Squid tcp_outgoing_mark and Linux fwmark Routing

Classify selected proxy requests with tcp_outgoing_mark and let an existing Linux fwmark rule choose their route.

Squid can classify a request using information that an ordinary IP route does not have. In a supported Linux build, tcp_outgoing_mark assigns a server-side Netfilter mark based on a fast ACL:

acl selected_sites dstdomain -n .vendor.example
tcp_outgoing_mark 0x20 selected_sites
tcp_outgoing_mark 0x00 all

A matching Linux policy rule can then use fwmark 0x20 to select an already configured routing table. The table still needs the correct routes and reachable next hop. The Squid directive does not create them.

This mark is local routing metadata. It is different from a DSCP or TOS field carried in an IP packet, and from tcp_outgoing_address selecting a source IP.

The documented directive requires Linux packet-mark and capability support and accepts only fast ACLs. It is available in Squid 7 and earlier listed releases, not Squid 8.

Define the policy around the actual outward connections. Reused TCP connections do not become fresh connections merely because another HTTP request uses them. Keep the client-facing return path and unmarked traffic’s route in the design as well.

Winndannde jowitiiɗe heen