A Squid server at work is being used to route requests through multiple external IP addresses. I'm doing the named-IP routing with the solution at my own question on Unix.SE. Another piece of the puzzle I need to add now is random selection if the custom header isn't set.

I know there's a 'random' directive that will set an ACL based on a probability, but the examples online are sketchy at best.

I need a way to split all of my traffic randomly across 20 IP addresses, UNLESS a specific header is set, at which point the header (aka ACL) should take priority and force an outbound IP address. How can I do this with ACL in squid?

1 Answer 1


I'm not a squid expert but i've used it a fair bit and think this might work.

acl random1 random 1/20
acl random2 random 1/20
acl random3 random 1/20
acl random4 random 1/20
acl random5 random 1/20
acl random6 random 1/20
acl random7 random 1/20
acl random8 random 1/20
acl random9 random 1/20
acl random10 random 1/20
acl random11 random 1/20
acl random12 random 1/20
acl random13 random 1/20
acl random14 random 1/20
acl random15 random 1/20
acl random16 random 1/20
acl random17 random 1/20
acl random18 random 1/20
acl random19 random 1/20
acl random20 random 1/20
acl prio1 req_header priohdr 1
acl prio2 req_header priohdr 2
acl prio3 req_header priohdr 3
acl prio4 req_header priohdr 4
acl prio5 req_header priohdr 5
acl prio6 req_header priohdr 6
acl prio7 req_header priohdr 7
acl prio8 req_header priohdr 8
acl prio9 req_header priohdr 9
acl prio10 req_header priohdr 10
acl prio11 req_header priohdr 11
acl prio12 req_header priohdr 12
acl prio13 req_header priohdr 13
acl prio14 req_header priohdr 14
acl prio15 req_header priohdr 15
acl prio16 req_header priohdr 16
acl prio17 req_header priohdr 17
acl prio18 req_header priohdr 18
acl prio19 req_header priohdr 19
acl prio20 req_header priohdr 20
tcp_outgoing_address random1
tcp_outgoing_address random2
tcp_outgoing_address random3
tcp_outgoing_address random4
tcp_outgoing_address random5
tcp_outgoing_address random6
tcp_outgoing_address random7
tcp_outgoing_address random8
tcp_outgoing_address random9
tcp_outgoing_address random10
tcp_outgoing_address random11
tcp_outgoing_address random12
tcp_outgoing_address random13
tcp_outgoing_address random14
tcp_outgoing_address random15
tcp_outgoing_address random16
tcp_outgoing_address random17
tcp_outgoing_address random18
tcp_outgoing_address random19
tcp_outgoing_address random20
tcp_outgoing_address prio1
tcp_outgoing_address prio2
tcp_outgoing_address prio3
tcp_outgoing_address prio4
tcp_outgoing_address prio5
tcp_outgoing_address prio6
tcp_outgoing_address prio7
tcp_outgoing_address prio8
tcp_outgoing_address prio9
tcp_outgoing_address prio10
tcp_outgoing_address prio11
tcp_outgoing_address prio12
tcp_outgoing_address prio13
tcp_outgoing_address prio14
tcp_outgoing_address prio15
tcp_outgoing_address prio16
tcp_outgoing_address prio17
tcp_outgoing_address prio18
tcp_outgoing_address prio19
tcp_outgoing_address prio20

Change 10.0.0.X to your ip addresses for your outgoing connections, obviously those addresses need to be available on the system, so they will need to be static ips.

Change at the end to whatever connection you want the traffic w/header set to use.

The header from the browser needs to have the specified name and have content that matches the regex.

Again Im not an expert but its worth a go.

Also this is 20, 1 in 20 chances to match the random probabilities, it theoretically must match one, but its not guaranteed, so the first line should set the default connection.


Updated to allow connection selection, it needs testing, because i can't be 100% sure it will work as required.

  • This sort of works, except: I need priohdr to be able to pick any outbound IP (like the random ones), and if that's not specified the random header MUST hit. It cannot default to a single IP. Sep 3, 2013 at 20:36
  • Also, to determine if it always hits one of the random acls, use squid-cache.org/Doc/config/request_header_add to add a header based on each randomXX and the priohdr ACL and then packet capture http requests for a day or so and check for the header you added, if its missing in any of the requests, then the default outbound address was used.
    – Aaron Tate
    Sep 6, 2013 at 7:51
  • This was supposed to be ^ my first comment, If the priohdr acl is to do the same thing as the randomXX acls what is the point of having the priohdr acl at all, what is it's function?
    – Aaron Tate
    Sep 6, 2013 at 7:55
  • The priohdr ACL should always override the randomXX ACL, if the header is present in the request. If not, the randomXX ACLs should sort the request through a random outbound IP. Sep 9, 2013 at 14:09
  • Yes, but override it how? in what way? should priohdr go to a specific connection (which is what i allowed for in my example) or do you want to be able to select a connection with the header's content?
    – Aaron Tate
    Sep 11, 2013 at 1:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.