Skip to content

403 Forbidden — Open Proxy Detection⚓︎

Question⚓︎

I am receiving a 403 Forbidden response from Maven Central. The error message says my IP has been identified as an open HTTP or SOCKS proxy endpoint.

What does this mean, and what do I do?

What is an open proxy?⚓︎

An open proxy is a server that accepts and forwards HTTP or SOCKS connections from any client — not just its own users or internal network. Cloudflare and other security services maintain threat intelligence lists of IP addresses running open proxy endpoints, because these endpoints are frequently exploited to anonymize traffic, launch attacks, and evade network-level enforcement.

Maven Central blocks requests from IPs on this list to prevent the infrastructure from being used as a target for anonymised scraping, abuse, or evasion.

The inadvertent case⚓︎

The most important thing to know: you may not have intentionally set up an open proxy. This is a common situation.

A server can become an inadvertent open relay through:

  • A misconfigured Squid, Nginx, HAProxy, or other proxy service with overly permissive ACLs
  • A SOCKS proxy (e.g. ss-server, shadowsocks, dante) left accessible on a public interface
  • A cloud instance where a proxy was set up for internal use but a firewall rule was not applied or was later removed
  • A compromised instance where an attacker installed proxy software

If your server is running one of these services and it is accessible from the public internet, it may have been added to threat intelligence lists without any action on your part.

How to check⚓︎

Check whether your server is acting as an open proxy:

# Check for listening proxy-related ports
sudo netstat -tlnp | grep -E ':3128|:8080|:1080|:8888|:8118|:9050'

# Check for running proxy processes
ps aux | grep -E 'squid|nginx|haproxy|shadowsocks|dante|socks|proxy'

# Test from an external host whether your server will proxy requests
# (replace YOUR.SERVER.IP with your actual IP)
curl -x http://YOUR.SERVER.IP:3128 https://example.com
curl --socks5 YOUR.SERVER.IP:1080 https://example.com

If any of these commands reveal an open port or a process you did not intend to expose publicly, that is likely the issue.

How to fix⚓︎

Close or restrict the proxy service:

  • If the proxy service is no longer needed, stop and disable it
  • If it is needed internally, add a firewall rule to block external access to the proxy port:
# Example: block external access to port 3128 (Squid) using ufw
sudo ufw deny 3128
  • If your server is on a cloud provider (AWS, GCP, Azure, etc.), check your security group or firewall rules to ensure the proxy port is not open to 0.0.0.0/0

If the IP has been rotated or reassigned:

Threat intelligence lists may lag behind IP reassignments. If you have already fixed the issue, the IP may still be listed for some time. In that case, contact us (see below) with the details and we can investigate whether the block can be lifted sooner.

Is this affecting you as a client, not a server operator?⚓︎

Different situation: connecting through a proxy or VPN

If you are not a server operator — you are a developer or build engineer whose traffic is being sent through a corporate proxy, VPN, or anonymisation service — this is a different situation. The block may be on the exit node of that service, not on your own server.

In that case, see 403 Forbidden error downloading from Central Repository for guidance on identifying your egress IP and contacting support.

Contact us⚓︎

If you believe the block is in error, or if you have fixed the open proxy issue and would like us to review the block status, contact Central Support with:

  • The blocked IP address
  • A brief description of what the server is (cloud instance, CI runner, internal proxy, etc.)
  • What you found and what you changed to close the proxy

We will investigate and let you know what we find.