diff --git a/compose/services.yml b/compose/services.yml
index f76b2fb..5965a28 100644
--- a/compose/services.yml
+++ b/compose/services.yml
@@ -144,6 +144,7 @@ services:
       - "80:80"
       - "222:222"
       - "443:443"
+      - "3128:3128"
       - "5432:5432"
       - "6379:6379"
     networks:
diff --git a/haproxy/haproxy.cfg b/haproxy/haproxy.cfg
index ff2af6a..b33137e 100644
--- a/haproxy/haproxy.cfg
+++ b/haproxy/haproxy.cfg
@@ -103,3 +103,8 @@ frontend redis
 backend backend_redis
   mode tcp
   server resin_redis_1 redis:6379 check port 6379
+
+listen vpn-tunnel
+  mode tcp
+  bind *:3128
+  server balena_vpn vpn:3128 check port 3128