<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Aptos;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:11.0pt;
font-family:"Aptos",sans-serif;
mso-ligatures:standardcontextual;
mso-fareast-language:EN-US;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;
mso-ligatures:none;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-SG" link="#467886" vlink="#96607D" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">Hi Support,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I am running Squid 3.5.20 in AWS as a forward proxy (http_port 3128) to forward client traffic through a firewall to the Internet.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">The proxy works fine when placed behind a Network Load Balancer (NLB). However, when I place Squid behind an Application Load Balancer (ALB) on port 3128, Squid receives malformed requests and logs the following error:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> ERR_INVALID_URL<o:p></o:p></p>
<p class="MsoNormal"> HTTP/400 Bad Request<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">From my understanding, this happens because ALB only supports HTTP/HTTPS listeners and does not forward raw TCP traffic the way Squid expects on port 3128.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">My questions are:<o:p></o:p></p>
<p class="MsoNormal">1. Is there any Squid configuration that can make it compatible with AWS ALB (which handles HTTP only), while still operating as a forward proxy?<o:p></o:p></p>
<p class="MsoNormal">2. If not, are there recommended approaches to integrate Squid with AWS WAF (which requires ALB/CloudFront) so that Squid can still function as a forward proxy for outbound client HTTPS traffic?<o:p></o:p></p>
<p class="MsoNormal">3. Would switching to reverse proxy mode help in this case, or would that break HTTPS CONNECT tunneling?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Environment details: <o:p></o:p></p>
<p class="MsoNormal">- Squid 3.5.20 <o:p></o:p></p>
<p class="MsoNormal">- Deployed in AWS VPC <o:p></o:p></p>
<p class="MsoNormal">- Works with NLB, fails with ALB <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thank you for any guidance or suggestions. Hope to hear from you soon.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="font-size:12.0pt;mso-fareast-language:EN-SG">Thanks and regards,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt;mso-fareast-language:EN-SG"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt;mso-fareast-language:EN-SG">Tan Tang Suan<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt;mso-fareast-language:EN-SG">Mobile: 96228330<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt;mso-fareast-language:EN-SG"><o:p> </o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>