Counting Connections with Squid maxconn
Apply maxconn as a per-source connection condition without treating its threshold as a count of devices or authenticated users.
maxconn 5 is not a five-device license for your proxy. It is a connection-count condition associated with a client source address.
A small rule fragment looks like this:
acl over_connection_limit maxconn 5
http_access deny over_connection_limitSquid's documented match is “greater than” the supplied value. The deny rule consumes that condition; declaring the ACL alone does not reject anything. Place it before broader rules that would already allow the requests it is meant to restrict.
Keep the normal authorization policy around this fragment. It is not a complete access configuration. The ACL also depends on Squid's client database being enabled; check client_db before expecting it to work.
One device can open many connections. Several devices behind NAT can appear as one source address. A single shared machine can serve several users, and a quiet device may have no connection at the moment you count. None of those relationships is one-to-one.
If the actual requirement is a limit on named accounts, enrolled devices, or active sessions, define that identity and its lifecycle explicitly. A per-source socket threshold can protect capacity, but its number should be described as connections, not people or devices.