iptables --uid-owner Matches Squid’s Local Sockets, Not LAN Users
Use the local socket-creator meaning of --uid-owner when reasoning about Squid egress and keep forwarded LAN packets separate.
The iptables owner match can identify packets created by a local process’s socket. For example, -m owner --uid-owner 1234 refers to a local socket owned by UID 1234; it does not identify an HTTP proxy username.
On a machine running Squid, distinguish these paths:
| Traffic | Relevant distinction |
|---|---|
| A client connects to Squid on this machine | Incoming connection to the proxy listener |
| Squid opens a destination connection | Locally created outbound socket |
| A LAN client routes directly through this machine | Forwarded traffic with no local creator socket |
The extension is valid in OUTPUT and POSTROUTING. Forwarded packets have no associated local socket for this match, so a FORWARD rule cannot discover the remote computer’s user by asking for Squid’s UID.
A policy allowing Squid’s own outbound sockets therefore addresses only one part of a proxy-only network design. Gateway forwarding, listener access, other allowed services and the actual proxy service account must be handled in their appropriate scope.
Use the configured runtime identity rather than assuming Squid runs as nobody. Several processes can share one UID, so a UID-based allowance is an account boundary rather than proof that one particular executable created every permitted connection.