Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

There is a line in squid default configuration:

# Deny CONNECT to other than secure SSL ports
http_access deny CONNECT !SSL_ports

acls are applied from top down, so CONNECT acl will deny access to all non SSL and SSL ports. I mean it never reaches the second access rule.

share|improve this question
up vote 1 down vote accepted

CONNECT here means the HTTPS CONNECT method, i.e., the standardized way a browser talks to a proxy server, asking for a connection to an HTTPS-serving site

http_access deny CONNECT !SSL_ports means 'deny all HTTPS CONNECT that asks to be connected to a port other than SSL_ports'. If the browser sends a CONNECT method asking to be connected to an SSL_port, the rule doesn't fire.

Whether or not the CONNECT actually gets through depends on the successive http_access rules.

share|improve this answer
So the acls after http_access deny are conjoined with a logical AND. am I right? – Majid Azimi Apr 25 '11 at 5:40
@Majid yes. In general, everything on the same line are conjoined with logical AND, while rules on different lines are conjoined with logical OR – pepoluan Apr 25 '11 at 8:03

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.