The Proxy Is Closed. Why Are Requests Still Arriving?
Distinguish continued connection attempts from successful unauthorized forwarding after tightening proxy access.
Continued incoming requests do not prove that outsiders can still use the proxy. Old endpoints can remain in request lists after the access policy changes. Verify the repair by what gets forwarded:
- Make authorized and unauthorized requests to a controlled destination.
- Read the access decision and, for Squid, hierarchy fields in the configured log format.
- Establish whether the forbidden request actually reached the destination. Accepting TCP, rejecting an HTTP request and completing an onward request are different outcomes.
- Check the other active listeners and virtual hosts, so a repaired policy block does not leave another entrance open.
For Apache intended to serve only reverse mappings, confirm unintended forward proxying is disabled. ProxyRequests Off can coexist with ProxyPass.
An error page alone is weaker evidence if you do not know which component produced it. Keep the client result, proxy decision and destination observation together.
If rejected traffic still consumes resources, narrow network access and manage rates and log retention. There is no dependable waiting period after which attempts must stop; correct forwarding decisions are the acceptance criterion.