Send Each Squid 7 Listener to Its Own Parent Proxy

For Squid 7, name each incoming listener and limit which parent is eligible for its requests:

http_port 3128 name=route_a
http_port 3129 name=route_b
acl via_a myportname route_a
acl via_b myportname route_b
cache_peer parent-a.example.net parent 8080 0 no-query name=parent_a
cache_peer parent-b.example.net parent 8080 0 no-query name=parent_b
cache_peer_access parent_a allow via_a
cache_peer_access parent_a deny all
cache_peer_access parent_b allow via_b
cache_peer_access parent_b deny all

Keep authenticated client access and required parent accounts configured separately. This routing fragment chooses eligible peers; it does not authorize clients or provide parent credentials. For an allowed public-destination test with no parent-proxy credentials configured, the HTTP proxy list supplies candidate public peers.

Narrowing eligible peers does not itself prohibit direct forwarding. If those exits are forbidden for the selected requests, add:

never_direct allow via_a
never_direct allow via_b

Review earlier always_direct rules and the full parent-selection configuration. Define whether an unavailable assigned parent must make forwarding fail or whether another explicitly approved route exists. A controlled forwarding request and parent-unavailable comparison can check that chosen outcome; a successful page alone can hide a wrong fallback.

The final public IP belongs to the last outward connection. Two different parents can share a NAT exit, so verify that address separately from listener and peer selection.

Use the peer reference for authentication/transport details. These interfaces apply to Squid 7 and earlier supporting releases; they are not available unchanged in Squid 8.