diff --git a/pkgs/tools/networking/cntlm/default.nix b/pkgs/tools/networking/cntlm/default.nix
new file mode 100644
index 000000000000..f58650207854
--- /dev/null
+++ b/pkgs/tools/networking/cntlm/default.nix
@@ -0,0 +1,25 @@
+{ stdenv, fetchurl, which}:
+
+stdenv.mkDerivation {
+  name = "cntlm-0.35.1";
+
+  src = fetchurl {
+    url = mirror://sourceforge/cntlm/cntlm-0.35.1.tar.gz;
+    sha256 = "7b3fb7184e72cc3f1743bb8e503a5305e96458bc630a7e1ebfc9f3c07ffa6c5e";
+  };
+
+  buildInputs = [ which ];
+
+  installPhase = ''
+    ensureDir $out/bin; cp cntlm $out/bin/;
+    ensureDir $out/share/; cp COPYRIGHT README VERSION doc/cntlm.conf $out/share/;
+    ensureDir $out/man/; cp doc/cntlm.1 $out/man/;
+  '';
+
+  meta = {
+    description = "Cntlm is an NTLM/NTLMv2 authenticating HTTP proxy";
+    homepage = http://cntlm.sourceforge.net/;
+    license = stdenv.lib.licenses.gpl2;
+    maintainers = [ stdenv.lib.maintainers.qknight ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 2001c64f874d..55aa9984ae74 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1197,6 +1197,8 @@ let
 
   proxytunnel = callPackage ../tools/misc/proxytunnel { };
 
+  cntlm = callPackage ../tools/networking/cntlm { };
+
   psmisc = callPackage ../os-specific/linux/psmisc { };
 
   pstoedit = callPackage ../tools/graphics/pstoedit { };