A Dynamic DNS Name Does Not Keep a Squid Source ACL Fresh
Refresh the resolved addresses used by a Squid src ACL when a roaming client’s dynamic DNS record changes.
A hostname accepted in a Squid src ACL is resolved into addresses while the configuration is parsed. It does not remain a live subscription to that hostname’s dynamic DNS updates.
Suppose a home client’s public address changes and its DDNS record is updated. Squid can still hold the addresses loaded for the earlier configuration. Confirm the proxy host’s resolver sees the new answer, then refresh the configuration through the deployment’s normal procedure.
Also check the access rule that uses the ACL. Defining an address list does not grant access until an applicable http_access rule matches it, and an earlier matching rule can decide the request first.
A DDNS record identifies an address, not a person. Confirm the source address the proxy actually sees before relying on that restriction. If the service needs stable account-based access for roaming clients, use its supported authentication policy rather than allowing an entire provider network simply because the client’s address changes.