diff --git a/Network/HTTP/Proxy.hs b/Network/HTTP/Proxy.hs
--- a/Network/HTTP/Proxy.hs
+++ b/Network/HTTP/Proxy.hs
@@ -35,6 +35,7 @@
 
     , Settings (..)
     , defaultSettings
+    , UpstreamProxy (..)
     , Request (..)
     )
 where
@@ -96,6 +97,7 @@
 import Data.String (IsString (..))
 import qualified Data.ByteString.Lex.Integral as LI
 import Network.TLS (TLSCertificateUsage (..))
+import qualified Data.ByteString.Base64 as B64
 
 #if WINDOWS
 import Control.Concurrent (threadDelay)
@@ -271,7 +273,7 @@
                                         [h, p] -> (h, LI.readDecimal_ p)
                                         _ -> (serverName req, serverPort req)
                                 modReq <- liftIO $ proxyRequestModifier settings req { serverName = hs, serverPort = ps }
-                                proxyPlain th conn mgr modReq
+                                proxyPlain (proxyUpstream settings) th conn mgr modReq
                                         >>= \keepAlive -> when keepAlive $ serveConnection'' fromClient
             _ | requestMethod req == "CONNECT" ->
                 case B.split ':' (rawPathInfo req) of
@@ -606,6 +608,8 @@
     , proxyOnException :: SomeException -> IO () -- ^ What to do with exceptions thrown by either the application or server. Default: ignore server-generated exceptions (see 'InvalidRequest') and print application-generated applications to stderr.
     , proxyTimeout :: Int -- ^ Timeout value in seconds. Default value: 30
     , proxyRequestModifier :: Request -> IO Request -- ^ A function that allows the the request to be modified before being run. Default: 'return . id'.
+    , proxyLogger :: ByteString -> IO () -- ^ A function for logging proxy internal state. Default: 'return ()'.
+    , proxyUpstream :: Maybe UpstreamProxy -- ^ Optional upstream proxy.
     }
 
 -- | Which host to bind.
@@ -640,6 +644,15 @@
             _ -> Host s'
     fromString s = Host s
 
+-- | A http-proxy can be configured to use and upstream proxy by providing the
+-- proxy name, the port it listens to and an option username and password for
+-- proxy authorisation.
+data UpstreamProxy = UpstreamProxy
+    { upstreamHost :: ByteString -- ^ The upstream proxy's hostname.
+    , upstreamPort :: Int -- ^ The upstream proxy's port number.
+    , upstreamAuth :: Maybe (ByteString, ByteString) -- ^ Optional username and password to use with upstream proxy.
+    }
+
 -- | The default settings for the Proxy server. See the individual settings for
 -- the default value.
 defaultSettings :: Settings
@@ -654,6 +667,8 @@
                     $ hPutStrLn stderr $ "ProxyEx: " ++ show e
     , proxyTimeout = 30
     , proxyRequestModifier = return . id
+    , proxyLogger = \ _ -> return ()
+    , proxyUpstream = Nothing
     }
   where
     go :: InvalidRequest -> IO ()
@@ -737,8 +752,8 @@
 
 --------------------------------------------------------------------------------
 
-proxyPlain :: T.Handle -> Connection -> HC.Manager -> Request -> ResourceT IO Bool
-proxyPlain th conn mgr req = do
+proxyPlain :: Maybe UpstreamProxy -> T.Handle -> Connection -> HC.Manager -> Request -> ResourceT IO Bool
+proxyPlain upstream th conn mgr req = do
         let portStr = case (serverPort req, isSecure req) of
                            (80, False) -> mempty
                            (443, True) -> mempty
@@ -760,14 +775,26 @@
              then 0
              else LI.readDecimal_ . fromMaybe "0" . lookup "content-length" . requestHeaders $ req
 
+        let (proxy, pauth) = case upstream of
+                                 Nothing -> (Nothing, [])
+                                 Just (UpstreamProxy ph pp Nothing) ->
+                                         ( Just (HC.Proxy ph pp), [])
+                                 Just (UpstreamProxy ph pp (Just (u, p))) ->
+                                         ( Just (HC.Proxy ph pp)
+                                         , [ ( "Proxy-Authorization"
+                                             , B.append "Basic " (B64.encode $ B.concat [ u, ":", p ])
+                                             )
+                                           ] )
+
         url <-
             (\u -> u { HC.method = requestMethod req
-                     , HC.requestHeaders = outHdrs
+                     , HC.requestHeaders = pauth ++ outHdrs
                      , HC.rawBody = True
                      , HC.secure = isSecure req
                      , HC.requestBody = HC.RequestBodySource contentLength
                                             $ fmap copyByteString
                                             $ requestBody req
+                     , HC.proxy = proxy
                      -- In a proxy we do not want to intercept non-2XX status codes.
                      , HC.checkStatus = \ _ _ -> Nothing
                      })
diff --git a/http-proxy.cabal b/http-proxy.cabal
--- a/http-proxy.cabal
+++ b/http-proxy.cabal
@@ -1,5 +1,5 @@
 Name:           http-proxy
-Version:        0.0.10
+Version:        0.0.11
 License:        BSD3
 License-file:   LICENSE
 Author:         Michael Snoyman, Stephen Blackheath, Erik de Castro Lopo
@@ -42,6 +42,7 @@
                    , blaze-builder-conduit   >= 0.2      && < 0.3
                    , tls                     >= 0.9      && < 0.10
                    , bytestring-lexing       >= 0.4      && < 0.5
+                   , base64-bytestring       >= 0.1      && < 0.2
                    , ghc-prim
   if flag(network-bytestring)
       build-depends: network               >= 2.2.1.5 && < 2.2.3