> ## Documentation Index
> Fetch the complete documentation index at: https://docs.safesquid.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Network settings

<Note>
  CLI man page: `safesquid-network(5)`
</Note>

The **Network** section (`safesquid-network(5)`) defines client listen sockets and outbound source IP selection for origin connections.

## Core mechanics

### Listen — startup bind

Every enabled Listen row with `port != -1` binds at startup. If no enabled row matches startup.ini `LISTEN_IP` and `LISTEN_PORT`, an additional fallback bind runs on those defaults. Restart required after Listen changes.

### Interface — first match wins

Outbound walks Interface rows top-down: skip disabled; skip empty Source IP after load; skip when destination is in **Excluded Destination IPs**; require a profile match (connection profiles plus hostname/service tags). The first match picks a source IP from the row's list, keyed by client ID.

### Source IP on host only

Non-local Source IPs are dropped silently at load. If all IPs are dropped, the row is skipped at runtime.

<Frame caption="Outbound Interface selection">
  <img src="https://mintcdn.com/safe-squid-labs-12a0916f/VRx-_vpMam8ezhZz/images/admin_guide/network_settings_flowchart.svg?fit=max&auto=format&n=VRx-_vpMam8ezhZz&q=85&s=e37a179a45a21066dac35839ec254b50" alt="Interface selection flow" width="480" height="340" data-path="images/admin_guide/network_settings_flowchart.svg" />
</Frame>

## Listen fields

* **IP / Port** — Bind address and client port. Blank IP = dual-stack any when IPv6 available.
* **Bindings** — `SSL_TRANSPARENT`, `CAPTIVE_PORTAL` implemented; `SSL_AUTHENTICATION` / `SSL_BRIDGE` have no effect.

## Interface fields

* **Profiles** — Blank matches all. Typical tag: `ALTERNATE OUTBOUND IP`.
* **Excluded Destination IPs** — Hyphen ranges; destination in list skips row (CIDR not supported).
* **Source IP** — Comma-separated local addresses; only host IPs kept; rotated by client id.

## Examples

<Tip>
  ### Single proxy port

  **Config:** Listen enabled, blank IP, port 8080.

  **Result:** All interfaces accept on 8080 after restart; Access controls who may connect.
</Tip>

<Tip>
  ### Excluded destination

  **Config:** Source IP 10.0.0.5, dest\_ips 10.0.0.0-10.255.255.255.

  **Result:** Outbound to 10.x skips row; public destinations may match and bind 10.0.0.5.
</Tip>

<Tip>
  ### Source IP not on host

  **Config:** Source IP 198.51.100.99 not assigned to appliance.

  **Result:** IP ignored at load; row skipped — no outbound bind from this row.
</Tip>

## How to verify

1. Restart after Listen changes.
2. `curl -x http://APPLIANCE:8080 http://example.com/`
3. Enable NETWORK logs; confirm bind and interface\_select lines.
4. Match listen socket in Access **Interface** for CONFIG vs PROXY tests.


## Related topics

- [startup.ini tunables](/admin_guide/start_here/startup_ini.md)
- [PAC File Configuration](/getting_started/client_configuration/pac_file.md)
- [TCP Proxy](/use_cases/scaling_and_high_availability/tcp_proxy.md)
- [Forward Proxy](/use_cases/scaling_and_high_availability/forward_proxy.md)
- [Troubleshooting Installation Issues](/troubleshooting/installation_issues.md)