Forward Squid Through a DigitalOcean TCP Load Balancer

Use matching TCP entry and target protocols for an existing DigitalOcean resource when the path must preserve forward HTTP and CONNECT.

For an existing DigitalOcean load-balancer resource, preserve the client's proxy byte stream with matching TCP protocols:

forwarding_rule {
  entry_port      = 3128
  entry_protocol  = "tcp"
  target_port     = 3128
  target_protocol = "tcp"
}

Keep the actual target, network restrictions and health checks around this fragment. The client uses the load balancer address and Squid receives the stream on its listener.

A forward proxy accepts absolute-form HTTP targets and CONNECT for HTTPS. Ordinary HTTP load-balancing mode must explicitly support those conversations; calling the listener HTTP does not establish that compatibility.

Verify more than the port: a TCP health check proves acceptance, while an authenticated CONNECT to a permitted target exercises the proxy contract.

Check the source address Squid sees before relying on IP authorization. PROXY-protocol metadata, if used, requires support at both ends and adds bytes before the proxy request. Drain live tunnels deliberately during target maintenance; abruptly removing their process interrupts them.

Ũhoro ũhĩtĩte