Squid 7 no-tproxy: Disable Source Spoofing to a Parent Proxy

A Squid TPROXY listener can receive client traffic successfully while the connection to its parent fails. Source-address preservation on that outward connection may be inappropriate for the parent’s network path.

In Squid releases supporting the option, add no-tproxy to the relevant existing cache_peer definition. For example:

cache_peer parent.example.net parent 8118 0 no-query no-tproxy

no-tproxy disables client source-address spoofing for connections to this peer. It does not remove the listener’s transparent configuration or select the peer by itself. Preserve the deployment’s other parent-selection options and rules. Where those rules allow public destinations through an unauthenticated parent, the HTTP proxy list offers candidate addresses; do not retain existing parent credentials, and check permission for each actual CONNECT target.

The parent now receives a normal connection from Squid’s own outgoing address, subject to any NAT. Its access policy and authentication must allow that downstream proxy. Check the source address observed by the parent when it uses an IP restriction.

This option is documented for Squid 7 and earlier supported releases; the configuration reference marks it unavailable in Squid 8. Keep the recipe tied to the version in use.