# How to connect to Squid? **URL:** \ **Category:** Support\ **Created:** [April 7, 2025, 7:46am UTC](https://openziti.discourse.group/t/how-to-connect-to-squid/4312 "2025-04-07T07:46:51Z")\ **Posts on this page:** 16\ **Page:** 1
**Author:** ![Rantanplan](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/rantanplan/32/3353_2.png) [@Rantanplan](https://openziti.discourse.group/u/Rantanplan)\ **Post date:** [April 7, 2025, 7:46am UTC](https://openziti.discourse.group/t/how-to-connect-to-squid/4312/1 "2025-04-07T07:46:51Z")
Is it possible to use the CONNECT method over a public endpoint? My squid forward proxy uses port 90. I’ve tried: zrok share public localhost:90 The results are: curl --proxy [https://alphadigits.share.zrok.io/](https://alphadigits.share.zrok.io/)[Sharing HTTP Servers | zrok](https://docs.zrok.io/docs/concepts/http/) curl: (56) Received HTTP code 400 from proxy after CONNECT ---
**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\ **Post date:** [April 7, 2025, 7:02pm UTC](https://openziti.discourse.group/t/how-to-connect-to-squid/4312/2 "2025-04-07T19:02:53Z")
Hi @Rantanplan, welcome to the community and to zrok! I don't know if the CONNECT is forwarded. I'll see if I can get someone to reply authoritatively though. Cheers ---
**Author:** ![michael.quigley](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/michael.quigley/32/1123_2.png) [@michael.quigley](https://openziti.discourse.group/u/michael.quigley)\ **Post date:** [April 7, 2025, 7:14pm UTC](https://openziti.discourse.group/t/how-to-connect-to-squid/4312/3 "2025-04-07T19:14:19Z")
Honestly don't know. There is nothing in zrok itself that filters out HTTP verbs. But the instance running for [zrok.io](http://zrok.io) is behind AWS infrastructure that very well might be filtering out those requests? ---
**Author:** ![mguthrie88](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/mguthrie88/32/151_2.png) [@mguthrie88](https://openziti.discourse.group/u/mguthrie88)\ **Post date:** [April 7, 2025, 7:25pm UTC](https://openziti.discourse.group/t/how-to-connect-to-squid/4312/4 "2025-04-07T19:25:42Z")
Unfortunately the public shares from hosted zrok do not support the CONNECT method. They rely on AWS ALBs, which do not support it. I suspect it would work just fine over a private share though. ---
**Author:** ![Rantanplan](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/rantanplan/32/3353_2.png) [@Rantanplan](https://openziti.discourse.group/u/Rantanplan)\ **Post date:** [April 7, 2025, 9:48pm UTC](https://openziti.discourse.group/t/how-to-connect-to-squid/4312/5 "2025-04-07T21:48:14Z")
Yes. It works over the private share. ---
**Author:** ![Rantanplan](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/rantanplan/32/3353_2.png) [@Rantanplan](https://openziti.discourse.group/u/Rantanplan)\ **Post date:** [April 17, 2025, 12:33pm UTC](https://openziti.discourse.group/t/how-to-connect-to-squid/4312/6 "2025-04-17T12:33:42Z")
I have installed a self-hosted instance of zrok. zrok share public localhost:90, zrok frontend, zrok connector, ziti-router, ziti-connector are all on the same host. I confirm that the zrok proxy does not allow the CONNECT method. ```auto curl --proxy http://xxx.domain.name:port https://www.google.com curl: (56) Received HTTP code 404 from proxy after CONNECT ``` ---
**Author:** ![smilindave26](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/smilindave26/32/185_2.png) [@smilindave26](https://openziti.discourse.group/u/smilindave26)\ **Post date:** [April 17, 2025, 12:38pm UTC](https://openziti.discourse.group/t/how-to-connect-to-squid/4312/7 "2025-04-17T12:38:36Z")
Have you tried with backend mode tcpTunnel? ---
**Author:** ![Rantanplan](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/rantanplan/32/3353_2.png) [@Rantanplan](https://openziti.discourse.group/u/Rantanplan)\ **Post date:** [April 17, 2025, 12:46pm UTC](https://openziti.discourse.group/t/how-to-connect-to-squid/4312/8 "2025-04-17T12:46:28Z")
It is strange ```auto curl --proxy http://xxx.domain.name:port https://www.google.com curl: (56) Received HTTP code 404 from proxy after CONNECT ``` zrok access public etc/frontend.yml says: ```auto [2478.082] ERROR zrok/endpoints.GetRefreshedService: service 'www' not found [2478.082] WARNING zrok/endpoints/publicProxy.NewHTTP.shareHandler.func2: [IP]:35492 -> service 'www' not found ``` ---
**Author:** ![qrkourier](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/qrkourier/32/52_2.png) [@qrkourier](https://openziti.discourse.group/u/qrkourier)\ **Post date:** [April 17, 2025, 1:00pm UTC](https://openziti.discourse.group/t/how-to-connect-to-squid/4312/9 "2025-04-17T13:00:48Z")
Thank you for demonstrating that zrok's public frontends do not support `CONNECT` because they assume the first part of the domain name in the HOST header (the least significant DNS label) represents a public share "token." Your remaining options for a public `CONNECT` proxy with zrok include running a "personalized frontend" (`zrok access private`) on a public IP with, as @smilindave26 suggested, the `tcpTunnel` backend mode targeting your Squid forward proxy ([Personalized Frontend | zrok](https://docs.zrok.io/docs/guides/self-hosting/personalized-frontend/)). Finally, if your clients can use `SOCKS` instead of `CONNECT`, there's also a zrok private share backend mode `socks` (no target address:port required) that will egress from the share backend. List of private share modes: [Private Shares | zrok](https://docs.zrok.io/docs/concepts/sharing-private/#private-backend-modes) ---
**Author:** ![Rantanplan](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/rantanplan/32/3353_2.png) [@Rantanplan](https://openziti.discourse.group/u/Rantanplan)\ **Post date:** [April 17, 2025, 8:49pm UTC](https://openziti.discourse.group/t/how-to-connect-to-squid/4312/10 "2025-04-17T20:49:04Z")
I have tested a private proxy. On the share side zrok forwards all to Squid ```auto zrok share private localhost:90 --backend-mode proxy --headless ``` On the access side, ```auto zrok access private rgvq2mq9ljss ``` we try the simplest possible, the GET method over http ```auto curl --proxy http://127.0.0.1:9191 http://www.google.com/relative_path_to ``` Now what we see in squid's log file: ```auto 1744920849.438 1 127.0.0.1 NONE_NONE/400 3734 GET /relative_path_to - HIER_NONE/- "-" ``` Somewhere on the route the host has disappeared from url. There is no hope that _reverse_ and _forward_ proxies will accept it. Certainly private sock5 works fine. But it is a very restrictive scenario. With working zrok's proxy we can forward http/https to haproxy/squid. For the GET method over http we can do something like this on the haproxy side ```auto http-request set-var(txn.myhost) req.hdr(Host) http-request set-uri %[pathq] ``` But for https zrok's proxy does not allow CONNECT, moreover my ipad sends CONNECT without Host in the header 😀 , because the Host is in the uri. Firefox will send Host header also. Regarding the tcpTunnel. It works pretty well. Thank you! I have managed to connect a zrok's tcp tunnel to Squid and Danted. There is a nasty error however. ```auto Squid zrok share private 127.0.0.1:8080 --backend-mode tcpTunnel ERROR zrok/endpoints.TXer: read error '127.0.0.1:90' -> 'ziti-edge-router connId=2147483740, logical=ziti-sdk[router=tls:domian.name:3022]': read tcp 127.0.0.1:44650->127.0.0.1:90: use of closed network connection ERROR zrok/endpoints.TXer: read error '127.0.0.1:90' -> 'ziti-edge-router connId=2147483709, logical=ziti-sdk[router=tls:domian.name:3022]': read tcp 127.0.0.1:38430->127.0.0.1:90: use of closed network connection Danted zrok share private 127.0.0.1:8080 --backend-mode tcpTunnel ERROR zrok/endpoints.TXer: read error '127.0.0.1:8080' -> 'ziti-edge-router connId=2147483800, logical=ziti-sdk[router=tls:domian.name:3022]': read tcp 127.0.0.1:60658->127.0.0.1:8080: use of closed network connection ``` The similar thing goes on the access side: ```auto zrok access private 7t5wq3iarbgk --headless -v ERROR zrok/endpoints.TXer: read error '127.0.0.1:57218' -> 'ziti-edge-router connId=51, logical=ziti-sdk[router=tls:domian.name:3022]': read tcp 127.0.0.1:9191->127.0.0.1:57218: use of closed network connection ``` ---
**Author:** ![qrkourier](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/qrkourier/32/52_2.png) [@qrkourier](https://openziti.discourse.group/u/qrkourier)\ **Post date:** [April 22, 2025, 5:12pm UTC](https://openziti.discourse.group/t/how-to-connect-to-squid/4312/11 "2025-04-22T17:12:11Z")
Recap: You confirmed that `CONNECT` does not work with a `proxy` backend, regardless of whether the frontend is `zrok access public` or `zrok access private`. @smilindave26 recommended backend mode `tcpTunnel` because your goal is to pass through arbitrary bytes via TCP. > [@Rantanplan](#): > > Regarding the tcpTunnel. It works pretty well. Thank you! I have managed to connect a zrok's tcp tunnel to Squid and Danted. > > There is a nasty error however. Thanks for sharing the backend and frontend messages about "use of closed network connection." Can you clarify whether the TCP tunnel is functioning or if a malfunction is co-occurring with these messages? If Squid and Danted are not functioning via their respective TCP tunnels, then I'll gather additional details: Is Squid at 127.0.0.1:90 a CONNECT server? Is Danted at 127.0.0.1:8080 a SOCKS server? This message from the TCP tunnel backend seems to indicate a new request was received via the frontend for a connection (socket) that was previously closed by the CONNECT or SOCKS server. ---
**Author:** ![Rantanplan](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/rantanplan/32/3353_2.png) [@Rantanplan](https://openziti.discourse.group/u/Rantanplan)\ **Post date:** [April 22, 2025, 8:47pm UTC](https://openziti.discourse.group/t/how-to-connect-to-squid/4312/12 "2025-04-22T20:47:05Z")
> [@qrkourier](#): > > This message from the TCP tunnel backend seems to indicate a new request was received via the frontend for a connection (socket) that was previously closed by the CONNECT or SOCKS server. I tested with Squid and Danted. Two different programs produce exactly the same ERROR message. The both, Squid and Danted, work via the TCP tunnel. Squid accepts CONNECT at port 90 Danted accepts SOCK5 at port 8080 I have not noticed any malfunction - the internet browsing goes smoothly as usual. However the system's log will be huge. ```auto zrok share private 127.0.0.1:8080 --backend-mode tcpTunnel --headless --verbose ``` ```auto [509.605] DEBUG zrok/endpoints.TXer: exited 'ziti-edge-router connId=2147483697, logical=ziti-sdk[router=tls:mydomain.name:port]' -> '127.0.0.1:8080' [509.605] DEBUG sdk-golang/ziti/edge/network.(*edgeConn).Accept: {chSeq=[652] edgeSeq=[10] connId=[2147483697] type=[EdgeStateClosedType]} received 12 bytes (msg type: 60785) [509.605] DEBUG sdk-golang/ziti/edge/network.(*edgeConn).Accept: {connId=[2147483691] type=[EdgeStateClosedType] chSeq=[653] edgeSeq=[12]} received 12 bytes (msg type: 60785) [509.605] DEBUG sdk-golang/ziti/edge/network.(*edgeConn).Read: {connId=[2147483691] marker=[6agaWgbo]} received ConnState_CLOSED message, closing connection [509.605] DEBUG sdk-golang/ziti/edge/network.(*edgeConn).close: {connId=[2147483691] marker=[6agaWgbo]} close: begin [509.605] DEBUG sdk-golang/ziti/edge/network.(*edgeConn).close: {marker=[6agaWgbo] connId=[2147483691]} close: end [509.605] ERROR zrok/endpoints.TXer: read error '127.0.0.1:8080' -> 'ziti-edge-router connId=2147483691, logical=ziti-sdk[router=tls:mydomain.name:port]': read tcp 127.0.0.1:40702->127.0.0.1:8080: use of closed network connection [509.605] DEBUG zrok/endpoints.TXer: exited '127.0.0.1:8080' -> 'ziti-edge-router connId=2147483691, logical=ziti-sdk[router=tls:mydomain.name:port]' [509.605] DEBUG zrok/endpoints.TXer: exited 'ziti-edge-router connId=2147483691, logical=ziti-sdk[router=tls:mydomain.name:port]' -> '127.0.0.1:8080' [509.605] DEBUG sdk-golang/ziti/edge/network.(*edgeConn).Accept: {connId=[2147483694] type=[EdgeStateClosedType] chSeq=[654] edgeSeq=[11]} received 12 bytes (msg type: 60785) [509.606] DEBUG sdk-golang/ziti/edge/network.(*edgeConn).Read: {connId=[2147483694] marker=[MwX1QKTM]} received ConnState_CLOSED message, closing connection [509.606] DEBUG sdk-golang/ziti/edge/network.(*edgeConn).close: {connId=[2147483694] marker=[MwX1QKTM]} close: begin [509.606] DEBUG sdk-golang/ziti/edge/network.(*edgeConn).close: {connId=[2147483694] marker=[MwX1QKTM]} close: end [509.606] ERROR zrok/endpoints.TXer: read error '127.0.0.1:8080' -> 'ziti-edge-router connId=2147483694, logical=ziti-sdk[router=tls:mydomain.name:port]': read tcp 127.0.0.1:44956->127.0.0.1:8080: use of closed network connection [509.606] DEBUG zrok/endpoints.TXer: exited '127.0.0.1:8080' -> 'ziti-edge-router connId=2147483694, logical=ziti-sdk[router=tls:mydomain.name:port]' [509.606] DEBUG zrok/endpoints.TXer: exited 'ziti-edge-router connId=2147483694, logical=ziti-sdk[router=tls:mydomain.name:port]' -> '127.0.0.1:8080' [509.606] DEBUG sdk-golang/ziti/edge/network.(*edgeConn).Accept: {connId=[2147483693] type=[EdgeStateClosedType] chSeq=[655] edgeSeq=[11]} received 12 bytes (msg type: 60785) [509.606] DEBUG sdk-golang/ziti/edge/network.(*edgeConn).Read: {connId=[2147483693] marker=[QJlmGF6I]} received ConnState_CLOSED message, closing connection [509.606] DEBUG sdk-golang/ziti/edge/network.(*edgeConn).close: {connId=[2147483693] marker=[QJlmGF6I]} close: begin [509.606] DEBUG sdk-golang/ziti/edge/network.(*edgeConn).close: {connId=[2147483693] marker=[QJlmGF6I]} close: end [509.606] ERROR zrok/endpoints.TXer: read error '127.0.0.1:8080' -> 'ziti-edge-router connId=2147483693, logical=ziti-sdk[router=tls:mydomain.name:port]': read tcp 127.0.0.1:59882->127.0.0.1:8080: use of closed network connection ``` ---
**Author:** ![qrkourier](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/qrkourier/32/52_2.png) [@qrkourier](https://openziti.discourse.group/u/qrkourier)\ **Post date:** [April 22, 2025, 9:45pm UTC](https://openziti.discourse.group/t/how-to-connect-to-squid/4312/13 "2025-04-22T21:45:44Z")
I'm glad to hear it's working now with a private TCP tunnel! I will keep an eye out for this "use of closed network connection" message in hopes of understanding whether it could represent a problem and if it's unique to TCP tunnels or CONNECT proxies. ---
**Author:** ![Rantanplan](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/rantanplan/32/3353_2.png) [@Rantanplan](https://openziti.discourse.group/u/Rantanplan)\ **Post date:** [May 3, 2025, 3:49pm UTC](https://openziti.discourse.group/t/how-to-connect-to-squid/4312/14 "2025-05-03T15:49:39Z")
Here is my squid configuration: ```auto http_port 127.0.0.1:90 tcpkeepalive=30,30,120 ``` But squid continues to close not used connections with a timeout = 2 mins. Does zrok support _tpc keep live_? ```auto May 03 15:43:12 zrok-proxy.bash[732496]: {"file":"/__w/zrok/zrok/endpoints/txer.go:33","func":"github.com/openziti/zrok/endpoints.TXer","level":"error","msg":"read error '127.0.0.1:90' -\u003e 'ziti-edge-router connId=2147484515, logical=ziti-sdk[router=tls:lambda29.rantanplan.ru:465]': read tcp 127.0.0.1:35824-\u003e127.0.0.1:90: use of closed network connection","time":"2025-05-03T15:43:12.552Z"} ``` ---
**Author:** ![michael.quigley](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/michael.quigley/32/1123_2.png) [@michael.quigley](https://openziti.discourse.group/u/michael.quigley)\ **Post date:** [May 3, 2025, 4:40pm UTC](https://openziti.discourse.group/t/how-to-connect-to-squid/4312/15 "2025-05-03T16:40:16Z")
zrok TCP connections are standard c-library TCP sockets, so they support whatever is configured in your operating system. ---
**Author:** ![Rantanplan](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/rantanplan/32/3353_2.png) [@Rantanplan](https://openziti.discourse.group/u/Rantanplan)\ **Post date:** [May 4, 2025, 9:25am UTC](https://openziti.discourse.group/t/how-to-connect-to-squid/4312/16 "2025-05-04T09:25:16Z")
The message itself might be misleading since there is nothing unusual in Squid closes the connection after the remote http server has closed the tcp session. On a contrary it is the standand situation. ```auto {"file":"/__w/zrok/zrok/endpoints/txer.go:33","func":"github.com/openziti/zrok/endpoints.TXer","level":"error","msg":"read error '127.0.0.1:90' -\u003e 'ziti-edge-router connId=2147485961, logical=ziti-sdk[router=tls:router.domain.name:rport]': read tcp 127.0.0.1:42254-\u003e127.0.0.1:90: use of closed network connection","time":"2025-05-04T06:47:46.101Z"} ``` I set squid's timeout=1 day and I still have these _error_ messages.