Skip to main content

​
Set Network Settings for Clients and Outbound Traffic

The Network section defines client listen sockets and outbound source IP selection for origin connections. The console splits this section into two tabs, and they are independent of each other: Listen binds the sockets clients connect to, Interface picks the source IP SafeSquid uses when it connects onward. These are infrastructure-plumbing settings, not a security control in themselves: Listen decides where clients may knock, and Interface decides which door SafeSquid walks out of. Who is allowed in, and what they may do, belongs to Access restrictions, which references the Listen sockets defined here through its own Interface match field. Nothing can reach SafeSquid at all unless a Listen entry is bound.

​
Core mechanics

​
Listen — startup bind

Every enabled Listen row with port != -1 binds at startup. If no enabled row matches startup.ini LISTEN_IP and LISTEN_PORT, an additional fallback bind runs on those defaults. This fallback is extra, it does not replace or disable any entry you configured. It only fires when nothing in your list already covers that address. Restart required after Listen changes.

​
Listen fields

Open Configure → Application Setup → Network settings → Listen.
SafeSquid console showing Network settings Listen rows including an SSL_TRANSPARENT binding, the Edit Policies icon on the first row circled

Network settings — Listen rows

  • IP / Port — Bind address and client port. Blank IP binds every address dual-stack where IPv6 is available; 0.0.0.0 binds every IPv4 address; :: binds every IPv6 address. A specific address binds only that one.
  • Bindings — SSL_TRANSPARENT, CAPTIVE_PORTAL implemented; SSL_AUTHENTICATION / SSL_BRIDGE have no effect.

​
Examples

​
Single proxy port

Config: Listen enabled, blank IP, port 8080.Result: All interfaces accept on 8080 after restart; Access controls who may connect.

​
Separate management listener

Config: entry A Enabled, IP 0.0.0.0, Port 8080 for regular users; entry B Enabled, IP 127.0.0.1, Port 8080 for administration.Result: after a restart both sockets are open, and an Access restrictions entry matching Interface 127.0.0.1:8080 can grant the Web interface right on the loopback listener while entries matching 0.0.0.0:8080 grant proxy rights — separating administrative access from ordinary browsing by which socket the connection arrived on.

​
How to verify

  1. Restart after Listen changes.
  2. curl -x http://APPLIANCE:8080 http://example.com/
  3. Enable NETWORK logs; confirm the bind lines.
  4. Match listen socket in Access Interface for CONFIG vs PROXY tests.

​
Next steps

  • Access restrictions - define who can connect through SafeSquid, whether they must authenticate, and which proxy features they get, using ordered first-match rules.