Squid Went Direct. Your Browser Still Used Squid.

The access log says DIRECT, but the browser still connects to Squid. That is an expected combination.

For Squid releases supporting always_direct, the directive tells Squid to reach the origin without using a parent or sibling. It changes the next hop after Squid. It does not rewrite the browser's earlier proxy decision.

browser → Squid → origin
browser → origin

Only the second path bypasses Squid from the client's perspective. To request that path, configure the participating client through its supported exception or PAC policy.

This distinction matters when the intended fix is reaching an internal device from the workstation. Squid going direct means the device is reached from Squid's network. That may be another machine, another subnet, and another source address entirely.

Keep authorization separate too. A peer-selection directive does not grant permission to use the proxy, and it does not disable object caching. Preserve the restricted access policy while changing the intended onward route.

When reporting the result, name the hop that went direct. The unqualified word “bypass” hides precisely the information needed to tell whether the configuration changed the right connection.