Skip to main content

​
Forward client traffic through a parent proxy

Use SafeSquid as a child proxy in front of a corporate (parent) proxy. A simple configuration in SafeSquid forwards all client requests to the parent proxy. SafeSquid can still perform HTTPS inspection and policy enforcement before forwarding; the parent handles upstream connectivity and any corporate policy. Traffic flows from the client through the child SafeSquid to the parent proxy, then to the internet: Example scenarios: Proxy chain scenario: client, child proxy, and parent proxy network layout Here am using two proxy servers as SafeSquid only My client (Browser)## ‘s network IP - 192.168.0.27 My Child Proxy## ‘s network IP - 192.168.27.50 (with no direct internet Access) My Parent Proxy## ‘s network IP - 192.168.27.100 Configuration on child proxy:
  1. Deploy SafeSquid proxy
  2. Enabling SSL inspection in SafeSquid
  3. Downloading ROOT CA certificate from SafeSquid
  4. Deploy certificate in client browsers.
  5. Enable forwarding to parent proxy using forwarding section
Configuration on Parent proxy: Deploy SafeSquid, it is up and running, no extra configuration required in parent proxy

​
Prerequisites

Enable HTTPS inspection on child proxy (optionally on parent proxy also). Check our document to configure HTTPS inspection on SafeSquid - How to configure HTTPS inspection Import SafeSquid child proxy ROOT CA in client browser Note: No configuration required on Parent Proxy server. Just deploy the parent proxy and make sure that it is up and running.

​
Configure proxy chain in SafeSquid

Access the SafeSquid Configuration Portal.

​
Open Configure page

Configure page in SafeSquid interface

​
Open Application Setup → Proxy chain

Application Setup section in sidebar Proxy chain section in Application Setup

​
Enable Global section

Enable Global section for proxy chain Global proxy chain toggle and options Saving Global proxy chain configuration

​
Open Forwarding proxies and add an entry

Forwarding proxies section Edit the default forwarding proxy entry Enable the forwarding proxy entry Add a reference comment for the forwarding proxy entry Entering parent proxy host or IP (192.168.27.100) In the example: my upstream proxy ip: 192.168.27.100 If the upstream proxy requires authentication, enter user name, password, and domain Entering parent proxy port In example: my upstream proxy listening on port 8080 Leave ICP peer type and ICP port at their defaults Selecting CONNECT as the forwarding proxy Type Selecting CONNECT and HTTP requests under Applies to Click Save Policy to save the forwarding proxy entry Forwarding proxy entry after saving

​
Test proxy chain connectivity

Open Reports to verify proxy chain connectivity Open Native logs under Reports Verifying traffic through parent proxy

​
Save configuration

Save configuration to apply proxy chain settings When the administrator clicks Save Config, a prompt asks for confirmation to store the configuration in the cloud. Select Yes only in below cases: to reuse this configuration in other SafeSquid instances. if the total configuration in all sections is completed and validated. Otherwise select No and click on submit.

​
Verification and Evidence

  • Interface Checks: In Configuration Portal, open Application Setup → Proxy chain. Confirm Global is enabled and the forwarding proxy entry shows the correct parent IP and port.
  • Log Analysis: Check SafeSquid access logs for requests showing the parent proxy as upstream; connection failures to the parent appear in logs with connect errors.
  • Performance Validation: From a client behind the child proxy, browse an external site; traffic should succeed and appear in both child and parent proxy logs.

​
Next steps