+ <p>
+ Assigns the value <tt class="LITERAL">/etc/privoxy</tt> to the option
+ <tt class="LITERAL">confdir</tt> and thus indicates that the
+ configuration directory is named <span class=
+ "QUOTE">"/etc/privoxy/"</span>.
+ </p>
+ <p>
+ All options in the config file except for <tt class=
+ "LITERAL">confdir</tt> and <tt class="LITERAL">logdir</tt> are
+ optional. Watch out in the below description for what happens if you
+ leave them unset.
+ </p>
+ <p>
+ The main config file controls all aspects of <span class=
+ "APPLICATION">Privoxy</span>'s operation that are not location
+ dependent (i.e. they apply universally, no matter where you may be
+ surfing). Like the filter and action files, the config file is a
+ plain text file and can be modified with a text editor like emacs,
+ vim or notepad.exe.
+ </p>
+ <div class="SECT2">
+ <h2 class="SECT2">
+ <a name="LOCAL-SET-UP">7.1. Local Set-up Documentation</a>
+ </h2>
+ <p>
+ If you intend to operate <span class="APPLICATION">Privoxy</span>
+ for more users than just yourself, it might be a good idea to let
+ them know how to reach you, what you block and why you do that,
+ your policies, etc.
+ </p>
+ <div class="SECT3">
+ <h4 class="SECT3">
+ <a name="USER-MANUAL">7.1.1. user-manual</a>
+ </h4>
+ <div class="VARIABLELIST">
+ <dl>
+ <dt>
+ Specifies:
+ </dt>
+ <dd>
+ <p>
+ Location of the <span class="APPLICATION">Privoxy</span>
+ User Manual.
+ </p>
+ </dd>
+ <dt>
+ Type of value:
+ </dt>
+ <dd>
+ <p>
+ A fully qualified URI
+ </p>
+ </dd>
+ <dt>
+ Default value:
+ </dt>
+ <dd>
+ <p>
+ <span class="emphasis"><i class="EMPHASIS">Unset</i></span>
+ </p>
+ </dd>
+ <dt>
+ Effect if unset:
+ </dt>
+ <dd>
+ <p>
+ <a href="https://www.privoxy.org/user-manual/" target=
+ "_top">https://www.privoxy.org/<tt class=
+ "REPLACEABLE"><i>version</i></tt>/user-manual/</a> will be
+ used, where <tt class="REPLACEABLE"><i>version</i></tt> is
+ the <span class="APPLICATION">Privoxy</span> version.
+ </p>
+ </dd>
+ <dt>
+ Notes:
+ </dt>
+ <dd>
+ <p>
+ The User Manual URI is the single best source of
+ information on <span class="APPLICATION">Privoxy</span>,
+ and is used for help links from some of the internal CGI
+ pages. The manual itself is normally packaged with the
+ binary distributions, so you probably want to set this to a
+ locally installed copy.
+ </p>
+ <p>
+ Examples:
+ </p>
+ <p>
+ The best all purpose solution is simply to put the full
+ local <tt class="LITERAL">PATH</tt> to where the <i class=
+ "CITETITLE">User Manual</i> is located:
+ </p>
+ <p>
+ </p>
+ <table border="0" bgcolor="#E0E0E0" width="90%">
+ <tr>
+ <td>
+<pre class="SCREEN">
+ user-manual /usr/share/doc/privoxy/user-manual
+</pre>
+ </td>
+ </tr>
+ </table>
+
+ <p>
+ The User Manual is then available to anyone with access to
+ <span class="APPLICATION">Privoxy</span>, by following the
+ built-in URL: <tt class=
+ "LITERAL">http://config.privoxy.org/user-manual/</tt> (or
+ the shortcut: <tt class=
+ "LITERAL">http://p.p/user-manual/</tt>).
+ </p>
+ <p>
+ If the documentation is not on the local system, it can be
+ accessed from a remote server, as:
+ </p>
+ <p>
+ </p>
+ <table border="0" bgcolor="#E0E0E0" width="90%">
+ <tr>
+ <td>
+<pre class="SCREEN">
+ user-manual http://example.com/privoxy/user-manual/
+</pre>
+ </td>
+ </tr>
+ </table>
+
+ <div class="WARNING">
+ <table class="WARNING" border="1" width="90%">
+ <tr>
+ <td align="CENTER">
+ <b>Warning</b>
+ </td>
+ </tr>
+ <tr>
+ <td align="LEFT">
+ <p>
+ If set, this option should be <span class=
+ "emphasis"><i class="EMPHASIS">the first option in
+ the config file</i></span>, because it is used
+ while the config file is being read on start-up.
+ </p>
+ </td>
+ </tr>
+ </table>
+ </div>
+ </dd>
+ </dl>
+ </div>
+ </div>
+ <div class="SECT3">
+ <h4 class="SECT3">
+ <a name="TRUST-INFO-URL">7.1.2. trust-info-url</a>
+ </h4>
+ <div class="VARIABLELIST">
+ <dl>
+ <dt>
+ Specifies:
+ </dt>
+ <dd>
+ <p>
+ A URL to be displayed in the error page that users will see
+ if access to an untrusted page is denied.
+ </p>
+ </dd>
+ <dt>
+ Type of value:
+ </dt>
+ <dd>
+ <p>
+ URL
+ </p>
+ </dd>
+ <dt>
+ Default value:
+ </dt>
+ <dd>
+ <p>
+ <span class="emphasis"><i class="EMPHASIS">Unset</i></span>
+ </p>
+ </dd>
+ <dt>
+ Effect if unset:
+ </dt>
+ <dd>
+ <p>
+ No links are displayed on the "untrusted" error page.
+ </p>
+ </dd>
+ <dt>
+ Notes:
+ </dt>
+ <dd>
+ <p>
+ The value of this option only matters if the experimental
+ trust mechanism has been activated. (See <a href=
+ "config.html#TRUSTFILE"><span class="emphasis"><i class=
+ "EMPHASIS">trustfile</i></span></a> below.)
+ </p>
+ <p>
+ If you use the trust mechanism, it is a good idea to write
+ up some on-line documentation about your trust policy and
+ to specify the URL(s) here. Use multiple times for multiple
+ URLs.
+ </p>
+ <p>
+ The URL(s) should be added to the trustfile as well, so
+ users don't end up locked out from the information on why
+ they were locked out in the first place!
+ </p>
+ </dd>
+ </dl>
+ </div>
+ </div>
+ <div class="SECT3">
+ <h4 class="SECT3">
+ <a name="ADMIN-ADDRESS">7.1.3. admin-address</a>
+ </h4>
+ <div class="VARIABLELIST">
+ <dl>
+ <dt>
+ Specifies:
+ </dt>
+ <dd>
+ <p>
+ An email address to reach the <span class=
+ "APPLICATION">Privoxy</span> administrator.
+ </p>
+ </dd>
+ <dt>
+ Type of value:
+ </dt>
+ <dd>
+ <p>
+ Email address
+ </p>
+ </dd>
+ <dt>
+ Default value:
+ </dt>
+ <dd>
+ <p>
+ <span class="emphasis"><i class="EMPHASIS">Unset</i></span>
+ </p>
+ </dd>
+ <dt>
+ Effect if unset:
+ </dt>
+ <dd>
+ <p>
+ No email address is displayed on error pages and the CGI
+ user interface.
+ </p>
+ </dd>
+ <dt>
+ Notes:
+ </dt>
+ <dd>
+ <p>
+ If both <tt class="LITERAL">admin-address</tt> and <tt
+ class="LITERAL">proxy-info-url</tt> are unset, the whole
+ "Local Privoxy Support" box on all generated pages will not
+ be shown.
+ </p>
+ </dd>
+ </dl>
+ </div>
+ </div>
+ <div class="SECT3">
+ <h4 class="SECT3">
+ <a name="PROXY-INFO-URL">7.1.4. proxy-info-url</a>
+ </h4>
+ <div class="VARIABLELIST">
+ <dl>
+ <dt>
+ Specifies:
+ </dt>
+ <dd>
+ <p>
+ A URL to documentation about the local <span class=
+ "APPLICATION">Privoxy</span> setup, configuration or
+ policies.
+ </p>
+ </dd>
+ <dt>
+ Type of value:
+ </dt>
+ <dd>
+ <p>
+ URL
+ </p>
+ </dd>
+ <dt>
+ Default value:
+ </dt>
+ <dd>
+ <p>
+ <span class="emphasis"><i class="EMPHASIS">Unset</i></span>
+ </p>
+ </dd>
+ <dt>
+ Effect if unset:
+ </dt>
+ <dd>
+ <p>
+ No link to local documentation is displayed on error pages
+ and the CGI user interface.
+ </p>
+ </dd>
+ <dt>
+ Notes:
+ </dt>
+ <dd>
+ <p>
+ If both <tt class="LITERAL">admin-address</tt> and <tt
+ class="LITERAL">proxy-info-url</tt> are unset, the whole
+ "Local Privoxy Support" box on all generated pages will not
+ be shown.
+ </p>
+ <p>
+ This URL shouldn't be blocked ;-)
+ </p>
+ </dd>
+ </dl>
+ </div>
+ </div>
+ </div>
+ <div class="SECT2">
+ <h2 class="SECT2">
+ <a name="CONF-LOG-LOC">7.2. Configuration and Log File
+ Locations</a>
+ </h2>
+ <p>
+ <span class="APPLICATION">Privoxy</span> can (and normally does)
+ use a number of other files for additional configuration, help and
+ logging. This section of the configuration file tells <span class=
+ "APPLICATION">Privoxy</span> where to find those other files.
+ </p>
+ <p>
+ The user running <span class="APPLICATION">Privoxy</span>, must
+ have read permission for all configuration files, and write
+ permission to any files that would be modified, such as log files
+ and actions files.
+ </p>
+ <div class="SECT3">
+ <h4 class="SECT3">
+ <a name="CONFDIR">7.2.1. confdir</a>
+ </h4>
+ <div class="VARIABLELIST">
+ <dl>
+ <dt>
+ Specifies:
+ </dt>
+ <dd>
+ <p>
+ The directory where the other configuration files are
+ located.
+ </p>
+ </dd>
+ <dt>
+ Type of value:
+ </dt>
+ <dd>
+ <p>
+ Path name
+ </p>
+ </dd>
+ <dt>
+ Default value:
+ </dt>
+ <dd>
+ <p>
+ /etc/privoxy (Unix) <span class="emphasis"><i class=
+ "EMPHASIS">or</i></span> <span class=
+ "APPLICATION">Privoxy</span> installation dir (Windows)
+ </p>
+ </dd>
+ <dt>
+ Effect if unset:
+ </dt>
+ <dd>
+ <p>
+ <span class="emphasis"><i class=
+ "EMPHASIS">Mandatory</i></span>
+ </p>
+ </dd>
+ <dt>
+ Notes:
+ </dt>
+ <dd>
+ <p>
+ No trailing <span class="QUOTE">"<tt class=
+ "LITERAL">/</tt>"</span>, please.
+ </p>
+ </dd>
+ </dl>
+ </div>
+ </div>
+ <div class="SECT3">
+ <h4 class="SECT3">
+ <a name="TEMPLDIR">7.2.2. templdir</a>
+ </h4>
+ <div class="VARIABLELIST">
+ <dl>
+ <dt>
+ Specifies:
+ </dt>
+ <dd>
+ <p>
+ An alternative directory where the templates are loaded
+ from.
+ </p>
+ </dd>
+ <dt>
+ Type of value:
+ </dt>
+ <dd>
+ <p>
+ Path name
+ </p>
+ </dd>
+ <dt>
+ Default value:
+ </dt>
+ <dd>
+ <p>
+ unset
+ </p>
+ </dd>
+ <dt>
+ Effect if unset:
+ </dt>
+ <dd>
+ <p>
+ The templates are assumed to be located in
+ confdir/template.
+ </p>
+ </dd>
+ <dt>
+ Notes:
+ </dt>
+ <dd>
+ <p>
+ <span class="APPLICATION">Privoxy's</span> original
+ templates are usually overwritten with each update. Use
+ this option to relocate customized templates that should be
+ kept. As template variables might change between updates,
+ you shouldn't expect templates to work with <span class=
+ "APPLICATION">Privoxy</span> releases other than the one
+ they were part of, though.
+ </p>
+ </dd>
+ </dl>
+ </div>
+ </div>
+ <div class="SECT3">
+ <h4 class="SECT3">
+ <a name="TEMPORARY-DIRECTORY">7.2.3. temporary-directory</a>
+ </h4>
+ <div class="VARIABLELIST">
+ <dl>
+ <dt>
+ Specifies:
+ </dt>
+ <dd>
+ <p>
+ A directory where Privoxy can create temporary files.
+ </p>
+ </dd>
+ <dt>
+ Type of value:
+ </dt>
+ <dd>
+ <p>
+ Path name
+ </p>
+ </dd>
+ <dt>
+ Default value:
+ </dt>
+ <dd>
+ <p>
+ unset
+ </p>
+ </dd>
+ <dt>
+ Effect if unset:
+ </dt>
+ <dd>
+ <p>
+ No temporary files are created, external filters don't
+ work.
+ </p>
+ </dd>
+ <dt>
+ Notes:
+ </dt>
+ <dd>
+ <p>
+ To execute <tt class="LITERAL"><a href=
+ "actions-file.html#EXTERNAL-FILTER" target="_top">external
+ filters</a></tt>, <span class="APPLICATION">Privoxy</span>
+ has to create temporary files. This directive specifies the
+ directory the temporary files should be written to.
+ </p>
+ <p>
+ It should be a directory only <span class=
+ "APPLICATION">Privoxy</span> (and trusted users) can
+ access.
+ </p>
+ </dd>
+ </dl>
+ </div>
+ </div>
+ <div class="SECT3">
+ <h4 class="SECT3">
+ <a name="LOGDIR">7.2.4. logdir</a>
+ </h4>
+ <div class="VARIABLELIST">
+ <dl>
+ <dt>
+ Specifies:
+ </dt>
+ <dd>
+ <p>
+ The directory where all logging takes place (i.e. where the
+ <tt class="FILENAME">logfile</tt> is located).
+ </p>
+ </dd>
+ <dt>
+ Type of value:
+ </dt>
+ <dd>
+ <p>
+ Path name
+ </p>
+ </dd>
+ <dt>
+ Default value:
+ </dt>
+ <dd>
+ <p>
+ /var/log/privoxy (Unix) <span class="emphasis"><i class=
+ "EMPHASIS">or</i></span> <span class=
+ "APPLICATION">Privoxy</span> installation dir (Windows)
+ </p>
+ </dd>
+ <dt>
+ Effect if unset:
+ </dt>
+ <dd>
+ <p>
+ <span class="emphasis"><i class=
+ "EMPHASIS">Mandatory</i></span>
+ </p>
+ </dd>
+ <dt>
+ Notes:
+ </dt>
+ <dd>
+ <p>
+ No trailing <span class="QUOTE">"<tt class=
+ "LITERAL">/</tt>"</span>, please.
+ </p>
+ </dd>
+ </dl>
+ </div>
+ </div>
+ <div class="SECT3">
+ <h4 class="SECT3">
+ <a name="ACTIONSFILE">7.2.5. actionsfile</a>
+ </h4>
+ <a name="DEFAULT.ACTION"></a><a name="STANDARD.ACTION"></a><a name=
+ "USER.ACTION"></a>
+ <div class="VARIABLELIST">
+ <dl>
+ <dt>
+ Specifies:
+ </dt>
+ <dd>
+ <p>
+ The <a href="actions-file.html">actions file(s)</a> to use
+ </p>
+ </dd>
+ <dt>
+ Type of value:
+ </dt>
+ <dd>
+ <p>
+ Complete file name, relative to <tt class=
+ "LITERAL">confdir</tt>
+ </p>
+ </dd>
+ <dt>
+ Default values:
+ </dt>
+ <dd>
+ <table border="0">
+ <tbody>
+ <tr>
+ <td>
+ <p class="LITERALLAYOUT">
+ match-all.action # Actions that are applied to all sites and maybe overruled later on.
+ </p>
+ </td>
+ </tr>
+ <tr>
+ <td>
+ <p class="LITERALLAYOUT">
+ default.action # Main actions file
+ </p>
+ </td>
+ </tr>
+ <tr>
+ <td>
+ <p class="LITERALLAYOUT">
+ user.action # User customizations
+ </p>
+ </td>
+ </tr>
+ </tbody>
+ </table>
+ </dd>
+ <dt>
+ Effect if unset:
+ </dt>
+ <dd>
+ <p>
+ No actions are taken at all. More or less neutral proxying.
+ </p>
+ </dd>
+ <dt>
+ Notes:
+ </dt>
+ <dd>
+ <p>
+ Multiple <tt class="LITERAL">actionsfile</tt> lines are
+ permitted, and are in fact recommended!
+ </p>
+ <p>
+ The default values are <tt class=
+ "FILENAME">default.action</tt>, which is the <span class=
+ "QUOTE">"main"</span> actions file maintained by the
+ developers, and <tt class="FILENAME">user.action</tt>,
+ where you can make your personal additions.
+ </p>
+ <p>
+ Actions files contain all the per site and per URL
+ configuration for ad blocking, cookie management, privacy
+ considerations, etc.
+ </p>
+ </dd>
+ </dl>
+ </div>
+ </div>
+ <div class="SECT3">
+ <h4 class="SECT3">
+ <a name="FILTERFILE">7.2.6. filterfile</a>
+ </h4>
+ <a name="DEFAULT.FILTER"></a>
+ <div class="VARIABLELIST">
+ <dl>
+ <dt>
+ Specifies:
+ </dt>
+ <dd>
+ <p>
+ The <a href="filter-file.html">filter file(s)</a> to use
+ </p>
+ </dd>
+ <dt>
+ Type of value:
+ </dt>
+ <dd>
+ <p>
+ File name, relative to <tt class="LITERAL">confdir</tt>
+ </p>
+ </dd>
+ <dt>
+ Default value:
+ </dt>
+ <dd>
+ <p>
+ default.filter (Unix) <span class="emphasis"><i class=
+ "EMPHASIS">or</i></span> default.filter.txt (Windows)
+ </p>
+ </dd>
+ <dt>
+ Effect if unset:
+ </dt>
+ <dd>
+ <p>
+ No textual content filtering takes place, i.e. all <tt
+ class="LITERAL">+<a href=
+ "actions-file.html#FILTER">filter</a>{<tt class=
+ "REPLACEABLE"><i>name</i></tt>}</tt> actions in the actions
+ files are turned neutral.
+ </p>
+ </dd>
+ <dt>
+ Notes:
+ </dt>
+ <dd>
+ <p>
+ Multiple <tt class="LITERAL">filterfile</tt> lines are
+ permitted.
+ </p>
+ <p>
+ The <a href="filter-file.html">filter files</a> contain
+ content modification rules that use <a href=
+ "appendix.html#REGEX">regular expressions</a>. These rules
+ permit powerful changes on the content of Web pages, and
+ optionally the headers as well, e.g., you could try to
+ disable your favorite JavaScript annoyances, re-write the
+ actual displayed text, or just have some fun playing
+ buzzword bingo with web pages.
+ </p>
+ <p>
+ The <tt class="LITERAL">+<a href=
+ "actions-file.html#FILTER">filter</a>{<tt class=
+ "REPLACEABLE"><i>name</i></tt>}</tt> actions rely on the
+ relevant filter (<tt class="REPLACEABLE"><i>name</i></tt>)
+ to be defined in a filter file!
+ </p>
+ <p>
+ A pre-defined filter file called <tt class=
+ "FILENAME">default.filter</tt> that contains a number of
+ useful filters for common problems is included in the
+ distribution. See the section on the <tt class="LITERAL"><a
+ href="actions-file.html#FILTER">filter</a></tt> action for
+ a list.
+ </p>
+ <p>
+ It is recommended to place any locally adapted filters into
+ a separate file, such as <tt class=
+ "FILENAME">user.filter</tt>.
+ </p>
+ </dd>
+ </dl>
+ </div>
+ </div>
+ <div class="SECT3">
+ <h4 class="SECT3">
+ <a name="LOGFILE">7.2.7. logfile</a>
+ </h4>
+ <div class="VARIABLELIST">
+ <dl>
+ <dt>
+ Specifies:
+ </dt>
+ <dd>
+ <p>
+ The log file to use
+ </p>
+ </dd>
+ <dt>
+ Type of value:
+ </dt>
+ <dd>
+ <p>
+ File name, relative to <tt class="LITERAL">logdir</tt>
+ </p>
+ </dd>
+ <dt>
+ Default value:
+ </dt>
+ <dd>
+ <p>
+ <span class="emphasis"><i class="EMPHASIS">Unset (commented
+ out)</i></span>. When activated: logfile (Unix) <span
+ class="emphasis"><i class="EMPHASIS">or</i></span>
+ privoxy.log (Windows).
+ </p>
+ </dd>
+ <dt>
+ Effect if unset:
+ </dt>
+ <dd>
+ <p>
+ No logfile is written.
+ </p>
+ </dd>
+ <dt>
+ Notes:
+ </dt>
+ <dd>
+ <p>
+ The logfile is where all logging and error messages are
+ written. The level of detail and number of messages are set
+ with the <tt class="LITERAL">debug</tt> option (see below).
+ The logfile can be useful for tracking down a problem with
+ <span class="APPLICATION">Privoxy</span> (e.g., it's not
+ blocking an ad you think it should block) and it can help
+ you to monitor what your browser is doing.
+ </p>
+ <p>
+ Depending on the debug options below, the logfile may be a
+ privacy risk if third parties can get access to it. As most
+ users will never look at it, <span class=
+ "APPLICATION">Privoxy</span> only logs fatal errors by
+ default.
+ </p>
+ <p>
+ For most troubleshooting purposes, you will have to change
+ that, please refer to the debugging section for details.
+ </p>
+ <p>
+ Any log files must be writable by whatever user <span
+ class="APPLICATION">Privoxy</span> is being run as (on
+ Unix, default user id is <span class=
+ "QUOTE">"privoxy"</span>).
+ </p>
+ <p>
+ To prevent the logfile from growing indefinitely, it is
+ recommended to periodically rotate or shorten it. Many
+ operating systems support log rotation out of the box, some
+ require additional software to do it. For details, please
+ refer to the documentation for your operating system.
+ </p>
+ </dd>
+ </dl>
+ </div>
+ </div>
+ <div class="SECT3">
+ <h4 class="SECT3">
+ <a name="TRUSTFILE">7.2.8. trustfile</a>
+ </h4>
+ <div class="VARIABLELIST">
+ <dl>
+ <dt>
+ Specifies:
+ </dt>
+ <dd>
+ <p>
+ The name of the trust file to use
+ </p>
+ </dd>
+ <dt>
+ Type of value:
+ </dt>
+ <dd>
+ <p>
+ File name, relative to <tt class="LITERAL">confdir</tt>
+ </p>
+ </dd>
+ <dt>
+ Default value:
+ </dt>
+ <dd>
+ <p>
+ <span class="emphasis"><i class="EMPHASIS">Unset (commented
+ out)</i></span>. When activated: trust (Unix) <span class=
+ "emphasis"><i class="EMPHASIS">or</i></span> trust.txt
+ (Windows)
+ </p>
+ </dd>
+ <dt>
+ Effect if unset:
+ </dt>
+ <dd>
+ <p>
+ The entire trust mechanism is disabled.
+ </p>
+ </dd>
+ <dt>
+ Notes:
+ </dt>
+ <dd>
+ <p>
+ The trust mechanism is an experimental feature for building
+ white-lists and should be used with care. It is <span
+ class="emphasis"><i class="EMPHASIS">NOT</i></span>
+ recommended for the casual user.
+ </p>
+ <p>
+ If you specify a trust file, <span class=
+ "APPLICATION">Privoxy</span> will only allow access to
+ sites that are specified in the trustfile. Sites can be
+ listed in one of two ways:
+ </p>
+ <p>
+ Prepending a <tt class="LITERAL">~</tt> character limits
+ access to this site only (and any sub-paths within this
+ site), e.g. <tt class="LITERAL">~www.example.com</tt>
+ allows access to <tt class=
+ "LITERAL">~www.example.com/features/news.html</tt>, etc.
+ </p>
+ <p>
+ Or, you can designate sites as <span class="emphasis"><i
+ class="EMPHASIS">trusted referrers</i></span>, by
+ prepending the name with a <tt class="LITERAL">+</tt>
+ character. The effect is that access to untrusted sites
+ will be granted -- but only if a link from this trusted
+ referrer was used to get there. The link target will then
+ be added to the <span class="QUOTE">"trustfile"</span> so
+ that future, direct accesses will be granted. Sites added
+ via this mechanism do not become trusted referrers
+ themselves (i.e. they are added with a <tt class=
+ "LITERAL">~</tt> designation). There is a limit of 512 such
+ entries, after which new entries will not be made.
+ </p>
+ <p>
+ If you use the <tt class="LITERAL">+</tt> operator in the
+ trust file, it may grow considerably over time.
+ </p>
+ <p>
+ It is recommended that <span class=
+ "APPLICATION">Privoxy</span> be compiled with the <tt
+ class="LITERAL">--disable-force</tt>, <tt class=
+ "LITERAL">--disable-toggle</tt> and <tt class=
+ "LITERAL">--disable-editor</tt> options, if this feature is
+ to be used.
+ </p>
+ <p>
+ Possible applications include limiting Internet access for
+ children.
+ </p>
+ </dd>
+ </dl>
+ </div>
+ </div>
+ </div>
+ <div class="SECT2">
+ <h2 class="SECT2">
+ <a name="DEBUGGING">7.3. Debugging</a>
+ </h2>
+ <p>
+ These options are mainly useful when tracing a problem. Note that
+ you might also want to invoke <span class=
+ "APPLICATION">Privoxy</span> with the <tt class=
+ "LITERAL">--no-daemon</tt> command line option when debugging.
+ </p>
+ <div class="SECT3">
+ <h4 class="SECT3">
+ <a name="DEBUG">7.3.1. debug</a>
+ </h4>
+ <div class="VARIABLELIST">
+ <dl>
+ <dt>
+ Specifies:
+ </dt>
+ <dd>
+ <p>
+ Key values that determine what information gets logged.
+ </p>
+ </dd>
+ <dt>
+ Type of value:
+ </dt>
+ <dd>
+ <p>
+ Integer values
+ </p>
+ </dd>
+ <dt>
+ Default value:
+ </dt>
+ <dd>
+ <p>
+ 0 (i.e.: only fatal errors (that cause Privoxy to exit) are
+ logged)
+ </p>
+ </dd>
+ <dt>
+ Effect if unset:
+ </dt>
+ <dd>
+ <p>
+ Default value is used (see above).
+ </p>
+ </dd>
+ <dt>
+ Notes:
+ </dt>
+ <dd>
+ <p>
+ The available debug levels are:
+ </p>
+ <p>
+ </p>
+ <table border="0" bgcolor="#E0E0E0" width="90%">
+ <tr>
+ <td>
+<pre class="PROGRAMLISTING">
+ debug 1 # Log the destination for each request <span class=
+"APPLICATION">Privoxy</span> let through. See also debug 1024.
+ debug 2 # show each connection status
+ debug 4 # show I/O status
+ debug 8 # show header parsing
+ debug 16 # log all data written to the network
+ debug 32 # debug force feature
+ debug 64 # debug regular expression filters
+ debug 128 # debug redirects
+ debug 256 # debug GIF de-animation
+ debug 512 # Common Log Format
+ debug 1024 # Log the destination for requests <span class=
+"APPLICATION">Privoxy</span> didn't let through, and the reason why.
+ debug 2048 # CGI user interface
+ debug 4096 # Startup banner and warnings.
+ debug 8192 # Non-fatal errors
+ debug 32768 # log all data read from the network
+ debug 65536 # Log the applying actions
+</pre>
+ </td>
+ </tr>
+ </table>
+
+ <p>
+ To select multiple debug levels, you can either add them or
+ use multiple <tt class="LITERAL">debug</tt> lines.
+ </p>
+ <p>
+ A debug level of 1 is informative because it will show you
+ each request as it happens. <span class="emphasis"><i
+ class="EMPHASIS">1, 1024, 4096 and 8192 are
+ recommended</i></span> so that you will notice when things
+ go wrong. The other levels are probably only of interest if
+ you are hunting down a specific problem. They can produce a
+ hell of an output (especially 16).
+ </p>
+ <p>
+ If you are used to the more verbose settings, simply enable
+ the debug lines below again.
+ </p>
+ <p>
+ If you want to use pure CLF (Common Log Format), you should
+ set <span class="QUOTE">"debug 512"</span> <span class=
+ "emphasis"><i class="EMPHASIS">ONLY</i></span> and not
+ enable anything else.
+ </p>
+ <p>
+ <span class="APPLICATION">Privoxy</span> has a hard-coded
+ limit for the length of log messages. If it's reached,
+ messages are logged truncated and marked with <span class=
+ "QUOTE">"... [too long, truncated]"</span>.
+ </p>
+ <p>
+ Please don't file any support requests without trying to
+ reproduce the problem with increased debug level first.
+ Once you read the log messages, you may even be able to
+ solve the problem on your own.
+ </p>
+ </dd>
+ </dl>
+ </div>
+ </div>
+ <div class="SECT3">
+ <h4 class="SECT3">
+ <a name="SINGLE-THREADED">7.3.2. single-threaded</a>
+ </h4>
+ <div class="VARIABLELIST">
+ <dl>
+ <dt>
+ Specifies:
+ </dt>
+ <dd>
+ <p>
+ Whether to run only one server thread.
+ </p>
+ </dd>
+ <dt>
+ Type of value:
+ </dt>
+ <dd>
+ <p>
+ <span class="emphasis"><i class="EMPHASIS">1 or
+ 0</i></span>
+ </p>
+ </dd>
+ <dt>
+ Default value:
+ </dt>
+ <dd>
+ <p>
+ <span class="emphasis"><i class="EMPHASIS">0</i></span>
+ </p>
+ </dd>
+ <dt>
+ Effect if unset:
+ </dt>
+ <dd>
+ <p>
+ Multi-threaded (or, where unavailable: forked) operation,
+ i.e. the ability to serve multiple requests simultaneously.
+ </p>
+ </dd>
+ <dt>
+ Notes:
+ </dt>
+ <dd>
+ <p>
+ This option is only there for debugging purposes. <span
+ class="emphasis"><i class="EMPHASIS">It will drastically
+ reduce performance.</i></span>
+ </p>
+ </dd>
+ </dl>
+ </div>
+ </div>
+ <div class="SECT3">
+ <h4 class="SECT3">
+ <a name="HOSTNAME">7.3.3. hostname</a>
+ </h4>
+ <div class="VARIABLELIST">
+ <dl>
+ <dt>
+ Specifies:
+ </dt>
+ <dd>
+ <p>
+ The hostname shown on the CGI pages.
+ </p>
+ </dd>
+ <dt>
+ Type of value:
+ </dt>
+ <dd>
+ <p>
+ Text
+ </p>
+ </dd>
+ <dt>
+ Default value:
+ </dt>
+ <dd>
+ <p>
+ <span class="emphasis"><i class="EMPHASIS">Unset</i></span>
+ </p>
+ </dd>
+ <dt>
+ Effect if unset:
+ </dt>
+ <dd>
+ <p>
+ The hostname provided by the operating system is used.
+ </p>
+ </dd>
+ <dt>
+ Notes:
+ </dt>
+ <dd>
+ <p>
+ On some misconfigured systems resolving the hostname fails
+ or takes too much time and slows Privoxy down. Setting a
+ fixed hostname works around the problem.
+ </p>
+ <p>
+ In other circumstances it might be desirable to show a
+ hostname other than the one returned by the operating
+ system. For example if the system has several different
+ hostnames and you don't want to use the first one.
+ </p>
+ <p>
+ Note that Privoxy does not validate the specified hostname
+ value.
+ </p>
+ </dd>
+ </dl>
+ </div>
+ </div>
+ </div>
+ <div class="SECT2">
+ <h2 class="SECT2">
+ <a name="ACCESS-CONTROL">7.4. Access Control and Security</a>
+ </h2>
+ <p>
+ This section of the config file controls the security-relevant
+ aspects of <span class="APPLICATION">Privoxy</span>'s
+ configuration.
+ </p>
+ <div class="SECT3">
+ <h4 class="SECT3">
+ <a name="LISTEN-ADDRESS">7.4.1. listen-address</a>
+ </h4>
+ <div class="VARIABLELIST">
+ <dl>
+ <dt>
+ Specifies:
+ </dt>
+ <dd>
+ <p>
+ The address and TCP port on which <span class=
+ "APPLICATION">Privoxy</span> will listen for client
+ requests.
+ </p>
+ </dd>
+ <dt>
+ Type of value:
+ </dt>
+ <dd>
+ <p>
+ [<tt class="REPLACEABLE"><i>IP-Address</i></tt>]:<tt class=
+ "REPLACEABLE"><i>Port</i></tt>
+ </p>
+ <p>
+ [<tt class="REPLACEABLE"><i>Hostname</i></tt>]:<tt class=
+ "REPLACEABLE"><i>Port</i></tt>
+ </p>
+ </dd>
+ <dt>
+ Default value:
+ </dt>
+ <dd>
+ <p>
+ 127.0.0.1:8118
+ </p>
+ </dd>
+ <dt>
+ Effect if unset:
+ </dt>
+ <dd>
+ <p>
+ Bind to 127.0.0.1 (IPv4 localhost), port 8118. This is
+ suitable and recommended for home users who run <span
+ class="APPLICATION">Privoxy</span> on the same machine as
+ their browser.
+ </p>
+ </dd>
+ <dt>
+ Notes:
+ </dt>
+ <dd>
+ <p>
+ You will need to configure your browser(s) to this proxy
+ address and port.
+ </p>
+ <p>
+ If you already have another service running on port 8118,
+ or if you want to serve requests from other machines (e.g.
+ on your local network) as well, you will need to override
+ the default.
+ </p>
+ <p>
+ You can use this statement multiple times to make <span
+ class="APPLICATION">Privoxy</span> listen on more ports or
+ more <abbr class="ABBREV">IP</abbr> addresses. Suitable if
+ your operating system does not support sharing <abbr class=
+ "ABBREV">IPv6</abbr> and <abbr class="ABBREV">IPv4</abbr>
+ protocols on the same socket.
+ </p>
+ <p>
+ If a hostname is used instead of an IP address, <span
+ class="APPLICATION">Privoxy</span> will try to resolve it
+ to an IP address and if there are multiple, use the first
+ one returned.
+ </p>
+ <p>
+ If the address for the hostname isn't already known on the
+ system (for example because it's in /etc/hostname), this
+ may result in DNS traffic.
+ </p>
+ <p>
+ If the specified address isn't available on the system, or
+ if the hostname can't be resolved, <span class=
+ "APPLICATION">Privoxy</span> will fail to start.
+ </p>
+ <p>
+ IPv6 addresses containing colons have to be quoted by
+ brackets. They can only be used if <span class=
+ "APPLICATION">Privoxy</span> has been compiled with IPv6
+ support. If you aren't sure if your version supports it,
+ have a look at <tt class=
+ "LITERAL">http://config.privoxy.org/show-status</tt>.
+ </p>
+ <p>
+ Some operating systems will prefer IPv6 to IPv4 addresses
+ even if the system has no IPv6 connectivity which is
+ usually not expected by the user. Some even rely on DNS to
+ resolve localhost which mean the "localhost" address used
+ may not actually be local.
+ </p>
+ <p>
+ It is therefore recommended to explicitly configure the
+ intended IP address instead of relying on the operating
+ system, unless there's a strong reason not to.
+ </p>
+ <p>
+ If you leave out the address, <span class=
+ "APPLICATION">Privoxy</span> will bind to all IPv4
+ interfaces (addresses) on your machine and may become
+ reachable from the Internet and/or the local network. Be
+ aware that some GNU/Linux distributions modify that
+ behaviour without updating the documentation. Check for
+ non-standard patches if your <span class=
+ "APPLICATION">Privoxy</span> version behaves differently.
+ </p>
+ <p>
+ If you configure <span class="APPLICATION">Privoxy</span>
+ to be reachable from the network, consider using <a href=
+ "config.html#ACLS">access control lists</a> (ACL's, see
+ below), and/or a firewall.
+ </p>
+ <p>
+ If you open <span class="APPLICATION">Privoxy</span> to
+ untrusted users, you will also want to make sure that the
+ following actions are disabled: <tt class="LITERAL"><a
+ href=
+ "config.html#ENABLE-EDIT-ACTIONS">enable-edit-actions</a></tt>
+ and <tt class="LITERAL"><a href=
+ "config.html#ENABLE-REMOTE-TOGGLE">enable-remote-toggle</a></tt>
+ </p>
+ </dd>
+ <dt>
+ Example:
+ </dt>
+ <dd>
+ <p>
+ Suppose you are running <span class=
+ "APPLICATION">Privoxy</span> on a machine which has the
+ address 192.168.0.1 on your local private network
+ (192.168.0.0) and has another outside connection with a
+ different address. You want it to serve requests from
+ inside only:
+ </p>
+ <p>
+ </p>
+ <table border="0" bgcolor="#E0E0E0" width="90%">
+ <tr>
+ <td>
+<pre class="PROGRAMLISTING">
+ listen-address 192.168.0.1:8118
+</pre>
+ </td>
+ </tr>
+ </table>
+
+ <p>
+ Suppose you are running <span class=
+ "APPLICATION">Privoxy</span> on an IPv6-capable machine and
+ you want it to listen on the IPv6 address of the loopback
+ device:
+ </p>
+ <p>
+ </p>
+ <table border="0" bgcolor="#E0E0E0" width="90%">
+ <tr>
+ <td>
+<pre class="PROGRAMLISTING">
+ listen-address [::1]:8118
+</pre>
+ </td>
+ </tr>
+ </table>
+ </dd>
+ </dl>
+ </div>
+ </div>
+ <div class="SECT3">
+ <h4 class="SECT3">
+ <a name="TOGGLE">7.4.2. toggle</a>
+ </h4>
+ <div class="VARIABLELIST">
+ <dl>
+ <dt>
+ Specifies:
+ </dt>
+ <dd>
+ <p>
+ Initial state of "toggle" status
+ </p>
+ </dd>
+ <dt>
+ Type of value:
+ </dt>
+ <dd>
+ <p>
+ 1 or 0
+ </p>
+ </dd>
+ <dt>
+ Default value:
+ </dt>
+ <dd>
+ <p>
+ 1
+ </p>
+ </dd>
+ <dt>
+ Effect if unset:
+ </dt>
+ <dd>
+ <p>
+ Act as if toggled on
+ </p>
+ </dd>
+ <dt>
+ Notes:
+ </dt>
+ <dd>
+ <p>
+ If set to 0, <span class="APPLICATION">Privoxy</span> will
+ start in <span class="QUOTE">"toggled off"</span> mode,
+ i.e. mostly behave like a normal, content-neutral proxy
+ with both ad blocking and content filtering disabled. See
+ <tt class="LITERAL">enable-remote-toggle</tt> below.
+ </p>
+ </dd>
+ </dl>
+ </div>
+ </div>
+ <div class="SECT3">
+ <h4 class="SECT3">
+ <a name="ENABLE-REMOTE-TOGGLE">7.4.3. enable-remote-toggle</a>
+ </h4>
+ <div class="VARIABLELIST">
+ <dl>
+ <dt>
+ Specifies:
+ </dt>
+ <dd>
+ <p>
+ Whether or not the <a href=
+ "http://config.privoxy.org/toggle" target="_top">web-based
+ toggle feature</a> may be used
+ </p>
+ </dd>
+ <dt>
+ Type of value:
+ </dt>
+ <dd>
+ <p>
+ 0 or 1
+ </p>
+ </dd>
+ <dt>
+ Default value:
+ </dt>
+ <dd>
+ <p>
+ 0
+ </p>
+ </dd>
+ <dt>
+ Effect if unset:
+ </dt>
+ <dd>
+ <p>
+ The web-based toggle feature is disabled.
+ </p>
+ </dd>
+ <dt>
+ Notes:
+ </dt>
+ <dd>
+ <p>
+ When toggled off, <span class="APPLICATION">Privoxy</span>
+ mostly acts like a normal, content-neutral proxy, i.e.
+ doesn't block ads or filter content.
+ </p>
+ <p>
+ Access to the toggle feature can <span class="emphasis"><i
+ class="EMPHASIS">not</i></span> be controlled separately by
+ <span class="QUOTE">"ACLs"</span> or HTTP authentication,
+ so that everybody who can access <span class=
+ "APPLICATION">Privoxy</span> (see <span class=
+ "QUOTE">"ACLs"</span> and <tt class=
+ "LITERAL">listen-address</tt> above) can toggle it for all
+ users. So this option is <span class="emphasis"><i class=
+ "EMPHASIS">not recommended</i></span> for multi-user
+ environments with untrusted users.
+ </p>
+ <p>
+ Note that malicious client side code (e.g Java) is also
+ capable of using this option.
+ </p>
+ <p>
+ As a lot of <span class="APPLICATION">Privoxy</span> users
+ don't read documentation, this feature is disabled by
+ default.
+ </p>
+ <p>
+ Note that you must have compiled <span class=
+ "APPLICATION">Privoxy</span> with support for this feature,
+ otherwise this option has no effect.
+ </p>
+ </dd>
+ </dl>
+ </div>
+ </div>
+ <div class="SECT3">
+ <h4 class="SECT3">
+ <a name="ENABLE-REMOTE-HTTP-TOGGLE">7.4.4.
+ enable-remote-http-toggle</a>
+ </h4>
+ <div class="VARIABLELIST">
+ <dl>
+ <dt>
+ Specifies:
+ </dt>
+ <dd>
+ <p>
+ Whether or not Privoxy recognizes special HTTP headers to
+ change its behaviour.
+ </p>
+ </dd>
+ <dt>
+ Type of value:
+ </dt>
+ <dd>
+ <p>
+ 0 or 1
+ </p>
+ </dd>
+ <dt>
+ Default value:
+ </dt>
+ <dd>
+ <p>
+ 0
+ </p>
+ </dd>
+ <dt>
+ Effect if unset:
+ </dt>
+ <dd>
+ <p>
+ Privoxy ignores special HTTP headers.
+ </p>
+ </dd>
+ <dt>
+ Notes:
+ </dt>
+ <dd>
+ <p>
+ When toggled on, the client can change <span class=
+ "APPLICATION">Privoxy's</span> behaviour by setting special
+ HTTP headers. Currently the only supported special header
+ is <span class="QUOTE">"X-Filter: No"</span>, to disable
+ filtering for the ongoing request, even if it is enabled in
+ one of the action files.
+ </p>
+ <p>
+ This feature is disabled by default. If you are using <span
+ class="APPLICATION">Privoxy</span> in a environment with
+ trusted clients, you may enable this feature at your
+ discretion. Note that malicious client side code (e.g Java)
+ is also capable of using this feature.
+ </p>
+ <p>
+ This option will be removed in future releases as it has
+ been obsoleted by the more general header taggers.
+ </p>
+ </dd>
+ </dl>
+ </div>
+ </div>
+ <div class="SECT3">
+ <h4 class="SECT3">
+ <a name="ENABLE-EDIT-ACTIONS">7.4.5. enable-edit-actions</a>
+ </h4>
+ <div class="VARIABLELIST">
+ <dl>
+ <dt>
+ Specifies:
+ </dt>
+ <dd>
+ <p>
+ Whether or not the <a href=
+ "http://config.privoxy.org/show-status" target=
+ "_top">web-based actions file editor</a> may be used
+ </p>
+ </dd>
+ <dt>
+ Type of value:
+ </dt>
+ <dd>
+ <p>
+ 0 or 1
+ </p>
+ </dd>
+ <dt>
+ Default value:
+ </dt>
+ <dd>
+ <p>
+ 0
+ </p>
+ </dd>
+ <dt>
+ Effect if unset:
+ </dt>
+ <dd>
+ <p>
+ The web-based actions file editor is disabled.
+ </p>
+ </dd>
+ <dt>
+ Notes:
+ </dt>
+ <dd>
+ <p>
+ Access to the editor can <span class="emphasis"><i class=
+ "EMPHASIS">not</i></span> be controlled separately by <span
+ class="QUOTE">"ACLs"</span> or HTTP authentication, so that
+ everybody who can access <span class=
+ "APPLICATION">Privoxy</span> (see <span class=
+ "QUOTE">"ACLs"</span> and <tt class=
+ "LITERAL">listen-address</tt> above) can modify its
+ configuration for all users.
+ </p>
+ <p>
+ This option is <span class="emphasis"><i class=
+ "EMPHASIS">not recommended</i></span> for environments with
+ untrusted users and as a lot of <span class=
+ "APPLICATION">Privoxy</span> users don't read
+ documentation, this feature is disabled by default.
+ </p>
+ <p>
+ Note that malicious client side code (e.g Java) is also
+ capable of using the actions editor and you shouldn't
+ enable this options unless you understand the consequences
+ and are sure your browser is configured correctly.
+ </p>
+ <p>
+ Note that you must have compiled <span class=
+ "APPLICATION">Privoxy</span> with support for this feature,
+ otherwise this option has no effect.
+ </p>
+ </dd>
+ </dl>
+ </div>
+ </div>
+ <div class="SECT3">
+ <h4 class="SECT3">
+ <a name="ENFORCE-BLOCKS">7.4.6. enforce-blocks</a>
+ </h4>
+ <div class="VARIABLELIST">
+ <dl>
+ <dt>
+ Specifies:
+ </dt>
+ <dd>
+ <p>
+ Whether the user is allowed to ignore blocks and can <span
+ class="QUOTE">"go there anyway"</span>.
+ </p>
+ </dd>
+ <dt>
+ Type of value:
+ </dt>
+ <dd>
+ <p>
+ <tt class="REPLACEABLE"><i>0 or 1</i></tt>
+ </p>
+ </dd>
+ <dt>
+ Default value:
+ </dt>
+ <dd>
+ <p>
+ <span class="emphasis"><i class="EMPHASIS">0</i></span>
+ </p>
+ </dd>
+ <dt>
+ Effect if unset:
+ </dt>
+ <dd>
+ <p>
+ Blocks are not enforced.
+ </p>
+ </dd>
+ <dt>
+ Notes:
+ </dt>
+ <dd>
+ <p>
+ <span class="APPLICATION">Privoxy</span> is mainly used to
+ block and filter requests as a service to the user, for
+ example to block ads and other junk that clogs the pipes.
+ <span class="APPLICATION">Privoxy's</span> configuration
+ isn't perfect and sometimes innocent pages are blocked. In
+ this situation it makes sense to allow the user to enforce
+ the request and have <span class=
+ "APPLICATION">Privoxy</span> ignore the block.
+ </p>
+ <p>
+ In the default configuration <span class=
+ "APPLICATION">Privoxy's</span> <span class=
+ "QUOTE">"Blocked"</span> page contains a <span class=
+ "QUOTE">"go there anyway"</span> link to adds a special
+ string (the force prefix) to the request URL. If that link
+ is used, <span class="APPLICATION">Privoxy</span> will
+ detect the force prefix, remove it again and let the
+ request pass.
+ </p>
+ <p>
+ Of course <span class="APPLICATION">Privoxy</span> can also
+ be used to enforce a network policy. In that case the user
+ obviously should not be able to bypass any blocks, and
+ that's what the <span class="QUOTE">"enforce-blocks"</span>
+ option is for. If it's enabled, <span class=
+ "APPLICATION">Privoxy</span> hides the <span class=
+ "QUOTE">"go there anyway"</span> link. If the user adds the
+ force prefix by hand, it will not be accepted and the
+ circumvention attempt is logged.
+ </p>
+ </dd>
+ <dt>
+ Examples:
+ </dt>
+ <dd>
+ <p>
+ enforce-blocks 1
+ </p>
+ </dd>
+ </dl>
+ </div>
+ </div>
+ <div class="SECT3">
+ <h4 class="SECT3">
+ <a name="ACLS">7.4.7. ACLs: permit-access and deny-access</a>
+ </h4>
+ <a name="PERMIT-ACCESS"></a><a name="DENY-ACCESS"></a>
+ <div class="VARIABLELIST">
+ <dl>
+ <dt>
+ Specifies:
+ </dt>
+ <dd>
+ <p>
+ Who can access what.
+ </p>
+ </dd>
+ <dt>
+ Type of value:
+ </dt>
+ <dd>
+ <p>
+ <tt class="REPLACEABLE"><i>src_addr</i></tt>[:<tt class=
+ "REPLACEABLE"><i>port</i></tt>][/<tt class=
+ "REPLACEABLE"><i>src_masklen</i></tt>] [<tt class=
+ "REPLACEABLE"><i>dst_addr</i></tt>[:<tt class=
+ "REPLACEABLE"><i>port</i></tt>][/<tt class=
+ "REPLACEABLE"><i>dst_masklen</i></tt>]]
+ </p>
+ <p>
+ Where <tt class="REPLACEABLE"><i>src_addr</i></tt> and <tt
+ class="REPLACEABLE"><i>dst_addr</i></tt> are IPv4 addresses
+ in dotted decimal notation or valid DNS names, <tt class=
+ "REPLACEABLE"><i>port</i></tt> is a port number, and <tt
+ class="REPLACEABLE"><i>src_masklen</i></tt> and <tt class=
+ "REPLACEABLE"><i>dst_masklen</i></tt> are subnet masks in
+ CIDR notation, i.e. integer values from 2 to 30
+ representing the length (in bits) of the network address.
+ The masks and the whole destination part are optional.
+ </p>
+ <p>
+ If your system implements <a href=
+ "http://tools.ietf.org/html/rfc3493" target="_top">RFC
+ 3493</a>, then <tt class="REPLACEABLE"><i>src_addr</i></tt>
+ and <tt class="REPLACEABLE"><i>dst_addr</i></tt> can be
+ IPv6 addresses delimeted by brackets, <tt class=
+ "REPLACEABLE"><i>port</i></tt> can be a number or a service
+ name, and <tt class="REPLACEABLE"><i>src_masklen</i></tt>
+ and <tt class="REPLACEABLE"><i>dst_masklen</i></tt> can be
+ a number from 0 to 128.
+ </p>
+ </dd>
+ <dt>
+ Default value:
+ </dt>
+ <dd>
+ <p>
+ <span class="emphasis"><i class="EMPHASIS">Unset</i></span>
+ </p>
+ <p>
+ If no <tt class="REPLACEABLE"><i>port</i></tt> is
+ specified, any port will match. If no <tt class=
+ "REPLACEABLE"><i>src_masklen</i></tt> or <tt class=
+ "REPLACEABLE"><i>src_masklen</i></tt> is given, the
+ complete IP address has to match (i.e. 32 bits for IPv4 and
+ 128 bits for IPv6).
+ </p>
+ </dd>
+ <dt>
+ Effect if unset:
+ </dt>
+ <dd>
+ <p>
+ Don't restrict access further than implied by <tt class=
+ "LITERAL">listen-address</tt>
+ </p>
+ </dd>
+ <dt>
+ Notes:
+ </dt>
+ <dd>
+ <p>
+ Access controls are included at the request of ISPs and
+ systems administrators, and <span class="emphasis"><i
+ class="EMPHASIS">are not usually needed by individual
+ users</i></span>. For a typical home user, it will normally
+ suffice to ensure that <span class=
+ "APPLICATION">Privoxy</span> only listens on the localhost
+ (127.0.0.1) or internal (home) network address by means of
+ the <a href="config.html#LISTEN-ADDRESS"><span class=
+ "emphasis"><i class=
+ "EMPHASIS">listen-address</i></span></a> option.
+ </p>
+ <p>
+ Please see the warnings in the FAQ that <span class=
+ "APPLICATION">Privoxy</span> is not intended to be a
+ substitute for a firewall or to encourage anyone to defer
+ addressing basic security weaknesses.
+ </p>
+ <p>
+ Multiple ACL lines are OK. If any ACLs are specified, <span
+ class="APPLICATION">Privoxy</span> only talks to IP
+ addresses that match at least one <tt class=
+ "LITERAL">permit-access</tt> line and don't match any
+ subsequent <tt class="LITERAL">deny-access</tt> line. In
+ other words, the last match wins, with the default being
+ <tt class="LITERAL">deny-access</tt>.
+ </p>
+ <p>
+ If <span class="APPLICATION">Privoxy</span> is using a
+ forwarder (see <tt class="LITERAL">forward</tt> below) for
+ a particular destination URL, the <tt class=
+ "REPLACEABLE"><i>dst_addr</i></tt> that is examined is the
+ address of the forwarder and <span class="emphasis"><i
+ class="EMPHASIS">NOT</i></span> the address of the ultimate
+ target. This is necessary because it may be impossible for
+ the local <span class="APPLICATION">Privoxy</span> to
+ determine the IP address of the ultimate target (that's
+ often what gateways are used for).
+ </p>
+ <p>
+ You should prefer using IP addresses over DNS names,
+ because the address lookups take time. All DNS names must
+ resolve! You can <span class="emphasis"><i class=
+ "EMPHASIS">not</i></span> use domain patterns like <span
+ class="QUOTE">"*.org"</span> or partial domain names. If a
+ DNS name resolves to multiple IP addresses, only the first
+ one is used.
+ </p>
+ <p>
+ Some systems allow IPv4 clients to connect to IPv6 server
+ sockets. Then the client's IPv4 address will be translated
+ by the system into IPv6 address space with special prefix
+ ::ffff:0:0/96 (so called IPv4 mapped IPv6 address). <span
+ class="APPLICATION">Privoxy</span> can handle it and maps
+ such ACL addresses automatically.
+ </p>
+ <p>
+ Denying access to particular sites by ACL may have
+ undesired side effects if the site in question is hosted on
+ a machine which also hosts other sites (most sites are).
+ </p>
+ </dd>
+ <dt>
+ Examples:
+ </dt>
+ <dd>
+ <p>
+ Explicitly define the default behavior if no ACL and <tt
+ class="LITERAL">listen-address</tt> are set: <span class=
+ "QUOTE">"localhost"</span> is OK. The absence of a <tt
+ class="REPLACEABLE"><i>dst_addr</i></tt> implies that <span
+ class="emphasis"><i class="EMPHASIS">all</i></span>
+ destination addresses are OK:
+ </p>
+ <p>
+ </p>
+ <table border="0" bgcolor="#E0E0E0" width="90%">
+ <tr>
+ <td>
+<pre class="SCREEN">
+ permit-access localhost
+</pre>
+ </td>
+ </tr>
+ </table>
+
+ <p>
+ Allow any host on the same class C subnet as
+ www.privoxy.org access to nothing but www.example.com (or
+ other domains hosted on the same system):
+ </p>
+ <p>
+ </p>
+ <table border="0" bgcolor="#E0E0E0" width="90%">
+ <tr>
+ <td>
+<pre class="SCREEN">
+ permit-access www.privoxy.org/24 www.example.com/32
+</pre>
+ </td>
+ </tr>
+ </table>
+
+ <p>
+ Allow access from any host on the 26-bit subnet
+ 192.168.45.64 to anywhere, with the exception that
+ 192.168.45.73 may not access the IP address behind
+ www.dirty-stuff.example.com:
+ </p>
+ <p>
+ </p>
+ <table border="0" bgcolor="#E0E0E0" width="90%">
+ <tr>
+ <td>
+<pre class="SCREEN">
+ permit-access 192.168.45.64/26
+ deny-access 192.168.45.73 www.dirty-stuff.example.com
+</pre>
+ </td>
+ </tr>
+ </table>
+
+ <p>
+ Allow access from the IPv4 network 192.0.2.0/24 even if
+ listening on an IPv6 wild card address (not supported on
+ all platforms):
+ </p>
+ <p>
+ </p>
+ <table border="0" bgcolor="#E0E0E0" width="90%">
+ <tr>
+ <td>
+<pre class="PROGRAMLISTING">
+ permit-access 192.0.2.0/24
+</pre>
+ </td>
+ </tr>
+ </table>
+
+ <p>
+ This is equivalent to the following line even if listening
+ on an IPv4 address (not supported on all platforms):
+ </p>
+ <p>
+ </p>
+ <table border="0" bgcolor="#E0E0E0" width="90%">
+ <tr>
+ <td>
+<pre class="PROGRAMLISTING">
+ permit-access [::ffff:192.0.2.0]/120
+</pre>
+ </td>
+ </tr>
+ </table>
+ </dd>
+ </dl>
+ </div>
+ </div>
+ <div class="SECT3">
+ <h4 class="SECT3">
+ <a name="BUFFER-LIMIT">7.4.8. buffer-limit</a>
+ </h4>
+ <div class="VARIABLELIST">
+ <dl>
+ <dt>
+ Specifies:
+ </dt>
+ <dd>
+ <p>
+ Maximum size of the buffer for content filtering.
+ </p>
+ </dd>
+ <dt>
+ Type of value:
+ </dt>
+ <dd>
+ <p>
+ Size in Kbytes
+ </p>
+ </dd>
+ <dt>
+ Default value:
+ </dt>
+ <dd>
+ <p>
+ 4096
+ </p>
+ </dd>
+ <dt>
+ Effect if unset:
+ </dt>
+ <dd>
+ <p>
+ Use a 4MB (4096 KB) limit.
+ </p>
+ </dd>
+ <dt>
+ Notes:
+ </dt>
+ <dd>
+ <p>
+ For content filtering, i.e. the <tt class=
+ "LITERAL">+filter</tt> and <tt class=
+ "LITERAL">+deanimate-gif</tt> actions, it is necessary that
+ <span class="APPLICATION">Privoxy</span> buffers the entire
+ document body. This can be potentially dangerous, since a
+ server could just keep sending data indefinitely and wait
+ for your RAM to exhaust -- with nasty consequences. Hence
+ this option.
+ </p>
+ <p>
+ When a document buffer size reaches the <tt class=
+ "LITERAL">buffer-limit</tt>, it is flushed to the client
+ unfiltered and no further attempt to filter the rest of the
+ document is made. Remember that there may be multiple
+ threads running, which might require up to <tt class=
+ "LITERAL">buffer-limit</tt> Kbytes <span class=
+ "emphasis"><i class="EMPHASIS">each</i></span>, unless you
+ have enabled <span class="QUOTE">"single-threaded"</span>
+ above.
+ </p>
+ </dd>
+ </dl>
+ </div>
+ </div>
+ <div class="SECT3">
+ <h4 class="SECT3">
+ <a name="ENABLE-PROXY-AUTHENTICATION-FORWARDING">7.4.9.
+ enable-proxy-authentication-forwarding</a>
+ </h4>
+ <div class="VARIABLELIST">
+ <dl>
+ <dt>
+ Specifies:
+ </dt>
+ <dd>
+ <p>
+ Whether or not proxy authentication through <span class=
+ "APPLICATION">Privoxy</span> should work.
+ </p>
+ </dd>
+ <dt>
+ Type of value:
+ </dt>
+ <dd>
+ <p>
+ 0 or 1
+ </p>
+ </dd>
+ <dt>
+ Default value:
+ </dt>
+ <dd>
+ <p>
+ 0
+ </p>
+ </dd>
+ <dt>
+ Effect if unset:
+ </dt>
+ <dd>
+ <p>
+ Proxy authentication headers are removed.
+ </p>
+ </dd>
+ <dt>
+ Notes:
+ </dt>
+ <dd>
+ <p>
+ Privoxy itself does not support proxy authentication, but
+ can allow clients to authenticate against Privoxy's parent
+ proxy.
+ </p>
+ <p>
+ By default Privoxy (3.0.21 and later) don't do that and
+ remove Proxy-Authorization headers in requests and
+ Proxy-Authenticate headers in responses to make it harder
+ for malicious sites to trick inexperienced users into
+ providing login information.
+ </p>
+ <p>
+ If this option is enabled the headers are forwarded.
+ </p>
+ <p>
+ Enabling this option is <span class="emphasis"><i class=
+ "EMPHASIS">not recommended</i></span> if there is no parent
+ proxy that requires authentication or if the local network
+ between Privoxy and the parent proxy isn't trustworthy. If
+ proxy authentication is only required for some requests, it
+ is recommended to use a client header filter to remove the
+ authentication headers for requests where they aren't
+ needed.
+ </p>
+ </dd>
+ </dl>
+ </div>
+ </div>
+ </div>
+ <div class="SECT2">
+ <h2 class="SECT2">
+ <a name="FORWARDING">7.5. Forwarding</a>
+ </h2>
+ <p>
+ This feature allows routing of HTTP requests through a chain of
+ multiple proxies.
+ </p>
+ <p>
+ Forwarding can be used to chain Privoxy with a caching proxy to
+ speed up browsing. Using a parent proxy may also be necessary if
+ the machine that <span class="APPLICATION">Privoxy</span> runs on
+ has no direct Internet access.
+ </p>
+ <p>
+ Note that parent proxies can severely decrease your privacy level.
+ For example a parent proxy could add your IP address to the request
+ headers and if it's a caching proxy it may add the <span class=
+ "QUOTE">"Etag"</span> header to revalidation requests again, even
+ though you configured Privoxy to remove it. It may also ignore
+ Privoxy's header time randomization and use the original values
+ which could be used by the server as cookie replacement to track
+ your steps between visits.
+ </p>
+ <p>
+ Also specified here are SOCKS proxies. <span class=
+ "APPLICATION">Privoxy</span> supports the SOCKS 4 and SOCKS 4A
+ protocols.
+ </p>
+ <div class="SECT3">
+ <h4 class="SECT3">
+ <a name="FORWARD">7.5.1. forward</a>
+ </h4>
+ <div class="VARIABLELIST">
+ <dl>
+ <dt>
+ Specifies:
+ </dt>
+ <dd>
+ <p>
+ To which parent HTTP proxy specific requests should be
+ routed.
+ </p>
+ </dd>
+ <dt>
+ Type of value:
+ </dt>
+ <dd>
+ <p>
+ <tt class="REPLACEABLE"><i>target_pattern</i></tt> <tt
+ class="REPLACEABLE"><i>http_parent</i></tt>[:<tt class=
+ "REPLACEABLE"><i>port</i></tt>]
+ </p>
+ <p>
+ where <tt class="REPLACEABLE"><i>target_pattern</i></tt> is
+ a <a href="actions-file.html#AF-PATTERNS">URL pattern</a>
+ that specifies to which requests (i.e. URLs) this forward
+ rule shall apply. Use <tt class="LITERAL">/</tt> to denote
+ <span class="QUOTE">"all URLs"</span>. <tt class=
+ "REPLACEABLE"><i>http_parent</i></tt>[:<tt class=
+ "REPLACEABLE"><i>port</i></tt>] is the DNS name or IP
+ address of the parent HTTP proxy through which the requests
+ should be forwarded, optionally followed by its listening
+ port (default: 8000). Use a single dot (<tt class=
+ "LITERAL">.</tt>) to denote <span class="QUOTE">"no
+ forwarding"</span>.
+ </p>
+ </dd>
+ <dt>
+ Default value:
+ </dt>
+ <dd>
+ <p>
+ <span class="emphasis"><i class="EMPHASIS">Unset</i></span>
+ </p>
+ </dd>
+ <dt>
+ Effect if unset:
+ </dt>
+ <dd>
+ <p>
+ Don't use parent HTTP proxies.
+ </p>
+ </dd>
+ <dt>
+ Notes:
+ </dt>
+ <dd>
+ <p>
+ If <tt class="REPLACEABLE"><i>http_parent</i></tt> is <span
+ class="QUOTE">"."</span>, then requests are not forwarded
+ to another HTTP proxy but are made directly to the web
+ servers.
+ </p>
+ <p>
+ <tt class="REPLACEABLE"><i>http_parent</i></tt> can be a
+ numerical IPv6 address (if <a href=
+ "http://tools.ietf.org/html/rfc3493" target="_top">RFC
+ 3493</a> is implemented). To prevent clashes with the port
+ delimiter, the whole IP address has to be put into
+ brackets. On the other hand a <tt class=
+ "REPLACEABLE"><i>target_pattern</i></tt> containing an IPv6
+ address has to be put into angle brackets (normal brackets
+ are reserved for regular expressions already).
+ </p>
+ <p>
+ Multiple lines are OK, they are checked in sequence, and
+ the last match wins.
+ </p>
+ </dd>
+ <dt>
+ Examples:
+ </dt>
+ <dd>
+ <p>
+ Everything goes to an example parent proxy, except SSL on
+ port 443 (which it doesn't handle):
+ </p>
+ <p>
+ </p>
+ <table border="0" bgcolor="#E0E0E0" width="90%">
+ <tr>
+ <td>
+<pre class="SCREEN">
+ forward / parent-proxy.example.org:8080
+ forward :443 .
+</pre>
+ </td>
+ </tr>
+ </table>
+
+ <p>
+ Everything goes to our example ISP's caching proxy, except
+ for requests to that ISP's sites:
+ </p>
+ <p>
+ </p>
+ <table border="0" bgcolor="#E0E0E0" width="90%">
+ <tr>
+ <td>
+<pre class="SCREEN">
+ forward / caching-proxy.isp.example.net:8000
+ forward .isp.example.net .
+</pre>
+ </td>
+ </tr>
+ </table>
+
+ <p>
+ Parent proxy specified by an IPv6 address:
+ </p>
+ <p>
+ </p>
+ <table border="0" bgcolor="#E0E0E0" width="90%">
+ <tr>
+ <td>
+<pre class="PROGRAMLISTING">
+ forward / [2001:DB8::1]:8000
+</pre>
+ </td>
+ </tr>
+ </table>
+
+ <p>
+ Suppose your parent proxy doesn't support IPv6:
+ </p>
+ <p>
+ </p>
+ <table border="0" bgcolor="#E0E0E0" width="90%">
+ <tr>
+ <td>
+<pre class="PROGRAMLISTING">
+ forward / parent-proxy.example.org:8000
+ forward ipv6-server.example.org .
+ forward <[2-3][0-9a-f][0-9a-f][0-9a-f]:*> .
+</pre>
+ </td>
+ </tr>
+ </table>
+ </dd>
+ </dl>
+ </div>
+ </div>
+ <div class="SECT3">
+ <h4 class="SECT3">
+ <a name="SOCKS">7.5.2. forward-socks4, forward-socks4a,
+ forward-socks5 and forward-socks5t</a>
+ </h4>
+ <a name="FORWARD-SOCKS4"></a><a name="FORWARD-SOCKS4A"></a>
+ <div class="VARIABLELIST">
+ <dl>
+ <dt>
+ Specifies:
+ </dt>
+ <dd>
+ <p>
+ Through which SOCKS proxy (and optionally to which parent
+ HTTP proxy) specific requests should be routed.
+ </p>
+ </dd>
+ <dt>
+ Type of value:
+ </dt>
+ <dd>
+ <p>
+ <tt class="REPLACEABLE"><i>target_pattern</i></tt> <tt
+ class="REPLACEABLE"><i>socks_proxy</i></tt>[:<tt class=
+ "REPLACEABLE"><i>port</i></tt>] <tt class=
+ "REPLACEABLE"><i>http_parent</i></tt>[:<tt class=
+ "REPLACEABLE"><i>port</i></tt>]
+ </p>
+ <p>
+ where <tt class="REPLACEABLE"><i>target_pattern</i></tt> is
+ a <a href="actions-file.html#AF-PATTERNS">URL pattern</a>
+ that specifies to which requests (i.e. URLs) this forward
+ rule shall apply. Use <tt class="LITERAL">/</tt> to denote
+ <span class="QUOTE">"all URLs"</span>. <tt class=
+ "REPLACEABLE"><i>http_parent</i></tt> and <tt class=
+ "REPLACEABLE"><i>socks_proxy</i></tt> are IP addresses in
+ dotted decimal notation or valid DNS names (<tt class=
+ "REPLACEABLE"><i>http_parent</i></tt> may be <span class=
+ "QUOTE">"."</span> to denote <span class="QUOTE">"no HTTP
+ forwarding"</span>), and the optional <tt class=
+ "REPLACEABLE"><i>port</i></tt> parameters are TCP ports,
+ i.e. integer values from 1 to 65535
+ </p>
+ </dd>
+ <dt>
+ Default value:
+ </dt>
+ <dd>
+ <p>
+ <span class="emphasis"><i class="EMPHASIS">Unset</i></span>
+ </p>
+ </dd>
+ <dt>
+ Effect if unset:
+ </dt>
+ <dd>
+ <p>
+ Don't use SOCKS proxies.
+ </p>
+ </dd>
+ <dt>
+ Notes:
+ </dt>
+ <dd>
+ <p>
+ Multiple lines are OK, they are checked in sequence, and
+ the last match wins.
+ </p>
+ <p>
+ The difference between <tt class=
+ "LITERAL">forward-socks4</tt> and <tt class=
+ "LITERAL">forward-socks4a</tt> is that in the SOCKS 4A
+ protocol, the DNS resolution of the target hostname happens
+ on the SOCKS server, while in SOCKS 4 it happens locally.
+ </p>
+ <p>
+ With <tt class="LITERAL">forward-socks5</tt> the DNS
+ resolution will happen on the remote server as well.
+ </p>
+ <p>
+ <tt class="LITERAL">forward-socks5t</tt> works like vanilla
+ <tt class="LITERAL">forward-socks5</tt> but lets <span
+ class="APPLICATION">Privoxy</span> additionally use
+ Tor-specific SOCKS extensions. Currently the only supported
+ SOCKS extension is optimistic data which can reduce the
+ latency for the first request made on a newly created
+ connection.
+ </p>
+ <p>
+ <tt class="REPLACEABLE"><i>socks_proxy</i></tt> and <tt
+ class="REPLACEABLE"><i>http_parent</i></tt> can be a
+ numerical IPv6 address (if <a href=
+ "http://tools.ietf.org/html/rfc3493" target="_top">RFC
+ 3493</a> is implemented). To prevent clashes with the port
+ delimiter, the whole IP address has to be put into
+ brackets. On the other hand a <tt class=
+ "REPLACEABLE"><i>target_pattern</i></tt> containing an IPv6
+ address has to be put into angle brackets (normal brackets
+ are reserved for regular expressions already).
+ </p>
+ <p>
+ If <tt class="REPLACEABLE"><i>http_parent</i></tt> is <span
+ class="QUOTE">"."</span>, then requests are not forwarded
+ to another HTTP proxy but are made (HTTP-wise) directly to
+ the web servers, albeit through a SOCKS proxy.
+ </p>
+ </dd>
+ <dt>
+ Examples:
+ </dt>
+ <dd>
+ <p>
+ From the company example.com, direct connections are made
+ to all <span class="QUOTE">"internal"</span> domains, but
+ everything outbound goes through their ISP's proxy by way
+ of example.com's corporate SOCKS 4A gateway to the
+ Internet.
+ </p>
+ <p>
+ </p>
+ <table border="0" bgcolor="#E0E0E0" width="90%">
+ <tr>
+ <td>
+<pre class="SCREEN">
+ forward-socks4a / socks-gw.example.com:1080 www-cache.isp.example.net:8080
+ forward .example.com .
+</pre>
+ </td>
+ </tr>
+ </table>
+
+ <p>
+ A rule that uses a SOCKS 4 gateway for all destinations but
+ no HTTP parent looks like this:
+ </p>
+ <p>
+ </p>
+ <table border="0" bgcolor="#E0E0E0" width="90%">
+ <tr>
+ <td>
+<pre class="SCREEN">
+ forward-socks4 / socks-gw.example.com:1080 .
+</pre>
+ </td>
+ </tr>
+ </table>
+
+ <p>
+ To chain Privoxy and Tor, both running on the same system,
+ you would use something like:
+ </p>
+ <p>
+ </p>
+ <table border="0" bgcolor="#E0E0E0" width="90%">
+ <tr>
+ <td>
+<pre class="SCREEN">
+ forward-socks5t / 127.0.0.1:9050 .
+</pre>
+ </td>
+ </tr>
+ </table>
+
+ <p>
+ Note that if you got Tor through one of the bundles, you
+ may have to change the port from 9050 to 9150 (or even
+ another one). For details, please check the documentation
+ on the <a href="https://torproject.org/" target="_top">Tor
+ website</a>.
+ </p>
+ <p>
+ The public <span class="APPLICATION">Tor</span> network
+ can't be used to reach your local network, if you need to
+ access local servers you therefore might want to make some
+ exceptions:
+ </p>
+ <p>
+ </p>
+ <table border="0" bgcolor="#E0E0E0" width="90%">
+ <tr>
+ <td>
+<pre class="SCREEN">
+ forward 192.168.*.*/ .
+ forward 10.*.*.*/ .
+ forward 127.*.*.*/ .
+</pre>
+ </td>
+ </tr>
+ </table>
+
+ <p>
+ Unencrypted connections to systems in these address ranges
+ will be as (un)secure as the local network is, but the
+ alternative is that you can't reach the local network
+ through <span class="APPLICATION">Privoxy</span> at all. Of
+ course this may actually be desired and there is no reason
+ to make these exceptions if you aren't sure you need them.
+ </p>
+ <p>
+ If you also want to be able to reach servers in your local
+ network by using their names, you will need additional
+ exceptions that look like this:
+ </p>
+ <p>
+ </p>
+ <table border="0" bgcolor="#E0E0E0" width="90%">
+ <tr>
+ <td>
+<pre class="SCREEN">
+ forward localhost/ .
+</pre>
+ </td>
+ </tr>
+ </table>
+ </dd>
+ </dl>
+ </div>
+ </div>
+ <div class="SECT3">
+ <h4 class="SECT3">
+ <a name="ADVANCED-FORWARDING-EXAMPLES">7.5.3. Advanced Forwarding
+ Examples</a>
+ </h4>
+ <p>
+ If you have links to multiple ISPs that provide various special
+ content only to their subscribers, you can configure multiple
+ <span class="APPLICATION">Privoxies</span> which have connections
+ to the respective ISPs to act as forwarders to each other, so
+ that <span class="emphasis"><i class="EMPHASIS">your</i></span>
+ users can see the internal content of all ISPs.
+ </p>
+ <p>
+ Assume that host-a has a PPP connection to isp-a.example.net. And
+ host-b has a PPP connection to isp-b.example.org. Both run <span
+ class="APPLICATION">Privoxy</span>. Their forwarding
+ configuration can look like this:
+ </p>
+ <p>
+ host-a:
+ </p>
+ <p>
+ </p>
+ <table border="0" bgcolor="#E0E0E0" width="100%">
+ <tr>
+ <td>
+<pre class="SCREEN">
+ forward / .
+ forward .isp-b.example.net host-b:8118
+</pre>
+ </td>
+ </tr>
+ </table>
+
+ <p>
+ host-b:
+ </p>
+ <p>
+ </p>
+ <table border="0" bgcolor="#E0E0E0" width="100%">
+ <tr>
+ <td>
+<pre class="SCREEN">
+ forward / .
+ forward .isp-a.example.org host-a:8118
+</pre>
+ </td>
+ </tr>
+ </table>
+
+ <p>
+ Now, your users can set their browser's proxy to use either
+ host-a or host-b and be able to browse the internal content of
+ both isp-a and isp-b.
+ </p>
+ <p>
+ If you intend to chain <span class="APPLICATION">Privoxy</span>
+ and <span class="APPLICATION">squid</span> locally, then chaining
+ as <tt class="LITERAL">browser -> squid -> privoxy</tt> is
+ the recommended way.
+ </p>
+ <p>
+ Assuming that <span class="APPLICATION">Privoxy</span> and <span
+ class="APPLICATION">squid</span> run on the same box, your <span
+ class="APPLICATION">squid</span> configuration could then look
+ like this:
+ </p>
+ <p>
+ </p>
+ <table border="0" bgcolor="#E0E0E0" width="100%">
+ <tr>
+ <td>
+<pre class="SCREEN">
+ # Define Privoxy as parent proxy (without ICP)
+ cache_peer 127.0.0.1 parent 8118 7 no-query
+
+ # Define ACL for protocol FTP
+ acl ftp proto FTP