Skip to main content

​
Prove Traffic Reaches the Proxy

A healthy proxy that clients cannot reach passes every check run on the server. The failure only appears from the client side. By then users are already escalating. The fastest workaround an impatient administrator reaches for is removing the proxy setting entirely. Run this check from a pilot client, not from the SafeSquid host.

​
Validate prerequisites

Confirm:
  • Service Health passes on the SafeSquid node.
  • At least one pilot client is configured to use SafeSquid as its proxy. Use Connect Your Client for the routing path.
  • You have shell access to the SafeSquid server to read the access log.
  • The test window is approved in the change record.

​
Request an HTTP site through the proxy

From the pilot client:
Expected result: the request returns an HTTP response such as 200, 301, or 302.

​
Confirm the request was logged

The client response alone does not prove the request went through SafeSquid. A bypassed client reaches the site just as successfully. The access log is the proof. On the SafeSquid server:
Expected result: the log records the pilot client IP address, destination host, timestamp, and action. Each record is one line of tab-separated, quoted fields. Read date_time, client_ip, username, method, url, status, and filtering_reason. If the request succeeded but no entry appears, the client is bypassing SafeSquid or the wrong proxy address is configured. Treat that as a failed test, not a logging problem.
Run this from a client workstation, not from the SafeSquid host. It catches the failures that server-side checks cannot see. A healthy proxy that clients cannot reach still passes every check on the server.Network connectivity
  • ping <PROXY-IP> succeeds from the client.
  • The proxy port accepts connections. On Windows, PuTTY in raw mode serves the same purpose as telnet:
Client configuration
  • Browser proxy points at <PROXY-IP>:8080.
  • OS-level proxy is configured, where all applications must be covered.
Licence and interface access
  • http://safesquid.cfg/ loads when the proxy is configured.
  • The activation key has been uploaded through the interface.
  • Support → License Details shows an active state.
Remote management, where used
  • An SSH client is available on the administrator workstation.
  • Public keys are installed on the SafeSquid host if key-based authentication is required.
  • ssh <admin-user>@<PROXY-IP> succeeds from the approved management network.

​
Capture connectivity evidence

Store these artifacts with the deployment record:
  • The curl command and its response headers.
  • The matching access-log line from /var/log/safesquid/extended/extended.log, showing source, destination, timestamp, and action.
  • The pilot client’s proxy configuration.
  • The completed client-side checklist, with the tester named.

​
Troubleshoot client routing

​
Next steps