of dedicated server hardware and software creates a network-level boundary between the "internal" (secure) and "external" (insecure) environments, with the VPN server acting as the gateway to the internal LAN and remaining exposed to the Internet.

Consequently, VPN server devices are susceptible to attack; if a vulnerability is exploited to breach them, there is a risk of unauthorized access to the entire corporate network.

Additionally, for a home internet setup, it is possible to enable external access by configuring port forwarding on a broadband router and using DDNS (Dynamic DNS). However, since this exposes the router—which serves as the gateway to the home LAN to the internet, there is a risk of unauthorized access should the router contain any vulnerabilities.

I therefore devised a solution that establishes an independent, private access environment utilizing a "Proxy Server + P2P tunnel" to achieve full NAT traversal. By eliminating the need to expose any part of the internal (corporate or home) LAN directly to the internet, you can ensure security against unauthorized access.

The access environment

Regarding the access setup, a "Squid" forward proxy server is installed within a network that has access to the private web server, and external PCs are configured with HTTP proxy settings. Additionally, the "Tunnel App" is used for the network connection between the PCs and the proxy server. (This is a P2P app developed by us and provided free of charge)

The Tunnel App is installed and used on two devices, one app accepts access from the client app on a proxy port, and the other app accesses the server app. Communication data between apps on your device is end-to-end encrypted, so you can safely access the data without it being seen by third parties.

While a Squid forward proxy server is typically used as an "exit point" from a LAN to web servers on the Internet, one alternative idea is to use it as an "exit point" from a P2P tunnel to private web servers.

Typically, Tunnel App require each proxy port (on the PC side) and its corresponding P2P tunnel configuration (on the server side) to be registered individually. Since this makes the setup and management process particularly on the PC side quite burdensome, I concluded that streamlining operations by converting an HTTP proxy into a P2P tunnel would be an effective solution.

Proxy server setup

For the proxy server's operating system environment, Linux will be used, and "Squid" will be installed and set up.

For details about "Squid," please check the official website (https://www.squid-cache.org/, etc). This article assumes the use of the default listening port, "3128."

This article assumes the existence of a private web server accessible via the URL "http://private.example.com" from within the same network as the proxy server.

• Access to the private web server requires login authentication, such as an ID and password.
  
• For internal corporate servers, the implementation of HTTPS (SSL/TLS) communication is recommended even if access is restricted to the local area network (LAN) due to security considerations and browser specifications.
  
• For server certificates used in HTTPS communication, options such as "Let's Encrypt" and "Google Trust Services(GTS)" are available; these offer free certificate issuance and have their root certificates widely distributed.

Next, install and launch the "Tunnel App (Linux version)." The following message will then appear on the console. This completes the Tunnel app setup on the Linux side; no configuration changes to the company's network environment are required. In this example, the terminal number (the first 6 digits) for the Tunnel App is "000001."

PC side setup

For the PC environment, use Windows to install and launch the "Tunnel App (Windows version)." This will display the command prompt and browser screen shown below. In this example, the terminal number for the Tunnel App is "000002."

The Windows version of the Tunnel App is available for download from the Microsoft Store (recommended). Since it is installed as a trusted application, the warning message shown below will not appear.

If a "Windows protected your PC" message appears when you launch the application after downloading the ZIP file, please click "More info" before proceeding (this is only required the first time). If a "Do you want to run this file?" message appears, please click "Run".

Next, using the Tunnel App on the proxy server, obtain the URL required to register this device as the server-side device by running the command "./TunnelApp_Linux.sh setting", and then access that URL using a browser on your PC. Please note that the generated URL is valid for 10 minutes and can be used only once.

You can use an optional parameter to add a memo (e.g.,"123456";such as a user ID for the target PC) to the setting key of the generated URL.

Then, the Tunnel App on the proxy server is registered as a server side device.

Additionally, you can confirm the device number of the Tunnel App on the linked PC from the proxy server side by using the following command "./TunnelApp_Linux.sh devices".

To disable access to the proxy server, you can make the change using the following command "./TunnelApp_Linux.sh disable_device <Device number>".

To enable access to the proxy server, you can make the change using the following command "./TunnelApp_Linux.sh enable_device <Device number>".

To delete access to the proxy server, you can make the change using the following command "./TunnelApp_Linux.sh delete_device <Device number>".

発行したURLの設定キーにメモを追加・変更する場合は、以下のコマンド「./TunnelApp_Linux.sh setting_memo <Setting key> <Memo>」で変更できます。

Next, register the tunnel communication settings in the Tunnel App on the PC.

On the client side device, select "In device Apps only" to restrict access to "127.0.0.1 (localhost)," and configure "23128" as the proxy port for accepting access from web browsers.

For the server side device, select the Tunnel App "000001" of the proxy server side, configure the access destination as "127.0.0.1" and port "3128," and save the settings.

Next, configure your web browser to use a setup script by enabling the "Use setup script" option in its HTTP proxy settings. To retrieve the setup script, we will leverage the error page output feature of Squid. This is accessed via the proxy server function of the Tunnel App running on your PC (connecting to "localhost" on port 10000); therefore, please set the URL as follows:

http://localhost:10000/proxy?url=http://localhost:23128/proxy.pac

Next, create and save the following setup script on the proxy server side.

Save to: /usr/share/squid/errors/templates/PROXY_PAC

function FindProxyForURL(url, host) {
  // Use a proxy for specific hostnames.
  if (host == "private.example.com") {
    return "PROXY 127.0.0.1:23128";
  }
  // All other traffic connects directly.
  return "DIRECT";
}

Add the following configuration to the Squid configuration file.

Configuration file: /etc/squid/squid.conf

acl proxy_pac url_regex -i /proxy.pac
deny_info PROXY_PAC proxy_pac
http_access deny proxy_pac

* This must be placed before the existing "http_access deny all".
* After changing the settings, you must reload or restart the Squid.

Delivering a setup script via Squid’s error page output is a bit tricky, but it eliminates the need to set up a separate web server and allows for centralized management on the server side.

Finally, if you access "http://private.example.com" from a web browser on your PC, the screen for the sample private web server will be displayed!

• Up to 5 simultaneous connections to the Tunnel App on the PC side (the access source) are supported.
• Up to 200 simultaneous connections to the Tunnel App on the proxy server side (the access destination) are supported.

Conclusion

Recently, there has been a series of incidents such as data breaches and service disruptions resulting from unauthorized access believed to involve the use of generative AI or AI agents; I believe it has become an urgent priority for both businesses and individuals to implement countermeasures.

While it remains crucial to perform regular version updates to address vulnerabilities in network equipment and applications, the reality is that it is impossible to completely prevent oversights or zero-day attacks.

Therefore, I believe a "process of elimination" approach is preferable: first, set up a private server within a network environment that is absolutely secure against unauthorized external access, and then implement further safeguards for any remaining points where a breach could still potentially occur.

I hope the suggestions in this article will be helpful for such considerations.

Until the end Thank you for reading! If you have any opinions, please feel free to send us a message.