Network settings

The Network section (safesquid-network(5)) defines client listen sockets and outbound source IP selection for origin connections.

​

Core mechanics

​

Listen — startup bind

Every enabled Listen row with port != -1 binds at startup. If no enabled row matches startup.ini LISTEN_IP and LISTEN_PORT, an additional fallback bind runs on those defaults. Restart required after Listen changes.

​

Interface — first match wins

Outbound walks Interface rows top-down: skip disabled; skip empty Source IP after load; skip when destination is in Excluded Destination IPs; require a profile match (connection profiles plus hostname/service tags). The first match picks a source IP from the row’s list, keyed by client ID.

​

Source IP on host only

Non-local Source IPs are dropped silently at load. If all IPs are dropped, the row is skipped at runtime.

​

Listen fields

• IP / Port — Bind address and client port. Blank IP = dual-stack any when IPv6 available.
• Bindings — SSL_TRANSPARENT, CAPTIVE_PORTAL implemented; SSL_AUTHENTICATION / SSL_BRIDGE have no effect.

​

Interface fields

• Profiles — Blank matches all. Typical tag: ALTERNATE OUTBOUND IP.
• Excluded Destination IPs — Hyphen ranges; destination in list skips row (CIDR not supported).
• Source IP — Comma-separated local addresses; only host IPs kept; rotated by client id.

​

Examples

​

How to verify

1. Restart after Listen changes.
2. curl -x http://APPLIANCE:8080 http://example.com/
3. Enable NETWORK logs; confirm bind and interface_select lines.
4. Match listen socket in Access Interface for CONFIG vs PROXY tests.