+> A rule that uses a SOCKS 4 gateway for all destinations but no HTTP parent looks like this:
+ </P
+><P
+> <TABLE
+BORDER="0"
+BGCOLOR="#E0E0E0"
+WIDTH="90%"
+><TR
+><TD
+><PRE
+CLASS="SCREEN"
+> forward-socks4 / socks-gw.example.com:1080 .</PRE
+></TD
+></TR
+></TABLE
+>
+ </P
+><P
+> To chain Privoxy and Tor, both running on the same system, you would use
+ something like:
+ </P
+><P
+> <TABLE
+BORDER="0"
+BGCOLOR="#E0E0E0"
+WIDTH="90%"
+><TR
+><TD
+><PRE
+CLASS="SCREEN"
+> forward-socks5 / 127.0.0.1:9050 .</PRE
+></TD
+></TR
+></TABLE
+>
+ </P
+><P
+> The public <SPAN
+CLASS="APPLICATION"
+>Tor</SPAN
+> network can't be used to
+ reach your local network, if you need to access local servers you
+ therefore might want to make some exceptions:
+ </P
+><P
+> <TABLE
+BORDER="0"
+BGCOLOR="#E0E0E0"
+WIDTH="90%"
+><TR
+><TD
+><PRE
+CLASS="SCREEN"
+> forward 192.168.*.*/ .
+ forward 10.*.*.*/ .
+ forward 127.*.*.*/ .</PRE
+></TD
+></TR
+></TABLE
+>
+ </P
+><P
+> Unencrypted connections to systems in these address ranges will
+ be as (un)secure as the local network is, but the alternative is that you
+ can't reach the local network through <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+>
+ at all. Of course this may actually be desired and there is no reason
+ to make these exceptions if you aren't sure you need them.
+ </P
+><P
+> If you also want to be able to reach servers in your local network by
+ using their names, you will need additional exceptions that look like
+ this:
+ </P
+><P
+> <TABLE
+BORDER="0"
+BGCOLOR="#E0E0E0"
+WIDTH="90%"
+><TR
+><TD
+><PRE
+CLASS="SCREEN"
+> forward localhost/ .</PRE
+></TD
+></TR
+></TABLE
+>
+ </P
+></DD
+></DL
+></DIV
+></DIV
+><DIV
+CLASS="SECT3"
+><H4
+CLASS="SECT3"
+><A
+NAME="ADVANCED-FORWARDING-EXAMPLES"
+>7.5.3. Advanced Forwarding Examples</A
+></H4
+><P
+> If you have links to multiple ISPs that provide various special content
+ only to their subscribers, you can configure multiple <SPAN
+CLASS="APPLICATION"
+>Privoxies</SPAN
+>
+ which have connections to the respective ISPs to act as forwarders to each other, so that
+ <SPAN
+CLASS="emphasis"
+><I
+CLASS="EMPHASIS"
+>your</I
+></SPAN
+> users can see the internal content of all ISPs.</P
+><P
+> Assume that host-a has a PPP connection to isp-a.example.net. And host-b has a PPP connection to
+ isp-b.example.org. Both run <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+>. Their forwarding
+ configuration can look like this:</P
+><P
+> host-a:</P
+><P
+> <TABLE
+BORDER="0"
+BGCOLOR="#E0E0E0"
+WIDTH="100%"
+><TR
+><TD
+><PRE
+CLASS="SCREEN"
+> forward / .
+ forward .isp-b.example.net host-b:8118</PRE
+></TD
+></TR
+></TABLE
+></P
+><P
+> host-b:</P
+><P
+> <TABLE
+BORDER="0"
+BGCOLOR="#E0E0E0"
+WIDTH="100%"
+><TR
+><TD
+><PRE
+CLASS="SCREEN"
+> forward / .
+ forward .isp-a.example.org host-a:8118</PRE
+></TD
+></TR
+></TABLE
+></P
+><P
+> Now, your users can set their browser's proxy to use either
+ host-a or host-b and be able to browse the internal content
+ of both isp-a and isp-b.</P
+><P
+> If you intend to chain <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+> and
+ <SPAN
+CLASS="APPLICATION"
+>squid</SPAN
+> locally, then chaining as
+ <TT
+CLASS="LITERAL"
+>browser -> squid -> privoxy</TT
+> is the recommended way. </P
+><P
+> Assuming that <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+> and <SPAN
+CLASS="APPLICATION"
+>squid</SPAN
+>
+ run on the same box, your <SPAN
+CLASS="APPLICATION"
+>squid</SPAN
+> configuration could then look like this:</P
+><P
+> <TABLE
+BORDER="0"
+BGCOLOR="#E0E0E0"
+WIDTH="100%"
+><TR
+><TD
+><PRE
+CLASS="SCREEN"
+> # Define Privoxy as parent proxy (without ICP)
+ cache_peer 127.0.0.1 parent 8118 7 no-query
+
+ # Define ACL for protocol FTP
+ acl ftp proto FTP
+
+ # Do not forward FTP requests to Privoxy
+ always_direct allow ftp
+
+ # Forward all the rest to Privoxy
+ never_direct allow all</PRE
+></TD
+></TR
+></TABLE
+></P
+><P
+> You would then need to change your browser's proxy settings to <SPAN
+CLASS="APPLICATION"
+>squid</SPAN
+>'s address and port.
+ Squid normally uses port 3128. If unsure consult <TT
+CLASS="LITERAL"
+>http_port</TT
+> in <TT
+CLASS="FILENAME"
+>squid.conf</TT
+>.</P
+><P
+> You could just as well decide to only forward requests you suspect
+ of leading to Windows executables through a virus-scanning parent proxy,
+ say, on <TT
+CLASS="LITERAL"
+>antivir.example.com</TT
+>, port 8010:</P
+><P
+> <TABLE
+BORDER="0"
+BGCOLOR="#E0E0E0"
+WIDTH="100%"
+><TR
+><TD
+><PRE
+CLASS="SCREEN"
+> forward / .
+ forward /.*\.(exe|com|dll|zip)$ antivir.example.com:8010</PRE
+></TD
+></TR
+></TABLE
+> </P
+></DIV
+><DIV
+CLASS="SECT3"
+><H4
+CLASS="SECT3"
+><A
+NAME="FORWARDED-CONNECT-RETRIES"
+>7.5.4. forwarded-connect-retries</A
+></H4
+><P
+></P
+><DIV
+CLASS="VARIABLELIST"
+><DL
+><DT
+>Specifies:</DT
+><DD
+><P
+> How often Privoxy retries if a forwarded connection request fails.
+ </P
+></DD
+><DT
+>Type of value:</DT
+><DD
+><P
+> <TT
+CLASS="REPLACEABLE"
+><I
+>Number of retries.</I
+></TT
+>
+ </P
+></DD
+><DT
+>Default value:</DT
+><DD
+><P
+><SPAN
+CLASS="emphasis"
+><I
+CLASS="EMPHASIS"
+>0</I
+></SPAN
+></P
+></DD
+><DT
+>Effect if unset:</DT
+><DD
+><P
+> Connections forwarded through other proxies are treated like direct connections and no retry attempts are made.
+ </P
+></DD
+><DT
+>Notes:</DT
+><DD
+><P
+> <TT
+CLASS="REPLACEABLE"
+><I
+>forwarded-connect-retries</I
+></TT
+> is mainly interesting
+ for socks4a connections, where <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+> can't detect why the connections failed.
+ The connection might have failed because of a DNS timeout in which case a retry makes sense,
+ but it might also have failed because the server doesn't exist or isn't reachable. In this
+ case the retry will just delay the appearance of Privoxy's error message.
+ </P
+><P
+> Note that in the context of this option, <SPAN
+CLASS="QUOTE"
+>"forwarded connections"</SPAN
+> includes all connections
+ that Privoxy forwards through other proxies. This option is not limited to the HTTP CONNECT method.
+ </P
+><P
+> Only use this option, if you are getting lots of forwarding-related error messages
+ that go away when you try again manually. Start with a small value and check Privoxy's
+ logfile from time to time, to see how many retries are usually needed.
+ </P
+><P
+> Due to a bug, this option currently also causes Privoxy to
+ retry in case of certain problems with direct connections.
+ </P
+></DD
+><DT
+>Examples:</DT
+><DD
+><P
+> forwarded-connect-retries 1
+ </P
+></DD
+></DL
+></DIV
+></DIV
+></DIV
+><DIV
+CLASS="SECT2"
+><H2
+CLASS="SECT2"
+><A
+NAME="MISC"
+>7.6. Miscellaneous</A
+></H2
+><DIV
+CLASS="SECT3"
+><H4
+CLASS="SECT3"
+><A
+NAME="ACCEPT-INTERCEPTED-REQUESTS"
+>7.6.1. accept-intercepted-requests</A
+></H4
+><P
+></P
+><DIV
+CLASS="VARIABLELIST"
+><DL
+><DT
+>Specifies:</DT
+><DD
+><P
+> Whether intercepted requests should be treated as valid.
+ </P
+></DD
+><DT
+>Type of value:</DT
+><DD
+><P
+> <TT
+CLASS="REPLACEABLE"
+><I
+>0 or 1</I
+></TT
+>
+ </P
+></DD
+><DT
+>Default value:</DT
+><DD
+><P
+><SPAN
+CLASS="emphasis"
+><I
+CLASS="EMPHASIS"
+>0</I
+></SPAN
+></P
+></DD
+><DT
+>Effect if unset:</DT
+><DD
+><P
+> Only proxy requests are accepted, intercepted requests are treated as invalid.
+ </P
+></DD
+><DT
+>Notes:</DT
+><DD
+><P
+> If you don't trust your clients and want to force them
+ to use <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+>, enable this
+ option and configure your packet filter to redirect outgoing
+ HTTP connections into <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+>.
+ </P
+><P
+> Make sure that <SPAN
+CLASS="APPLICATION"
+>Privoxy's</SPAN
+> own requests
+ aren't redirected as well. Additionally take care that
+ <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+> can't intentionally connect
+ to itself, otherwise you could run into redirection loops if
+ <SPAN
+CLASS="APPLICATION"
+>Privoxy's</SPAN
+> listening port is reachable
+ by the outside or an attacker has access to the pages you visit.
+ </P
+></DD
+><DT
+>Examples:</DT
+><DD
+><P
+> accept-intercepted-requests 1
+ </P
+></DD
+></DL
+></DIV
+></DIV
+><DIV
+CLASS="SECT3"
+><H4
+CLASS="SECT3"
+><A
+NAME="ALLOW-CGI-REQUEST-CRUNCHING"
+>7.6.2. allow-cgi-request-crunching</A
+></H4
+><P
+></P
+><DIV
+CLASS="VARIABLELIST"
+><DL
+><DT
+>Specifies:</DT
+><DD
+><P
+> Whether requests to <SPAN
+CLASS="APPLICATION"
+>Privoxy's</SPAN
+> CGI pages can be blocked or redirected.
+ </P
+></DD
+><DT
+>Type of value:</DT
+><DD
+><P
+> <TT
+CLASS="REPLACEABLE"
+><I
+>0 or 1</I
+></TT
+>
+ </P
+></DD
+><DT
+>Default value:</DT
+><DD
+><P
+><SPAN
+CLASS="emphasis"
+><I
+CLASS="EMPHASIS"
+>0</I
+></SPAN
+></P
+></DD
+><DT
+>Effect if unset:</DT
+><DD
+><P
+> <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+> ignores block and redirect actions for its CGI pages.
+ </P
+></DD
+><DT
+>Notes:</DT
+><DD
+><P
+> By default <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+> ignores block or redirect actions
+ for its CGI pages. Intercepting these requests can be useful in multi-user
+ setups to implement fine-grained access control, but it can also render the complete
+ web interface useless and make debugging problems painful if done without care.
+ </P
+><P
+> Don't enable this option unless you're sure that you really need it.
+ </P
+></DD
+><DT
+>Examples:</DT
+><DD
+><P
+> allow-cgi-request-crunching 1
+ </P
+></DD
+></DL
+></DIV
+></DIV
+><DIV
+CLASS="SECT3"
+><H4
+CLASS="SECT3"
+><A
+NAME="SPLIT-LARGE-FORMS"
+>7.6.3. split-large-forms</A
+></H4
+><P
+></P
+><DIV
+CLASS="VARIABLELIST"
+><DL
+><DT
+>Specifies:</DT
+><DD
+><P
+> Whether the CGI interface should stay compatible with broken HTTP clients.
+ </P
+></DD
+><DT
+>Type of value:</DT
+><DD
+><P
+> <TT
+CLASS="REPLACEABLE"
+><I
+>0 or 1</I
+></TT
+>
+ </P
+></DD
+><DT
+>Default value:</DT
+><DD
+><P
+><SPAN
+CLASS="emphasis"
+><I
+CLASS="EMPHASIS"
+>0</I
+></SPAN
+></P
+></DD
+><DT
+>Effect if unset:</DT
+><DD
+><P
+> The CGI form generate long GET URLs.
+ </P
+></DD
+><DT
+>Notes:</DT
+><DD
+><P
+> <SPAN
+CLASS="APPLICATION"
+>Privoxy's</SPAN
+> CGI forms can lead to
+ rather long URLs. This isn't a problem as far as the HTTP
+ standard is concerned, but it can confuse clients with arbitrary
+ URL length limitations.
+ </P
+><P
+> Enabling split-large-forms causes <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+>
+ to divide big forms into smaller ones to keep the URL length down.
+ It makes editing a lot less convenient and you can no longer
+ submit all changes at once, but at least it works around this
+ browser bug.
+ </P
+><P
+> If you don't notice any editing problems, there is no reason
+ to enable this option, but if one of the submit buttons appears
+ to be broken, you should give it a try.
+ </P
+></DD
+><DT
+>Examples:</DT
+><DD
+><P
+> split-large-forms 1
+ </P
+></DD
+></DL
+></DIV
+></DIV
+><DIV
+CLASS="SECT3"
+><H4
+CLASS="SECT3"
+><A
+NAME="KEEP-ALIVE-TIMEOUT"
+>7.6.4. keep-alive-timeout</A
+></H4
+><P
+></P
+><DIV
+CLASS="VARIABLELIST"
+><DL
+><DT
+>Specifies:</DT
+><DD
+><P
+> Number of seconds after which an open connection will no longer be reused.
+ </P
+></DD
+><DT
+>Type of value:</DT
+><DD
+><P
+> <TT
+CLASS="REPLACEABLE"
+><I
+>Time in seconds.</I
+></TT
+>
+ </P
+></DD
+><DT
+>Default value:</DT
+><DD
+><P
+>None</P
+></DD
+><DT
+>Effect if unset:</DT
+><DD
+><P
+> Connections are not kept alive.
+ </P
+></DD
+><DT
+>Notes:</DT
+><DD
+><P
+> This option allows clients to keep the connection to <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+>
+ alive. If the server supports it, <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+> will keep
+ the connection to the server alive as well. Under certain
+ circumstances this may result in speed-ups.
+ </P
+><P
+> By default, <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+> will close the connection to the server if
+ the client connection gets closed, or if the specified timeout
+ has been reached without a new request coming in. This behaviour
+ can be changed with the <A
+HREF="#CONNECTION-SHARING"
+TARGET="_top"
+>connection-sharing</A
+> option.
+ </P
+><P
+> This option has no effect if <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+>
+ has been compiled without keep-alive support.
+ </P
+><P
+> Note that a timeout of five seconds as used in the default
+ configuration file significantly decreases the number of
+ connections that will be reused. The value is used because
+ some browsers limit the number of connections they open to
+ a single host and apply the same limit to proxies. This can
+ result in a single website <SPAN
+CLASS="QUOTE"
+>"grabbing"</SPAN
+> all the
+ connections the browser allows, which means connections to
+ other websites can't be opened until the connections currently
+ in use time out.
+ </P
+><P
+> Several users have reported this as a Privoxy bug, so the
+ default value has been reduced. Consider increasing it to
+ 300 seconds or even more if you think your browser can handle
+ it. If your browser appears to be hanging it can't.
+ </P
+></DD
+><DT
+>Examples:</DT
+><DD
+><P
+> keep-alive-timeout 300
+ </P
+></DD
+></DL
+></DIV
+></DIV
+><DIV
+CLASS="SECT3"
+><H4
+CLASS="SECT3"
+><A
+NAME="DEFAULT-SERVER-TIMEOUT"
+>7.6.5. default-server-timeout</A
+></H4
+><P
+></P
+><DIV
+CLASS="VARIABLELIST"
+><DL
+><DT
+>Specifies:</DT
+><DD
+><P
+> Assumed server-side keep-alive timeout if not specified by the server.
+ </P
+></DD
+><DT
+>Type of value:</DT
+><DD
+><P
+> <TT
+CLASS="REPLACEABLE"
+><I
+>Time in seconds.</I
+></TT
+>
+ </P
+></DD
+><DT
+>Default value:</DT
+><DD
+><P
+>None</P
+></DD
+><DT
+>Effect if unset:</DT
+><DD
+><P
+> Connections for which the server didn't specify the keep-alive
+ timeout are not reused.
+ </P
+></DD
+><DT
+>Notes:</DT
+><DD
+><P
+> Enabling this option significantly increases the number of connections
+ that are reused, provided the <A
+HREF="#KEEP-ALIVE-TIMEOUT"
+TARGET="_top"
+>keep-alive-timeout</A
+> option
+ is also enabled.
+ </P
+><P
+> While it also increases the number of connections problems
+ when <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+> tries to reuse a connection that already has
+ been closed on the server side, or is closed while <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+>
+ is trying to reuse it, this should only be a problem if it
+ happens for the first request sent by the client. If it happens
+ for requests on reused client connections, <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+> will simply
+ close the connection and the client is supposed to retry the
+ request without bothering the user.
+ </P
+><P
+> Enabling this option is therefore only recommended if the
+ <A
+HREF="#CONNECTION-SHARING"
+TARGET="_top"
+>connection-sharing</A
+> option
+ is disabled.
+ </P
+><P
+> It is an error to specify a value larger than the <A
+HREF="#KEEP-ALIVE-TIMEOUT"
+TARGET="_top"
+>keep-alive-timeout</A
+> value.
+ </P
+><P
+> This option has no effect if <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+>
+ has been compiled without keep-alive support.
+ </P
+></DD
+><DT
+>Examples:</DT
+><DD
+><P
+> default-server-timeout 60
+ </P
+></DD
+></DL
+></DIV
+></DIV
+><DIV
+CLASS="SECT3"
+><H4
+CLASS="SECT3"
+><A
+NAME="CONNECTION-SHARING"
+>7.6.6. connection-sharing</A
+></H4
+><P
+></P
+><DIV
+CLASS="VARIABLELIST"
+><DL
+><DT
+>Specifies:</DT
+><DD
+><P
+> Whether or not outgoing connections that have been kept alive
+ should be shared between different incoming connections.
+ </P
+></DD
+><DT
+>Type of value:</DT
+><DD
+><P
+> <TT
+CLASS="REPLACEABLE"
+><I
+>0 or 1</I
+></TT
+>
+ </P
+></DD
+><DT
+>Default value:</DT
+><DD
+><P
+>None</P
+></DD
+><DT
+>Effect if unset:</DT
+><DD
+><P
+> Connections are not shared.
+ </P
+></DD
+><DT
+>Notes:</DT
+><DD
+><P
+> This option has no effect if <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+>
+ has been compiled without keep-alive support, or if it's disabled.
+ </P
+></DD
+><DT
+>Notes:</DT
+><DD
+><P
+> Note that reusing connections doesn't necessary cause speedups.
+ There are also a few privacy implications you should be aware of.
+ </P
+><P
+> If this option is effective, outgoing connections are shared between
+ clients (if there are more than one) and closing the browser that initiated
+ the outgoing connection does no longer affect the connection between <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+>
+ and the server unless the client's request hasn't been completed yet.
+ </P
+><P
+> If the outgoing connection is idle, it will not be closed until either
+ <SPAN
+CLASS="APPLICATION"
+>Privoxy's</SPAN
+> or the server's timeout is reached.
+ While it's open, the server knows that the system running <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+> is still
+ there.
+ </P
+><P
+> If there are more than one client (maybe even belonging to multiple users),
+ they will be able to reuse each others connections. This is potentially
+ dangerous in case of authentication schemes like NTLM where only the
+ connection is authenticated, instead of requiring authentication for
+ each request.
+ </P
+><P
+> If there is only a single client, and if said client can keep connections
+ alive on its own, enabling this option has next to no effect. If the client
+ doesn't support connection keep-alive, enabling this option may make sense
+ as it allows <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+> to keep outgoing connections alive even if the client
+ itself doesn't support it.
+ </P
+><P
+> You should also be aware that enabling this option increases the likelihood
+ of getting the "No server or forwarder data" error message, especially if you
+ are using a slow connection to the Internet.
+ </P
+><P
+> This option should only be used by experienced users who
+ understand the risks and can weight them against the benefits.
+ </P
+></DD
+><DT
+>Examples:</DT
+><DD
+><P
+> connection-sharing 1
+ </P
+></DD
+></DL
+></DIV
+></DIV
+><DIV
+CLASS="SECT3"
+><H4
+CLASS="SECT3"
+><A
+NAME="SOCKET-TIMEOUT"
+>7.6.7. socket-timeout</A
+></H4
+><P
+></P
+><DIV
+CLASS="VARIABLELIST"
+><DL
+><DT
+>Specifies:</DT
+><DD
+><P
+> Number of seconds after which a socket times out if
+ no data is received.
+ </P
+></DD
+><DT
+>Type of value:</DT
+><DD
+><P
+> <TT
+CLASS="REPLACEABLE"
+><I
+>Time in seconds.</I
+></TT
+>
+ </P
+></DD
+><DT
+>Default value:</DT
+><DD
+><P
+>None</P
+></DD
+><DT
+>Effect if unset:</DT
+><DD
+><P
+> A default value of 300 seconds is used.
+ </P
+></DD
+><DT
+>Notes:</DT
+><DD
+><P
+> For SOCKS requests the timeout currently doesn't start until
+ the SOCKS server accepted the request. This will be fixed in
+ the next release.