Map Squid Listener Ports to Outgoing Source IPs
Select Squid outgoing source addresses from named incoming listeners, accounting for routing, NAT, and connection reuse.
Four proxy ports do not automatically mean four public IPs. Squid normally lets the operating system choose a source address for its outward connection. To make the port choice meaningful, connect it to an explicit outgoing-address policy.
For Squid 7 configurations supporting these directives, a routing fragment can use named listeners:
http_port 3128 name=exit_a
http_port 3129 name=exit_b
acl on_a myportname exit_a
acl on_b myportname exit_b
tcp_outgoing_address 192.0.2.10 on_a
tcp_outgoing_address 192.0.2.11 on_bThe addresses are documentation placeholders. Replace them with addresses assigned and usable on your host. This adds routing to an already restricted proxy configuration; it does not supply authentication or client access rules.
Source selection is only part of the path
The outgoing address reference describes ordered matching and address-family selection. An IPv4 source cannot become the source of an IPv6 connection. With different providers for different addresses, the host's routing policy must use a compatible gateway for each.
An upstream NAT can translate two selected local addresses into one public address. The listener mapping can therefore work locally without producing the public identities you intended. A parent proxy can also become the final website-facing exit.
Existing connections deserve attention. Squid's documentation warns about client-dependent outgoing rules and server-side persistent connections. Reusing a connection established under an earlier policy can make a changed selection appear ineffective.
Interpret the website-facing address alongside the local policy and a fresh connection. A different incoming port is a selection signal, not an IP address allocation mechanism.