3proxy is distributed in 2 variants: as a set of standalone modules (proxy, socks, pop3p, tcppm, udppm) and as universal proxy server. These services are absolutely independant, and if you use 3proxy you needn't any of standalone modules.
Standalone modules are only configurable via command line interface while 3proxy uses configuration file. Many functions, such as ODBC logging, log rotation, access control, etc are only available in 3proxy, not in standalone proxies. Standalone module may be started from command line, for example:

$/sbin/socks -l/var/log/socks.log -i127.0.0.1

If 3proxy is used you should start all services in 3proxy.cfg file. 3proxy.cfg is executed by 3proxy as a batch file. Example of 3proxy.cfg and command syntaxys can be found in 3proxy.cfg.sample.

log /var/log/3proxy.log D
rotate 30
internal 127.0.0.1
external 192.168.1.1
proxy
socks -p3129
pop3p 

-i options specifies internal interface, -p - listening port. No space are allowed. To bind 'proxy' service to port 8080 on interfaces 192.168.1.1 and 192.168.2.1 use

proxy -p8080 -i192.168.1.1
proxy -p8080 -i192.168.2.1

First, always specify internal interface to accept incoming connection with 'internal' configuration command or '-i' service command. (See How to start any of proxy services (HTTP, SOCKS etc)). If no internal interface is specified your proxy will act as open one.

It's also important to specify external interface to prevent access to internal network with 'external' or -e.

3proxy with configuration files allows to use authentication and authorization for user's access. Authentication is possible by username/password or user's NetBIOS name. Authentication type is specified by 'auth' command.

auth none

auth iponly

auth nbname

auth strong

Different services can have different authentication levels.

auth none
pop3p
auth iponly
proxy
auth strong
socks

Since 0.6 version double authentication is possible, e.g.

auth iponly strong
allow * * 192.168.0.0/16
allow user1,user2
proxy

0.6 version introduces authentication (username) caching to increase productivity. It's recommended to use authentication caching with resource or time consuming authentication types, such as nbname or external plugins (WindowsAuthentication). Caching can be set with 'authcache' command with 2 parameters: caching type and caching time (in seconds). Caching type defines the type of cached access: 'ip' - after successful authentication all connections during caching time from same IP are assigned to the same user, username is not requested. "ip,user" - username is requested and all connections from the same IP are assigned to the same user without actual authentication. "user" - same as above, but IP is not checked. "user,password" - username and password are checked against cached ones. For authentication special authentication type 'cache' must be used. Example:

authcache ip 60
auth cache strong windows
proxy -n

Userslist is created with 'users' command.

users USERDESC ...

users admin:CL:bigsecret test:CL:password test1:CL:password1
users "test2:CR:$1$lFDGlder$pLRb4cU2D7GAT58YQvY49."
users test3:NT:BD7DFBF29A93F93C63CB84790DA00E63

• No password type: use system authentication.
• CL - cleartext password
• CR - crypt password, only MD5 crypt passwords are supported
• NT - NT-hashed (MD4) passwords in hex, as used in pwdump or SAMBA

users $/etc/.3proxypasswd

users $"c:\Program Files\3proxy\passwords"

Commands allow, deny and flush are used to manage ACLs:

allow <userlist> <sourcelist> <targetlist> <targetportlist> <commandlist> <weekdaylist> <timeperiodlist>
deny <userlist> <sourcelist> <targetlist> <weekdaylist> <timeperiodlist>
flush

• <userlist> - comma delimited list of users
• <sourcelist> - comma delimited list of source (client) networks. Networks can be defined as single IP address or in CIDR form xxx.yyy.zzz.mmm/l, where l - is the length of network mask (a number of non-zero bits). 192.168.1.0/24 means network with 255.255.255.0 mask.
• <targetlist> - comma delimited list of target (server) networks. In 3proxy 0.6 and above it's allowed to use hostnames with wildmasks in targetlist. Wildmask may only present in the begginning or at the end of the hostname, e.g. 192.168.0.0/16,www.example.com,*wrongsite.com,*wrongcontent*.
• <targetportlist> - comma delimited list of ports. I It's possible to define port ranges with -, e.g. 80,1024-65535 means port 80 and all unprivileged ports.
• <commandlist> - the list of allowed actions
  CONNECT - establish outgoing TCP connection. e.g. POP3 or SOCKSv5
  BIND - allow incoming TCP connection (SOCKSv5)
  UDPASSOC - create UDP association (SOCKSv5)
  ICMPASSOC - create ICMP association (not implemented)
  HTTP_GET - HTTP GET request (HTTP proxy)
  HTTP_PUT - HTTP PUT request (HTTP proxy)
  HTTP_POST - HTTP POST request (HTTP proxy)
  HTTP_HEAD - HTTP HEAD request (HTTP proxy)
  HTTP_CONNECT - HTTP CONNECT, aka HTTPS request (HTTP proxy)
  HTTP_OTHER - another HTTP request (HTTP proxy)
  HTTP - any HTTP request except HTTP_CONNECT (HTTP proxy)
  HTTPS - alias to HTTP_CONNECT (HTTP proxy)
  FTP_GET - FTP get request (http, ftp proxy)
  FTP_PUT - FTP put request (ftp proxy)
  FTP_LIST - FTP list request (http, ftp proxy)
  FTP - any FTP request
  ADMIN - administration interface access

• <weeksdays> - week days numbers or periods (0 or 7 means Sunday, 1 is Monday, 1-5 means Monday through Friday).
• <timeperiodlists> - a list of time periods in HH:MM:SS-HH:MM:SS format. For example, 00:00:00-08:00:00,17:00:00-24:00:00 lists non-working hours.