• ISP with proxy server
  • local TOR service

I would like to automatically let all .onion-domain traffic go to the local TOR-service and all other traffic to the ISP proxy (am using TOR only to browse the hidden TOR sites, not for privacy).

Now I was thinking of using Squid for that. Squid can automatically select a parent proxy depending on the target (with the plus that it then also caches the slow tor sites) but I could not find a way to let it connect to the TOR socks5 service. Anyone got an idea how to do this?


1 Answer 1


Depending on which browser you are using, using a proxy auto-config file might work best. Most modern browsers will support this.

Something like this should be a good start:

function FindProxyForURL(url, host) {

    isp = "PROXY ip_address:port; DIRECT";
    tor = "SOCKS";

    if (shExpMatch(host,"*.onion")) {
        return tor;

    return "DIRECT";


put that somewhere like $HOME/.proxy_pac, and then in your "Automatic Proxy Configuration URL" put the URL path to the file: file:///home/user/.proxy_pac.

  • Tried it but can't get it to work: chrome tries to resolve the address by itself and fails to do that. I tried changing the bind9 configuration by adding "forwarders { port 530; [isp dns] }; but this doesn't fork for some reason altough bind9 accepts the port statement (tcpdump shows though that no traffic goes from local bind to that local 530 port). Nov 30, 2011 at 19:25
  • I've read that some people have trouble with Chrome and proxy settings, but there is a way you can do it. you need to start Google Chrome with --proxy-pac-url=file:///home/user/.proxy_pac argument. That should get Chrome to play along with your pac file. Dec 1, 2011 at 0:18
  • Tim, it is not that chrome doesn't use the proxy pac file, it is that it still tries to resolve the url by itself and not via the socks5 service as exported by tor. Dec 1, 2011 at 12:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .