diff --git a/src/conf.c b/src/conf.c
index d568dfb..eadaaf6 100644
--- a/src/conf.c
+++ b/src/conf.c
@@ -254,8 +254,8 @@ struct {
                 BEGIN "(no" WS "upstream)" WS STR END, handle_upstream_no, NULL
         },
         {
-                BEGIN "(upstream)" WS "(" IP "|" ALNUM ")" ":" INT "(" WS STR
-                      ")?" END, handle_upstream, NULL
+                BEGIN "(upstream)" WS "(" STR "@" ")?" "(" IP "|" ALNUM ")" ":"
+                        INT "(" WS STR ")?" END, handle_upstream, NULL
         },
 #endif
         /* loglevel */
@@ -1071,22 +1071,30 @@ static HANDLE_FUNC (handle_upstream)
         char *ip;
         int port;
         char *domain;
+        char *basic_auth = NULL;        /* optional, Base64 basic auth */
 
-        ip = get_string_arg (line, &match[2]);
+        if (match[3].rm_so != -1) {
+                /* Basic auth is set for upstream proxy. */
+                basic_auth = get_string_arg (line, &match[3]);
+        }
+
+        ip = get_string_arg (line, &match[4]);
         if (!ip)
                 return -1;
-        port = (int) get_long_arg (line, &match[7]);
+        port = (int) get_long_arg (line, &match[9]);
 
-        if (match[10].rm_so != -1) {
-                domain = get_string_arg (line, &match[10]);
+        if (match[12].rm_so != -1) {
+                domain = get_string_arg (line, &match[12]);
                 if (domain) {
-                        upstream_add (ip, port, domain, &conf->upstream_list);
+                        upstream_add (ip, port, basic_auth, domain,
+                                      &conf->upstream_list);
                         safefree (domain);
                 }
         } else {
-                upstream_add (ip, port, NULL, &conf->upstream_list);
+                upstream_add (ip, port, basic_auth, NULL, &conf->upstream_list);
         }
 
+        safefree (basic_auth);
         safefree (ip);
 
         return 0;
@@ -1100,7 +1108,7 @@ static HANDLE_FUNC (handle_upstream_no)
         if (!domain)
                 return -1;
 
-        upstream_add (NULL, 0, domain, &conf->upstream_list);
+        upstream_add (NULL, 0, NULL, domain, &conf->upstream_list);
         safefree (domain);
 
         return 0;
diff --git a/src/reqs.c b/src/reqs.c
index 990152a..26158ae 100644
--- a/src/reqs.c
+++ b/src/reqs.c
@@ -267,6 +267,17 @@ establish_http_connection (struct conn_s *connptr, struct request_s *request)
                                       "Connection: close\r\n",
                                       request->method, request->path,
                                       request->host, portbuff);
+        } else if ((connptr->upstream_proxy) &&
+                (connptr->upstream_proxy->basic_auth)) {
+                /* Basic auth is set for upstream proxy. */
+                return write_message (connptr->server_fd,
+                                      "%s %s HTTP/1.0\r\n"
+                                      "Host: %s%s\r\n"
+                                      "Connection: close\r\n"
+                                      "Proxy-Authorization: Basic %s\r\n",
+                                      request->method, request->path,
+                                      request->host, portbuff,
+                                      connptr->upstream_proxy->basic_auth);
         } else {
                 return write_message (connptr->server_fd,
                                       "%s %s HTTP/1.0\r\n"
diff --git a/src/upstream.c b/src/upstream.c
index 6b25f9b..201e967 100644
--- a/src/upstream.c
+++ b/src/upstream.c
@@ -32,7 +32,9 @@
 /**
  * Construct an upstream struct from input data.
  */
-static struct upstream *upstream_build (const char *host, int port, const char *domain)
+static struct upstream *upstream_build (const char *host, int port,
+                                        const char *basic_auth,
+                                        const char *domain)
 {
         char *ptr;
         struct upstream *up;
@@ -44,7 +46,7 @@ static struct upstream *upstream_build (const char *host, int port, const char *
                 return NULL;
         }
 
-        up->host = up->domain = NULL;
+        up->host = up->domain = up->basic_auth = NULL;
         up->ip = up->mask = 0;
 
         if (domain == NULL) {
@@ -57,6 +59,9 @@ static struct upstream *upstream_build (const char *host, int port, const char *
                 up->host = safestrdup (host);
                 up->port = port;
 
+                if (basic_auth != NULL)
+                        up->basic_auth = safestrdup (basic_auth);
+
                 log_message (LOG_INFO, "Added upstream %s:%d for [default]",
                              host, port);
         } else if (host == NULL) {
@@ -101,6 +106,9 @@ static struct upstream *upstream_build (const char *host, int port, const char *
                 up->port = port;
                 up->domain = safestrdup (domain);
 
+                if (basic_auth != NULL)
+                        up->basic_auth = safestrdup (basic_auth);
+
                 log_message (LOG_INFO, "Added upstream %s:%d for %s",
                              host, port, domain);
         }
@@ -109,6 +117,7 @@ static struct upstream *upstream_build (const char *host, int port, const char *
 
 fail:
         safefree (up->host);
+        safefree (up->basic_auth);
         safefree (up->domain);
         safefree (up);
 
@@ -116,14 +125,14 @@ fail:
 }
 
 /*
- * Add an entry to the upstream list
+ * Add an entry to the upstream list.
  */
-void upstream_add (const char *host, int port, const char *domain,
-                   struct upstream **upstream_list)
+void upstream_add (const char *host, int port, const char *basic_auth,
+                   const char *domain, struct upstream **upstream_list)
 {
         struct upstream *up;
 
-        up = upstream_build (host, port, domain);
+        up = upstream_build (host, port, basic_auth, domain);
         if (up == NULL) {
                 return;
         }
@@ -155,6 +164,7 @@ void upstream_add (const char *host, int port, const char *domain,
 
 upstream_cleanup:
         safefree (up->host);
+        safefree (up->basic_auth);
         safefree (up->domain);
         safefree (up);
 
@@ -216,6 +226,7 @@ void free_upstream_list (struct upstream *up)
                 struct upstream *tmp = up;
                 up = up->next;
                 safefree (tmp->domain);
+                safefree (tmp->basic_auth);
                 safefree (tmp->host);
                 safefree (tmp);
         }
diff --git a/src/upstream.h b/src/upstream.h
index 34dad68..1431d4b 100644
--- a/src/upstream.h
+++ b/src/upstream.h
@@ -36,11 +36,13 @@ struct upstream {
         char *domain;           /* optional */
         char *host;
         int port;
+        char *basic_auth;       /* optional, Base64 basic auth */
         in_addr_t ip, mask;
 };
 
 #ifdef UPSTREAM_SUPPORT
-extern void upstream_add (const char *host, int port, const char *domain,
+extern void upstream_add (const char *host, int port,
+                          const char *basic_auth, const char *domain,
                           struct upstream **upstream_list);
 extern struct upstream *upstream_get (char *host, struct upstream *up);
 extern void free_upstream_list (struct upstream *up);