+ </div>
+ </div>
+
+ <div class="SECT2">
+ <h2 class="SECT2"><a name="FORWARDING" id="FORWARDING">7.5.
+ Forwarding</a></h2>
+
+ <p>This feature allows routing of HTTP requests through a chain of
+ multiple proxies.</p>
+
+ <p>Forwarding can be used to chain Privoxy with a caching proxy to
+ speed up browsing. Using a parent proxy may also be necessary if the
+ machine that <span class="APPLICATION">Privoxy</span> runs on has no
+ direct Internet access.</p>
+
+ <p>Note that parent proxies can severely decrease your privacy level.
+ For example a parent proxy could add your IP address to the request
+ headers and if it's a caching proxy it may add the <span class=
+ "QUOTE">"Etag"</span> header to revalidation requests again, even
+ though you configured Privoxy to remove it. It may also ignore
+ Privoxy's header time randomization and use the original values which
+ could be used by the server as cookie replacement to track your steps
+ between visits.</p>
+
+ <p>Also specified here are SOCKS proxies. <span class=
+ "APPLICATION">Privoxy</span> supports the SOCKS 4 and SOCKS 4A
+ protocols.</p>
+
+ <div class="SECT3">
+ <h4 class="SECT3"><a name="FORWARD" id="FORWARD">7.5.1.
+ forward</a></h4>
+
+ <div class="VARIABLELIST">
+ <dl>
+ <dt>Specifies:</dt>
+
+ <dd>
+ <p>To which parent HTTP proxy specific requests should be
+ routed.</p>
+ </dd>
+
+ <dt>Type of value:</dt>
+
+ <dd>
+ <p><tt class="REPLACEABLE"><i>target_pattern</i></tt>
+ <tt class="REPLACEABLE"><i>http_parent</i></tt>[:<tt class=
+ "REPLACEABLE"><i>port</i></tt>]</p>
+
+ <p>where <tt class="REPLACEABLE"><i>target_pattern</i></tt> is
+ a <a href="actions-file.html#AF-PATTERNS">URL pattern</a> that
+ specifies to which requests (i.e. URLs) this forward rule shall
+ apply. Use <tt class="LITERAL">/</tt> to denote <span class=
+ "QUOTE">"all URLs"</span>. <tt class=
+ "REPLACEABLE"><i>http_parent</i></tt>[:<tt class=
+ "REPLACEABLE"><i>port</i></tt>] is the DNS name or IP address
+ of the parent HTTP proxy through which the requests should be
+ forwarded, optionally followed by its listening port (default:
+ 8000). Use a single dot (<tt class="LITERAL">.</tt>) to denote
+ <span class="QUOTE">"no forwarding"</span>.</p>
+ </dd>
+
+ <dt>Default value:</dt>
+
+ <dd>
+ <p><span class="emphasis"><i class=
+ "EMPHASIS">Unset</i></span></p>
+ </dd>
+
+ <dt>Effect if unset:</dt>
+
+ <dd>
+ <p>Don't use parent HTTP proxies.</p>
+ </dd>
+
+ <dt>Notes:</dt>
+
+ <dd>
+ <p>If <tt class="REPLACEABLE"><i>http_parent</i></tt> is
+ <span class="QUOTE">"."</span>, then requests are not forwarded
+ to another HTTP proxy but are made directly to the web
+ servers.</p>
+
+ <p><tt class="REPLACEABLE"><i>http_parent</i></tt> can be a
+ numerical IPv6 address (if <a href=
+ "http://tools.ietf.org/html/rfc3493" target="_top">RFC 3493</a>
+ is implemented). To prevent clashes with the port delimiter,
+ the whole IP address has to be put into brackets. On the other
+ hand a <tt class="REPLACEABLE"><i>target_pattern</i></tt>
+ containing an IPv6 address has to be put into angle brackets
+ (normal brackets are reserved for regular expressions
+ already).</p>
+
+ <p>Multiple lines are OK, they are checked in sequence, and the
+ last match wins.</p>
+ </dd>
+
+ <dt>Examples:</dt>
+
+ <dd>
+ <p>Everything goes to an example parent proxy, except SSL on
+ port 443 (which it doesn't handle):</p>
+
+ <table border="0" bgcolor="#E0E0E0" width="90%">
+ <tr>
+ <td>
+ <pre class="SCREEN">
+ forward / parent-proxy.example.org:8080
+ forward :443 .
+</pre>
+ </td>
+ </tr>
+ </table>
+
+ <p>Everything goes to our example ISP's caching proxy, except
+ for requests to that ISP's sites:</p>
+
+ <table border="0" bgcolor="#E0E0E0" width="90%">
+ <tr>
+ <td>
+ <pre class="SCREEN">
+ forward / caching-proxy.isp.example.net:8000
+ forward .isp.example.net .
+</pre>
+ </td>
+ </tr>
+ </table>
+
+ <p>Parent proxy specified by an IPv6 address:</p>
+
+ <table border="0" bgcolor="#E0E0E0" width="90%">
+ <tr>
+ <td>
+ <pre class="PROGRAMLISTING">
+ forward / [2001:DB8::1]:8000
+</pre>
+ </td>
+ </tr>
+ </table>
+
+ <p>Suppose your parent proxy doesn't support IPv6:</p>
+
+ <table border="0" bgcolor="#E0E0E0" width="90%">
+ <tr>
+ <td>
+ <pre class="PROGRAMLISTING">
+ forward / parent-proxy.example.org:8000
+ forward ipv6-server.example.org .
+ forward <[2-3][0-9a-f][0-9a-f][0-9a-f]:*> .
+</pre>
+ </td>
+ </tr>
+ </table>
+ </dd>
+ </dl>
+ </div>
+ </div>
+
+ <div class="SECT3">
+ <h4 class="SECT3"><a name="SOCKS" id="SOCKS">7.5.2. forward-socks4,
+ forward-socks4a, forward-socks5 and forward-socks5t</a></h4><a name=
+ "FORWARD-SOCKS4" id="FORWARD-SOCKS4"></a><a name="FORWARD-SOCKS4A"
+ id="FORWARD-SOCKS4A"></a>
+
+ <div class="VARIABLELIST">
+ <dl>
+ <dt>Specifies:</dt>
+
+ <dd>
+ <p>Through which SOCKS proxy (and optionally to which parent
+ HTTP proxy) specific requests should be routed.</p>
+ </dd>
+
+ <dt>Type of value:</dt>
+
+ <dd>
+ <p><tt class="REPLACEABLE"><i>target_pattern</i></tt>
+ <tt class="REPLACEABLE"><i>socks_proxy</i></tt>[:<tt class=
+ "REPLACEABLE"><i>port</i></tt>] <tt class=
+ "REPLACEABLE"><i>http_parent</i></tt>[:<tt class=
+ "REPLACEABLE"><i>port</i></tt>]</p>
+
+ <p>where <tt class="REPLACEABLE"><i>target_pattern</i></tt> is
+ a <a href="actions-file.html#AF-PATTERNS">URL pattern</a> that
+ specifies to which requests (i.e. URLs) this forward rule shall
+ apply. Use <tt class="LITERAL">/</tt> to denote <span class=
+ "QUOTE">"all URLs"</span>. <tt class=
+ "REPLACEABLE"><i>http_parent</i></tt> and <tt class=
+ "REPLACEABLE"><i>socks_proxy</i></tt> are IP addresses in
+ dotted decimal notation or valid DNS names (<tt class=
+ "REPLACEABLE"><i>http_parent</i></tt> may be <span class=
+ "QUOTE">"."</span> to denote <span class="QUOTE">"no HTTP
+ forwarding"</span>), and the optional <tt class=
+ "REPLACEABLE"><i>port</i></tt> parameters are TCP ports, i.e.
+ integer values from 1 to 65535</p>
+ </dd>
+
+ <dt>Default value:</dt>
+
+ <dd>
+ <p><span class="emphasis"><i class=
+ "EMPHASIS">Unset</i></span></p>
+ </dd>
+
+ <dt>Effect if unset:</dt>
+
+ <dd>
+ <p>Don't use SOCKS proxies.</p>
+ </dd>
+
+ <dt>Notes:</dt>
+
+ <dd>
+ <p>Multiple lines are OK, they are checked in sequence, and the
+ last match wins.</p>
+
+ <p>The difference between <tt class=
+ "LITERAL">forward-socks4</tt> and <tt class=
+ "LITERAL">forward-socks4a</tt> is that in the SOCKS 4A
+ protocol, the DNS resolution of the target hostname happens on
+ the SOCKS server, while in SOCKS 4 it happens locally.</p>
+
+ <p>With <tt class="LITERAL">forward-socks5</tt> the DNS
+ resolution will happen on the remote server as well.</p>
+
+ <p><tt class="LITERAL">forward-socks5t</tt> works like vanilla
+ <tt class="LITERAL">forward-socks5</tt> but lets <span class=
+ "APPLICATION">Privoxy</span> additionally use Tor-specific
+ SOCKS extensions. Currently the only supported SOCKS extension
+ is optimistic data which can reduce the latency for the first
+ request made on a newly created connection.</p>
+
+ <p><tt class="REPLACEABLE"><i>socks_proxy</i></tt> and
+ <tt class="REPLACEABLE"><i>http_parent</i></tt> can be a
+ numerical IPv6 address (if <a href=
+ "http://tools.ietf.org/html/rfc3493" target="_top">RFC 3493</a>
+ is implemented). To prevent clashes with the port delimiter,
+ the whole IP address has to be put into brackets. On the other
+ hand a <tt class="REPLACEABLE"><i>target_pattern</i></tt>
+ containing an IPv6 address has to be put into angle brackets
+ (normal brackets are reserved for regular expressions
+ already).</p>
+
+ <p>If <tt class="REPLACEABLE"><i>http_parent</i></tt> is
+ <span class="QUOTE">"."</span>, then requests are not forwarded
+ to another HTTP proxy but are made (HTTP-wise) directly to the
+ web servers, albeit through a SOCKS proxy.</p>
+ </dd>
+
+ <dt>Examples:</dt>
+
+ <dd>
+ <p>From the company example.com, direct connections are made to
+ all <span class="QUOTE">"internal"</span> domains, but
+ everything outbound goes through their ISP's proxy by way of
+ example.com's corporate SOCKS 4A gateway to the Internet.</p>
+
+ <table border="0" bgcolor="#E0E0E0" width="90%">
+ <tr>
+ <td>
+ <pre class="SCREEN">
+ forward-socks4a / socks-gw.example.com:1080 www-cache.isp.example.net:8080
+ forward .example.com .
+</pre>
+ </td>
+ </tr>
+ </table>
+
+ <p>A rule that uses a SOCKS 4 gateway for all destinations but
+ no HTTP parent looks like this:</p>
+
+ <table border="0" bgcolor="#E0E0E0" width="90%">
+ <tr>
+ <td>
+ <pre class="SCREEN">
+ forward-socks4 / socks-gw.example.com:1080 .
+</pre>
+ </td>
+ </tr>
+ </table>
+
+ <p>To chain Privoxy and Tor, both running on the same system,
+ you would use something like:</p>
+
+ <table border="0" bgcolor="#E0E0E0" width="90%">
+ <tr>
+ <td>
+ <pre class="SCREEN">
+ forward-socks5t / 127.0.0.1:9050 .
+</pre>
+ </td>
+ </tr>
+ </table>
+
+ <p>Note that if you got Tor through one of the bundles, you may
+ have to change the port from 9050 to 9150 (or even another
+ one). For details, please check the documentation on the
+ <a href="https://torproject.org/" target="_top">Tor
+ website</a>.</p>
+
+ <p>The public <span class="APPLICATION">Tor</span> network
+ can't be used to reach your local network, if you need to
+ access local servers you therefore might want to make some
+ exceptions:</p>
+
+ <table border="0" bgcolor="#E0E0E0" width="90%">
+ <tr>
+ <td>
+ <pre class="SCREEN">
+ forward 192.168.*.*/ .
+ forward 10.*.*.*/ .
+ forward 127.*.*.*/ .
+</pre>
+ </td>
+ </tr>
+ </table>
+
+ <p>Unencrypted connections to systems in these address ranges
+ will be as (un)secure as the local network is, but the
+ alternative is that you can't reach the local network through
+ <span class="APPLICATION">Privoxy</span> at all. Of course this
+ may actually be desired and there is no reason to make these
+ exceptions if you aren't sure you need them.</p>
+
+ <p>If you also want to be able to reach servers in your local
+ network by using their names, you will need additional
+ exceptions that look like this:</p>
+
+ <table border="0" bgcolor="#E0E0E0" width="90%">
+ <tr>
+ <td>
+ <pre class="SCREEN">
+ forward localhost/ .
+</pre>
+ </td>
+ </tr>
+ </table>
+ </dd>
+ </dl>
+ </div>
+ </div>
+
+ <div class="SECT3">
+ <h4 class="SECT3"><a name="ADVANCED-FORWARDING-EXAMPLES" id=
+ "ADVANCED-FORWARDING-EXAMPLES">7.5.3. Advanced Forwarding
+ Examples</a></h4>
+
+ <p>If you have links to multiple ISPs that provide various special
+ content only to their subscribers, you can configure multiple
+ <span class="APPLICATION">Privoxies</span> which have connections to
+ the respective ISPs to act as forwarders to each other, so that
+ <span class="emphasis"><i class="EMPHASIS">your</i></span> users can
+ see the internal content of all ISPs.</p>
+
+ <p>Assume that host-a has a PPP connection to isp-a.example.net. And
+ host-b has a PPP connection to isp-b.example.org. Both run
+ <span class="APPLICATION">Privoxy</span>. Their forwarding
+ configuration can look like this:</p>
+
+ <p>host-a:</p>
+
+ <table border="0" bgcolor="#E0E0E0" width="100%">
+ <tr>
+ <td>
+ <pre class="SCREEN">
+ forward / .
+ forward .isp-b.example.net host-b:8118
+</pre>
+ </td>
+ </tr>
+ </table>
+
+ <p>host-b:</p>
+
+ <table border="0" bgcolor="#E0E0E0" width="100%">
+ <tr>
+ <td>
+ <pre class="SCREEN">
+ forward / .
+ forward .isp-a.example.org host-a:8118
+</pre>
+ </td>
+ </tr>
+ </table>
+
+ <p>Now, your users can set their browser's proxy to use either host-a
+ or host-b and be able to browse the internal content of both isp-a
+ and isp-b.</p>
+
+ <p>If you intend to chain <span class="APPLICATION">Privoxy</span>
+ and <span class="APPLICATION">squid</span> locally, then chaining as
+ <tt class="LITERAL">browser -> squid -> privoxy</tt> is the
+ recommended way.</p>
+
+ <p>Assuming that <span class="APPLICATION">Privoxy</span> and
+ <span class="APPLICATION">squid</span> run on the same box, your
+ <span class="APPLICATION">squid</span> configuration could then look
+ like this:</p>
+
+ <table border="0" bgcolor="#E0E0E0" width="100%">
+ <tr>
+ <td>
+ <pre class="SCREEN">
+ # Define Privoxy as parent proxy (without ICP)
+ cache_peer 127.0.0.1 parent 8118 7 no-query
+
+ # Define ACL for protocol FTP
+ acl ftp proto FTP
+
+ # Do not forward FTP requests to Privoxy
+ always_direct allow ftp
+
+ # Forward all the rest to Privoxy
+ never_direct allow all
+</pre>
+ </td>
+ </tr>
+ </table>
+
+ <p>You would then need to change your browser's proxy settings to
+ <span class="APPLICATION">squid</span>'s address and port. Squid
+ normally uses port 3128. If unsure consult <tt class=
+ "LITERAL">http_port</tt> in <tt class="FILENAME">squid.conf</tt>.</p>
+
+ <p>You could just as well decide to only forward requests you suspect
+ of leading to Windows executables through a virus-scanning parent
+ proxy, say, on <tt class="LITERAL">antivir.example.com</tt>, port
+ 8010:</p>
+
+ <table border="0" bgcolor="#E0E0E0" width="100%">
+ <tr>
+ <td>
+ <pre class="SCREEN">
+ forward / .
+ forward /.*\.(exe|com|dll|zip)$ antivir.example.com:8010
+</pre>
+ </td>
+ </tr>
+ </table>
+ </div>
+
+ <div class="SECT3">
+ <h4 class="SECT3"><a name="FORWARDED-CONNECT-RETRIES" id=
+ "FORWARDED-CONNECT-RETRIES">7.5.4. forwarded-connect-retries</a></h4>
+
+ <div class="VARIABLELIST">
+ <dl>
+ <dt>Specifies:</dt>
+
+ <dd>
+ <p>How often Privoxy retries if a forwarded connection request
+ fails.</p>
+ </dd>
+
+ <dt>Type of value:</dt>
+
+ <dd>
+ <p><tt class="REPLACEABLE"><i>Number of retries.</i></tt></p>
+ </dd>
+
+ <dt>Default value:</dt>
+
+ <dd>
+ <p><span class="emphasis"><i class="EMPHASIS">0</i></span></p>
+ </dd>
+
+ <dt>Effect if unset:</dt>
+
+ <dd>
+ <p>Connections forwarded through other proxies are treated like
+ direct connections and no retry attempts are made.</p>
+ </dd>
+
+ <dt>Notes:</dt>
+
+ <dd>
+ <p><tt class=
+ "REPLACEABLE"><i>forwarded-connect-retries</i></tt> is mainly
+ interesting for socks4a connections, where <span class=
+ "APPLICATION">Privoxy</span> can't detect why the connections
+ failed. The connection might have failed because of a DNS
+ timeout in which case a retry makes sense, but it might also
+ have failed because the server doesn't exist or isn't
+ reachable. In this case the retry will just delay the
+ appearance of Privoxy's error message.</p>
+
+ <p>Note that in the context of this option, <span class=
+ "QUOTE">"forwarded connections"</span> includes all connections
+ that Privoxy forwards through other proxies. This option is not
+ limited to the HTTP CONNECT method.</p>
+
+ <p>Only use this option, if you are getting lots of
+ forwarding-related error messages that go away when you try
+ again manually. Start with a small value and check Privoxy's
+ logfile from time to time, to see how many retries are usually
+ needed.</p>
+ </dd>
+
+ <dt>Examples:</dt>
+
+ <dd>
+ <p>forwarded-connect-retries 1</p>
+ </dd>
+ </dl>
+ </div>
+ </div>
+ </div>
+
+ <div class="SECT2">
+ <h2 class="SECT2"><a name="MISC" id="MISC">7.6. Miscellaneous</a></h2>
+
+ <div class="SECT3">
+ <h4 class="SECT3"><a name="ACCEPT-INTERCEPTED-REQUESTS" id=
+ "ACCEPT-INTERCEPTED-REQUESTS">7.6.1.
+ accept-intercepted-requests</a></h4>
+
+ <div class="VARIABLELIST">
+ <dl>
+ <dt>Specifies:</dt>
+
+ <dd>
+ <p>Whether intercepted requests should be treated as valid.</p>
+ </dd>
+
+ <dt>Type of value:</dt>
+
+ <dd>
+ <p><tt class="REPLACEABLE"><i>0 or 1</i></tt></p>
+ </dd>
+
+ <dt>Default value:</dt>
+
+ <dd>
+ <p><span class="emphasis"><i class="EMPHASIS">0</i></span></p>
+ </dd>
+
+ <dt>Effect if unset:</dt>
+
+ <dd>
+ <p>Only proxy requests are accepted, intercepted requests are
+ treated as invalid.</p>
+ </dd>
+
+ <dt>Notes:</dt>
+
+ <dd>
+ <p>If you don't trust your clients and want to force them to
+ use <span class="APPLICATION">Privoxy</span>, enable this
+ option and configure your packet filter to redirect outgoing
+ HTTP connections into <span class=
+ "APPLICATION">Privoxy</span>.</p>
+
+ <p>Note that intercepting encrypted connections (HTTPS) isn't
+ supported.</p>
+
+ <p>Make sure that <span class="APPLICATION">Privoxy's</span>
+ own requests aren't redirected as well. Additionally take care
+ that <span class="APPLICATION">Privoxy</span> can't
+ intentionally connect to itself, otherwise you could run into
+ redirection loops if <span class="APPLICATION">Privoxy's</span>
+ listening port is reachable by the outside or an attacker has
+ access to the pages you visit.</p>
+
+ <p>If you are running Privoxy as intercepting proxy without
+ being able to intercept all client requests you may want to
+ adjust the CGI templates to make sure they don't reference
+ content from config.privoxy.org.</p>
+ </dd>
+
+ <dt>Examples:</dt>
+
+ <dd>
+ <p>accept-intercepted-requests 1</p>
+ </dd>
+ </dl>
+ </div>
+ </div>
+
+ <div class="SECT3">
+ <h4 class="SECT3"><a name="ALLOW-CGI-REQUEST-CRUNCHING" id=
+ "ALLOW-CGI-REQUEST-CRUNCHING">7.6.2.
+ allow-cgi-request-crunching</a></h4>
+
+ <div class="VARIABLELIST">
+ <dl>
+ <dt>Specifies:</dt>
+
+ <dd>
+ <p>Whether requests to <span class=
+ "APPLICATION">Privoxy's</span> CGI pages can be blocked or
+ redirected.</p>
+ </dd>
+
+ <dt>Type of value:</dt>
+
+ <dd>
+ <p><tt class="REPLACEABLE"><i>0 or 1</i></tt></p>
+ </dd>
+
+ <dt>Default value:</dt>
+
+ <dd>
+ <p><span class="emphasis"><i class="EMPHASIS">0</i></span></p>
+ </dd>
+
+ <dt>Effect if unset:</dt>
+
+ <dd>
+ <p><span class="APPLICATION">Privoxy</span> ignores block and
+ redirect actions for its CGI pages.</p>
+ </dd>
+
+ <dt>Notes:</dt>
+
+ <dd>
+ <p>By default <span class="APPLICATION">Privoxy</span> ignores
+ block or redirect actions for its CGI pages. Intercepting these
+ requests can be useful in multi-user setups to implement
+ fine-grained access control, but it can also render the
+ complete web interface useless and make debugging problems
+ painful if done without care.</p>
+
+ <p>Don't enable this option unless you're sure that you really
+ need it.</p>
+ </dd>
+
+ <dt>Examples:</dt>
+
+ <dd>
+ <p>allow-cgi-request-crunching 1</p>
+ </dd>
+ </dl>
+ </div>
+ </div>
+
+ <div class="SECT3">
+ <h4 class="SECT3"><a name="SPLIT-LARGE-FORMS" id=
+ "SPLIT-LARGE-FORMS">7.6.3. split-large-forms</a></h4>
+
+ <div class="VARIABLELIST">
+ <dl>
+ <dt>Specifies:</dt>
+
+ <dd>
+ <p>Whether the CGI interface should stay compatible with broken
+ HTTP clients.</p>
+ </dd>
+
+ <dt>Type of value:</dt>
+
+ <dd>
+ <p><tt class="REPLACEABLE"><i>0 or 1</i></tt></p>
+ </dd>
+
+ <dt>Default value:</dt>
+
+ <dd>
+ <p><span class="emphasis"><i class="EMPHASIS">0</i></span></p>
+ </dd>
+
+ <dt>Effect if unset:</dt>
+
+ <dd>
+ <p>The CGI form generate long GET URLs.</p>
+ </dd>
+
+ <dt>Notes:</dt>
+
+ <dd>
+ <p><span class="APPLICATION">Privoxy's</span> CGI forms can
+ lead to rather long URLs. This isn't a problem as far as the
+ HTTP standard is concerned, but it can confuse clients with
+ arbitrary URL length limitations.</p>
+
+ <p>Enabling split-large-forms causes <span class=
+ "APPLICATION">Privoxy</span> to divide big forms into smaller
+ ones to keep the URL length down. It makes editing a lot less
+ convenient and you can no longer submit all changes at once,
+ but at least it works around this browser bug.</p>
+
+ <p>If you don't notice any editing problems, there is no reason
+ to enable this option, but if one of the submit buttons appears
+ to be broken, you should give it a try.</p>
+ </dd>
+
+ <dt>Examples:</dt>
+
+ <dd>
+ <p>split-large-forms 1</p>
+ </dd>
+ </dl>
+ </div>
+ </div>
+
+ <div class="SECT3">
+ <h4 class="SECT3"><a name="KEEP-ALIVE-TIMEOUT" id=
+ "KEEP-ALIVE-TIMEOUT">7.6.4. keep-alive-timeout</a></h4>
+
+ <div class="VARIABLELIST">
+ <dl>
+ <dt>Specifies:</dt>
+
+ <dd>
+ <p>Number of seconds after which an open connection will no
+ longer be reused.</p>
+ </dd>
+
+ <dt>Type of value:</dt>
+
+ <dd>
+ <p><tt class="REPLACEABLE"><i>Time in seconds.</i></tt></p>
+ </dd>
+
+ <dt>Default value:</dt>
+
+ <dd>
+ <p>None</p>
+ </dd>
+
+ <dt>Effect if unset:</dt>
+
+ <dd>
+ <p>Connections are not kept alive.</p>
+ </dd>
+
+ <dt>Notes:</dt>
+
+ <dd>
+ <p>This option allows clients to keep the connection to
+ <span class="APPLICATION">Privoxy</span> alive. If the server
+ supports it, <span class="APPLICATION">Privoxy</span> will keep
+ the connection to the server alive as well. Under certain
+ circumstances this may result in speed-ups.</p>
+
+ <p>By default, <span class="APPLICATION">Privoxy</span> will
+ close the connection to the server if the client connection
+ gets closed, or if the specified timeout has been reached
+ without a new request coming in. This behaviour can be changed
+ with the <a href="#CONNECTION-SHARING" target=
+ "_top">connection-sharing</a> option.</p>
+
+ <p>This option has no effect if <span class=
+ "APPLICATION">Privoxy</span> has been compiled without
+ keep-alive support.</p>
+
+ <p>Note that a timeout of five seconds as used in the default
+ configuration file significantly decreases the number of
+ connections that will be reused. The value is used because some
+ browsers limit the number of connections they open to a single
+ host and apply the same limit to proxies. This can result in a
+ single website <span class="QUOTE">"grabbing"</span> all the
+ connections the browser allows, which means connections to
+ other websites can't be opened until the connections currently
+ in use time out.</p>
+
+ <p>Several users have reported this as a Privoxy bug, so the
+ default value has been reduced. Consider increasing it to 300
+ seconds or even more if you think your browser can handle it.
+ If your browser appears to be hanging, it probably can't.</p>
+ </dd>
+
+ <dt>Examples:</dt>
+
+ <dd>
+ <p>keep-alive-timeout 300</p>
+ </dd>
+ </dl>
+ </div>
+ </div>
+
+ <div class="SECT3">
+ <h4 class="SECT3"><a name="TOLERATE-PIPELINING" id=
+ "TOLERATE-PIPELINING">7.6.5. tolerate-pipelining</a></h4>
+
+ <div class="VARIABLELIST">
+ <dl>
+ <dt>Specifies:</dt>
+
+ <dd>
+ <p>Whether or not pipelined requests should be served.</p>
+ </dd>
+
+ <dt>Type of value:</dt>
+
+ <dd>
+ <p><tt class="REPLACEABLE"><i>0 or 1.</i></tt></p>
+ </dd>
+
+ <dt>Default value:</dt>
+
+ <dd>
+ <p>None</p>
+ </dd>
+
+ <dt>Effect if unset:</dt>
+
+ <dd>
+ <p>If Privoxy receives more than one request at once, it
+ terminates the client connection after serving the first
+ one.</p>
+ </dd>
+
+ <dt>Notes:</dt>
+
+ <dd>
+ <p><span class="APPLICATION">Privoxy</span> currently doesn't
+ pipeline outgoing requests, thus allowing pipelining on the
+ client connection is not guaranteed to improve the
+ performance.</p>
+
+ <p>By default <span class="APPLICATION">Privoxy</span> tries to
+ discourage clients from pipelining by discarding aggressively
+ pipelined requests, which forces the client to resend them
+ through a new connection.</p>
+
+ <p>This option lets <span class="APPLICATION">Privoxy</span>
+ tolerate pipelining. Whether or not that improves performance
+ mainly depends on the client configuration.</p>
+
+ <p>If you are seeing problems with pages not properly loading,
+ disabling this option could work around the problem.</p>
+ </dd>
+
+ <dt>Examples:</dt>
+
+ <dd>
+ <p>tolerate-pipelining 1</p>
+ </dd>
+ </dl>
+ </div>
+ </div>
+
+ <div class="SECT3">
+ <h4 class="SECT3"><a name="DEFAULT-SERVER-TIMEOUT" id=
+ "DEFAULT-SERVER-TIMEOUT">7.6.6. default-server-timeout</a></h4>
+
+ <div class="VARIABLELIST">
+ <dl>
+ <dt>Specifies:</dt>
+
+ <dd>
+ <p>Assumed server-side keep-alive timeout if not specified by
+ the server.</p>
+ </dd>
+
+ <dt>Type of value:</dt>
+
+ <dd>
+ <p><tt class="REPLACEABLE"><i>Time in seconds.</i></tt></p>
+ </dd>
+
+ <dt>Default value:</dt>
+
+ <dd>
+ <p>None</p>
+ </dd>
+
+ <dt>Effect if unset:</dt>
+
+ <dd>
+ <p>Connections for which the server didn't specify the
+ keep-alive timeout are not reused.</p>
+ </dd>
+
+ <dt>Notes:</dt>
+
+ <dd>
+ <p>Enabling this option significantly increases the number of
+ connections that are reused, provided the <a href=
+ "#KEEP-ALIVE-TIMEOUT" target="_top">keep-alive-timeout</a>
+ option is also enabled.</p>
+
+ <p>While it also increases the number of connections problems
+ when <span class="APPLICATION">Privoxy</span> tries to reuse a
+ connection that already has been closed on the server side, or
+ is closed while <span class="APPLICATION">Privoxy</span> is
+ trying to reuse it, this should only be a problem if it happens
+ for the first request sent by the client. If it happens for
+ requests on reused client connections, <span class=
+ "APPLICATION">Privoxy</span> will simply close the connection
+ and the client is supposed to retry the request without
+ bothering the user.</p>
+
+ <p>Enabling this option is therefore only recommended if the
+ <a href="#CONNECTION-SHARING" target=
+ "_top">connection-sharing</a> option is disabled.</p>
+
+ <p>It is an error to specify a value larger than the <a href=
+ "#KEEP-ALIVE-TIMEOUT" target="_top">keep-alive-timeout</a>
+ value.</p>
+
+ <p>This option has no effect if <span class=
+ "APPLICATION">Privoxy</span> has been compiled without
+ keep-alive support.</p>
+ </dd>
+
+ <dt>Examples:</dt>
+
+ <dd>
+ <p>default-server-timeout 60</p>
+ </dd>
+ </dl>
+ </div>
+ </div>
+
+ <div class="SECT3">
+ <h4 class="SECT3"><a name="CONNECTION-SHARING" id=
+ "CONNECTION-SHARING">7.6.7. connection-sharing</a></h4>
+
+ <div class="VARIABLELIST">
+ <dl>
+ <dt>Specifies:</dt>
+
+ <dd>
+ <p>Whether or not outgoing connections that have been kept
+ alive should be shared between different incoming
+ connections.</p>
+ </dd>
+
+ <dt>Type of value:</dt>
+
+ <dd>
+ <p><tt class="REPLACEABLE"><i>0 or 1</i></tt></p>
+ </dd>
+
+ <dt>Default value:</dt>
+
+ <dd>
+ <p>None</p>
+ </dd>
+
+ <dt>Effect if unset:</dt>
+
+ <dd>
+ <p>Connections are not shared.</p>
+ </dd>
+
+ <dt>Notes:</dt>
+
+ <dd>
+ <p>This option has no effect if <span class=
+ "APPLICATION">Privoxy</span> has been compiled without
+ keep-alive support, or if it's disabled.</p>
+ </dd>
+
+ <dt>Notes:</dt>
+
+ <dd>
+ <p>Note that reusing connections doesn't necessary cause
+ speedups. There are also a few privacy implications you should
+ be aware of.</p>
+
+ <p>If this option is effective, outgoing connections are shared
+ between clients (if there are more than one) and closing the
+ browser that initiated the outgoing connection does no longer
+ affect the connection between <span class=
+ "APPLICATION">Privoxy</span> and the server unless the client's
+ request hasn't been completed yet.</p>
+
+ <p>If the outgoing connection is idle, it will not be closed
+ until either <span class="APPLICATION">Privoxy's</span> or the
+ server's timeout is reached. While it's open, the server knows
+ that the system running <span class=
+ "APPLICATION">Privoxy</span> is still there.</p>
+
+ <p>If there are more than one client (maybe even belonging to
+ multiple users), they will be able to reuse each others
+ connections. This is potentially dangerous in case of
+ authentication schemes like NTLM where only the connection is
+ authenticated, instead of requiring authentication for each
+ request.</p>
+
+ <p>If there is only a single client, and if said client can
+ keep connections alive on its own, enabling this option has
+ next to no effect. If the client doesn't support connection
+ keep-alive, enabling this option may make sense as it allows
+ <span class="APPLICATION">Privoxy</span> to keep outgoing
+ connections alive even if the client itself doesn't support
+ it.</p>
+
+ <p>You should also be aware that enabling this option increases
+ the likelihood of getting the "No server or forwarder data"
+ error message, especially if you are using a slow connection to
+ the Internet.</p>
+
+ <p>This option should only be used by experienced users who
+ understand the risks and can weight them against the
+ benefits.</p>
+ </dd>
+
+ <dt>Examples:</dt>
+
+ <dd>
+ <p>connection-sharing 1</p>
+ </dd>
+ </dl>
+ </div>
+ </div>
+
+ <div class="SECT3">
+ <h4 class="SECT3"><a name="SOCKET-TIMEOUT" id="SOCKET-TIMEOUT">7.6.8.
+ socket-timeout</a></h4>
+
+ <div class="VARIABLELIST">
+ <dl>
+ <dt>Specifies:</dt>
+
+ <dd>
+ <p>Number of seconds after which a socket times out if no data
+ is received.</p>
+ </dd>
+
+ <dt>Type of value:</dt>
+
+ <dd>
+ <p><tt class="REPLACEABLE"><i>Time in seconds.</i></tt></p>
+ </dd>
+
+ <dt>Default value:</dt>
+
+ <dd>
+ <p>None</p>
+ </dd>
+
+ <dt>Effect if unset:</dt>
+
+ <dd>
+ <p>A default value of 300 seconds is used.</p>
+ </dd>
+
+ <dt>Notes:</dt>
+
+ <dd>
+ <p>The default is quite high and you probably want to reduce
+ it. If you aren't using an occasionally slow proxy like Tor,
+ reducing it to a few seconds should be fine.</p>
+ </dd>
+
+ <dt>Examples:</dt>
+
+ <dd>
+ <p>socket-timeout 300</p>
+ </dd>
+ </dl>
+ </div>
+ </div>
+
+ <div class="SECT3">
+ <h4 class="SECT3"><a name="MAX-CLIENT-CONNECTIONS" id=
+ "MAX-CLIENT-CONNECTIONS">7.6.9. max-client-connections</a></h4>
+
+ <div class="VARIABLELIST">
+ <dl>
+ <dt>Specifies:</dt>
+
+ <dd>
+ <p>Maximum number of client connections that will be
+ served.</p>
+ </dd>
+
+ <dt>Type of value:</dt>
+
+ <dd>
+ <p><tt class="REPLACEABLE"><i>Positive number.</i></tt></p>
+ </dd>
+
+ <dt>Default value:</dt>
+
+ <dd>
+ <p>128</p>
+ </dd>
+
+ <dt>Effect if unset:</dt>
+
+ <dd>
+ <p>Connections are served until a resource limit is
+ reached.</p>
+ </dd>
+
+ <dt>Notes:</dt>
+
+ <dd>
+ <p><span class="APPLICATION">Privoxy</span> creates one thread
+ (or process) for every incoming client connection that isn't
+ rejected based on the access control settings.</p>
+
+ <p>If the system is powerful enough, <span class=
+ "APPLICATION">Privoxy</span> can theoretically deal with
+ several hundred (or thousand) connections at the same time, but
+ some operating systems enforce resource limits by shutting down
+ offending processes and their default limits may be below the
+ ones <span class="APPLICATION">Privoxy</span> would require
+ under heavy load.</p>
+
+ <p>Configuring <span class="APPLICATION">Privoxy</span> to
+ enforce a connection limit below the thread or process limit
+ used by the operating system makes sure this doesn't happen.
+ Simply increasing the operating system's limit would work too,
+ but if <span class="APPLICATION">Privoxy</span> isn't the only
+ application running on the system, you may actually want to
+ limit the resources used by <span class=
+ "APPLICATION">Privoxy</span>.</p>
+
+ <p>If <span class="APPLICATION">Privoxy</span> is only used by
+ a single trusted user, limiting the number of client
+ connections is probably unnecessary. If there are multiple
+ possibly untrusted users you probably still want to
+ additionally use a packet filter to limit the maximal number of
+ incoming connections per client. Otherwise a malicious user
+ could intentionally create a high number of connections to
+ prevent other users from using <span class=
+ "APPLICATION">Privoxy</span>.</p>
+
+ <p>Obviously using this option only makes sense if you choose a
+ limit below the one enforced by the operating system.</p>
+
+ <p>One most POSIX-compliant systems <span class=
+ "APPLICATION">Privoxy</span> can't properly deal with more than
+ FD_SETSIZE file descriptors at the same time and has to reject
+ connections if the limit is reached. This will likely change in
+ a future version, but currently this limit can't be increased
+ without recompiling <span class="APPLICATION">Privoxy</span>
+ with a different FD_SETSIZE limit.</p>
+ </dd>
+
+ <dt>Examples:</dt>
+
+ <dd>
+ <p>max-client-connections 256</p>
+ </dd>
+ </dl>