Squid Source Addresses and Host Gateway Routing
Separate Squid source-address selection from host routing when a proxy uses multiple interfaces or providers.
Binding Squid's outward connection to address A does not make the host use provider A. tcp_outgoing_address selects a local source; the operating system still chooses the route.
| Decision | Owner |
|---|---|
| Local outgoing TCP source | Squid's source-address rule. |
| Gateway and interface for that source | Host routing policy. |
| Public address seen by the website | The complete path, including any NAT or parent proxy. |
If A belongs to provider A but the default route uses provider B, B may reject that source or the return path may fail. A multihomed setup can need source-based policy routing. Its operating-system/network rules must fit this deployment; a copied default-route command can interrupt SSH and proxy sessions.
Record listener, intended outward source and compatible gateway. The client→Squid and Squid→destination connections can use different interfaces, and the return route to the client is another requirement.
The Squid directive controls the source selection, not route installation. Dante's internal/external binding distinction likewise cannot replace a usable path. A locally correct source can still be translated later, so verify the website-facing address separately.