Tinyproxy 1.11.2 Listener and Client Access Settings

In Tinyproxy 1.11.2, Listen selects the address accepting client connections, and Allow controls eligible clients. Bind selects an outgoing address.

Listener and client rules

Keep the package's service-user, log, and PID-file settings. Replace its listener and access entries with the intended policy:

Port 8888
Listen 192.0.2.10
Allow 198.51.100.27/32
ConnectPort 443

Replace both documentation addresses. The listener must belong to the server, and the client address must match the source the server sees. Remove obsolete permissive rules.

With no Allow or Deny entries, Tinyproxy permits all clients. Once access entries exist, the default becomes denial, and rule order matters. Deleting every access line therefore opens the policy rather than resetting it to a restrictive default.

ConnectPort 443 restricts CONNECT to that destination port. Regular HTTP requests need separate destination controls if your deployment requires them.

Checking the running service

An outbound Bind setting does not restrict incoming sockets. Inspect the effective listener after startup:

sudo ss -ltnp 'sport = :8888'

Check both address families for unintended listeners or older service instances.

This version has no documented parse-only -t switch. With the managed service stopped, a foreground run exposes startup errors:

sudo tinyproxy -d -c /etc/tinyproxy/tinyproxy.conf

Stop the foreground process before restarting the managed service. Test requests from an allowed source and a second controlled source that must be denied. The destination's logs help confirm that a rejected request was not forwarded.