Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm new to Squid and iptables, and am investigating whether they would be able to

accomplish a task at hand. part of my squid.conf:

acl wf myport 8010
acl vp myport 8020
acl ss myport 8030

cache_peer IP1 parent 80 0 no-query originserver name=wflocal
cache_peer_access wflocal allow wf
cache_peer IP2 parent 80 0 no-query originserver name=vplocal
cache_peer_access vplocal allow vp
cache_peer IP3 parent 80 0 no-query originserver name=sslocal
cache_peer_access sslocal allow ss

cache_peer_access sslocal deny all
cache_peer_access vplocal deny all
cache_peer_access wflocal deny all

my squid ip is IP9

I need that the HTTP server IP1,IP2 and IP3 should logically

appear under a single URL hierarchy

like this :

    http  : // IP9:8010  

    http  : // IP9:8020 

    http  : // IP9:8030

all above is going well now

but the HTTP server access log can not know the "real" user IP and it just record ip of the accelerator(squid).what should I do to make the HTTP server IP1 , IP2 and IP3 record the "real" user IP.

Thanks for any insights on this!

share|improve this question
Have you enabled X-Forwarded-For headers in Squid? – Andrew Nov 18 '13 at 6:56
What HTTP server are you using? – Ladadadada Nov 18 '13 at 7:39
apache and iis both support X-Forwarded-For – pangjiale Nov 18 '13 at 9:01
up vote 1 down vote accepted

Your squid passes your real ip address in HTTP header. You can disable it in squid.conf by

forwarded_for off
share|improve this answer
squid.conf set forwarded_for = on and apache set X-Forwarded-For, then problem was solved – pangjiale Nov 18 '13 at 8:58

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.