I have a question about setting up squid as a reverse proxy behind a transparent / forward proxy. Basically, what I am looking for is whether it's possible to set up (B) in the following:

Client (A) --> Squid as Reverse Proxy (B) --> Squid as Forward Proxy (C) --> Origin Servers Depending on Client Request URI (D)

Depending on the client request from (A), (B) could route the request to different origin servers (multiple cache_peer lines). The request has to go through (C) to reach (D), as (C) is the only way out of the network to the internet. Moreover, the logic of figuring out where to go to lies in (B).

And we do not have access to or control of (A) and (C).

Let's say I have the following cache_peer lines in (B), and the address for (C) is "forward-proxy.example.com:3128".

cache_peer    origin-x.example.com    parent 443 0 no-query originserver ssl
cache_peer    origin-y.example.com    parent 443 0 no-query originserver ssl
cache_peer    origin-z.example.com    parent 443 0 no-query originserver ssl

What would be the syntax to configure (B) to use "forward-proxy.example.com:3128" (C) as the forward proxy to the origin servers (D) ?



Yes, this is possible, though probably not in the way you're thinking of it.

You're talking a lot about C, as though it matters; since you have no control over it, you should stop worrying about it. Unless there's more than one C, and that can be used to choose your origin servers, C is utterly irrelevant...it's just in the way (and does prevent you from using more direct methods of selecting origin servers).

You don't/can't determine the origin server in this scenario with cache_peer directives; cache_peer configures how Squid talks to other proxies, not origin servers. Since you can't control the middle Squid, you can't perform any selection based directly on the origin server; i.e. the forward proxy is always going to go to the domain name you've requested, and that won't be based on your selection criteria at B. (If you had control over that other Squid, you would have more options.)

One way to achieve what you want is to give your origin servers some additional names, so that your first Squid (B) can rewrite requests based on URI to new domain names, and the middle squid can make requests based on the domain name.

You can use the url_rewrite_helper option to make use of a rewrite program to alter the URL in whatever way you choose. If it were me, I would probably create a new name for each origin server (a, b, c, etc.), and then rewrite based on whatever piece of data you have to those names. So, if your URI is "http://domain.tld/a/image.png" you could rewrite that to "http://a.domain.tld/image.png", and "http://domain.tld/b/image.png" to "http://b.domain.tld/image.png".

You would, of course, need to configure the origin servers to answer on those new domains and possibly configure them to reconstruct the URI from the munged one it's receiving.



And, re-writer info and example rewrite program:


You could also skip having that first squid determine the origin, and let the origin app distribute your requests across domains in whatever way makes sense, by telling the client to request from whichever server is the right one. Hope this helps.

  • Hi swelljoe, sorry for the confusion, i mean it's (B) that determines which origin server to go to, and (C) is just a transparent proxy. I have updated my question. – kid-hac Nov 14 '14 at 2:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.