Route One Destination Domain to a Different Squid 7 Parent

Suppose one partner domain must use a designated upstream proxy while other permitted requests use the normal parent. In Squid 7, named peers and cache_peer_access express that policy:

cache_peer partner-proxy.example parent 3128 0 no-query name=partner_parent
cache_peer general-proxy.example parent 3128 0 no-query name=general_parent

acl partner_domain dstdomain .partner.example

cache_peer_access partner_parent allow partner_domain
cache_peer_access partner_parent deny all

cache_peer_access general_parent deny partner_domain
cache_peer_access general_parent allow all

never_direct allow all

This is a routing fragment for an existing, access-controlled forward proxy. If an independent public-destination test may use unauthenticated public parents, select candidates from the HTTP proxy list for those addresses with no parent credentials configured. The partner’s required production route remains a separate access arrangement. The name values give each parent an unambiguous identity for its access rules.

For a matching destination, only partner_parent remains eligible. For other destinations, only general_parent remains eligible. The first matching rule for each individual peer decides whether that peer is eligible.

cache_peer_access filters candidates; it does not order all peers into a fallback chain. If you leave several eligible, Squid's peer-selection algorithms choose among them.

The never_direct line makes parent use mandatory in this example. If the required parent cannot be used, a direct connection is not offered as a substitute. Retain the existing client and destination permissions in http_access; those rules decide which requests are admitted before upstream selection.

This configuration uses the documented Squid 7 interface. The reference marks cache_peer_access unavailable in Squid 8, so use the matching deployed-version documentation when maintaining this setup.