Squid QoS: Classify the Proxy’s New Outbound Connections
Place bandwidth classification where the proxy opens its server-side stream instead of expecting the original packet identity to survive.
A client-source filter can match the laptop on the LAN side and miss all of Squid's Internet-side packets. Squid terminates the client connection and opens another one, so the outgoing source address is ordinarily the proxy's.
| What you want to control | Where the relevant work happens |
|---|---|
| Police incoming client traffic | The client-to-proxy path |
| Schedule responses sent to clients | The proxy's client-facing outbound queue |
| Classify proxy-to-origin traffic | The new server-side connection |
These placements are not interchangeable. An ingress policer drops excess packets; an outbound scheduler manages a sending queue. Pick the direction and unit—rate, bytes or concurrent work—before choosing a classifier.
For Squid 6 and 7, tcp_outgoing_tos can select a server-side TOS or Diffserv value using ACLs. This deliberately carries a policy signal to another classifier rather than preserving the client's original packet source.
Define that signal inside a domain that controls it. DSCP values are not user credentials: other senders can use the same mark and downstream devices can replace it. A reused server-side connection can also carry multiple requests, so consult the deployed version's persistent-connection and QoS behavior before assuming each request can relabel the stream independently.
For a per-user allowance, enforce at a point with the required application identity. A packet mark helps carry a class; it does not recreate identity that the selected connection no longer carries.