Forward proxy

​

Overview

​

Core Mechanics (C++ Source Validation)

• CARP Hashing: When routing requests through an array of proxies, the routing engine performs a deterministic 32-bit bitwise rotation hash combining the requested URL and the peer’s hostname. The peer generating the highest hash score receives the request.
• Self-Resolution (Loop Prevention): If SafeSquid calculates that its own hostname generates the highest CARP hash (op >= hp), it drops the forwarding requirement and resolves the request directly.
• Cache Coordination: When a request is forwarded to another CARP array member, SafeSquid sets CONNECTION_NOCACHE. This ensures the object is only cached on the designated CARP owner, creating a single, distributed logical cache without duplication.

​

Schema Fields

​

Global Fields

• Enabled (enabled): Toggles proxy forwarding globally.
• Enable CARP (carp): Enables Cache Array Routing Protocol for load balancing across peers.
• CARP hash size (carphashsize): Determines the hash bucket size for CARP distribution.

​

Rule-Based Fields (Per Connection Tuning)

• Enabled (enabled): Toggles the rule.
• Comment (comment): User description.
• Profiles (profiles): The trigger condition. Limit this entry to connections that already carry these Access Profile tags.
• Proxy (proxy): The IP address or hostname of the upstream proxy server.
• User name (username): The username to authenticate with the upstream proxy.
• Password (password): The password to authenticate with the upstream proxy.
• Domain (domain): PCRE regex matching the request URL domain. Blank matches all domains.
• Port (port): The TCP port of the upstream proxy server.
• ICP peer type (icptype): Defines the relationship with the peer (e.g., Parent, Sibling).
• ICP port (icpport): The UDP port used for ICP queries.
• Type (type): The protocol type of the upstream proxy (e.g., HTTP, HTTPS).
• Applies to (which): Specifies whether the forwarding rule applies to the client request URL or the response Location header.

​

Important entry fields

• Profiles — Limit the row with Access Profile tags. Blank matches all profiles.
• Proxy — Upstream hostname or IP. Blank on a matching row stops candidate collection without forwarding. Rows whose Proxy equals this instance hostname or System configuration Proxy hostname are skipped (shared-config safety).
• Type — HTTP (standard proxy), SOCKS4 / SOCKS5, or CONNECT tunnel. Port defaults to 3128 for HTTP/SOCKS and 443 for CONNECT when Port is 0.
• Applies to — Protocol flags: HTTP, FTP, CONNECT. Row is skipped when the connection protocol does not match any selected flag.
• ICP peer type / ICP port — When global CARP is off: NONE gives fixed priority 1; PARENT forwards on ICP miss; SIBLING forwards only on ICP HIT. UDP ICP uses the ICP port on this row; global ICP listen port and timeout come from Caching.
• User name / Password / Domain — Upstream proxy authentication when the selected peer requires it.

​

Processing order

1. If forwarding is disabled, or Access Bypass → Forward is set, skip.
2. Walk Forwarding proxies top to bottom; add each enabled matching row with a non-self Proxy to the candidate list.
3. Blank Proxy on a matching row stops collection immediately.
4. CONNECT requests skip ICP/CARP selection logic used for plain HTTP.
5. Select one peer: CARP hash among candidates, or ICP priorities, or random tie-break.
6. Send the request through the selected peer, or direct if no candidate remains.

​

Examples

​

How to verify

1. Enable FORWARD in LOG_LEVEL; look for native forwarding: lines.
2. From a test client, confirm upstream sees traffic from SafeSquid (or from your upstream auth logs).
3. Enable Trace Entry on one Forwarding proxies row to see candidate collection.
4. Detailed logs may show forward-related status when policies apply.