Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In squid.conf, there are directives for safe ports and ssl ports:

acl safe_ports (list of ports)
acl ssl_port 443


http_access deny !safe_ports
http_access deny !ssl_port

My question is: why the default for http_access is deny !safe_ports and !ssl_port, why not http_access allow safe_ports or http_access allow ssl_port ?

share|improve this question

migrated from Apr 25 '11 at 6:48

This question came from our site for professional and enthusiast programmers.

If you do something like:

http_access allow safe_ports

Then all your ports will be open unless you add a directive after it to deny every port access:

http_access deny unsafe_ports

where unsafe_ports is exactly !safe_ports, but it is much easier to define a list of safe ports, than a list of unsafe ports, since the later has almost 65536 entries.

Then it is a lot easier and probably more efficient to do

http_access deny !safe_ports
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.