Tinyproxy Denies localhost: Check Which Loopback Address Arrived

Your configuration allows 127.0.0.1, yet an application connecting to localhost is denied. Before widening the allowlist, check which address the application used.

localhost is a name. Depending on the environment, it may lead the client to IPv4 loopback, IPv6 loopback, or a sequence of connection attempts. An IPv4 source rule does not necessarily match an IPv6 connection from ::1.

Check three independent details

1. Which address the client connected to.
2. Which address Tinyproxy is listening on.
3. Which source address Tinyproxy evaluated in its access rules.

A refused connection suggests there was no reachable listener for that endpoint. A Tinyproxy access-denied response means a connection reached the service and was rejected under its policy. Those failures need different fixes.

For Tinyproxy 1.11.2, the listener and client-access settings show those two controls separately. If local IPv6 clients are intended, an explicit Allow ::1 can express that policy more clearly than relying on a hostname-based rule's behavior.

Do not open the proxy to a whole private subnet simply to solve a loopback mismatch. Also remember that loopback is local to the relevant network environment. A container's loopback address does not identify a different machine's proxy, even if both use the name localhost.

Use the observed numeric endpoint and source in the diagnosis. Once those match the intended policy, any remaining proxy login or destination failure is a later stage rather than evidence that localhost needs an unrestricted exception.