One Squid Allow Rule Means AND; Two Can Mean OR

Read this policy aloud: allow the office network to use the proxy for the approved destination. If those conditions belong together, keep them together in the rule.

http_access allow office_clients approved_destination

Both ACLs must match for that line to allow the request. Splitting it changes the policy:

http_access allow office_clients
http_access allow approved_destination

Office clients can now be allowed without the destination restriction, and requests to that destination without the office restriction, unless an earlier rule denied them. Two lines are not a more readable spelling of one line.

Order is part of the policy

Squid evaluates access rules in sequence. The first matching decision controls the request. An earlier allow all defeats a careful later restriction; an earlier matching denial prevents reaching a later allow.

The http_access documentation explains this sequence. Keep a deliberate final denial rather than relying on a reader to remember implicit default behavior.

Many ACL definitions have a different OR relationship: one named source ACL can list several permitted ranges. That does not make source and destination identity the same ACL type. Define them separately, then combine the names in an access decision.

For a private exit, this affects who can use your outward IP. Consider four cases: approved client to approved destination, approved client elsewhere, another client to the approved destination, and another client elsewhere. If the rules allow more cases than the policy intends, fix the logic before broadening the listener. A syntactically valid configuration can still express the wrong permissions.