Tinyproxy Upstream Rules: Default Proxy and Exceptions

A parent proxy that should handle every destination needs a default forwarding rule. It does not necessarily need a wildcard copied from a much older Tinyproxy configuration.

The current manual uses a proxy type and endpoint, with the destination selector optional:

Upstream http parent.example.net:8080

For permitted public destinations with an unauthenticated public HTTP parent, the HTTP proxy list offers candidates for that host and port; do not attach credentials from another parent. Omitting the optional destination makes this the default upstream in the documented syntax. A more specific destination rule can then express a different route or a deliberate direct exception.

Do not mix grammars from different releases

An old example containing only an address, port, and trailing dot can belong to another version. Match the manual to the installed package, including its upstream feature support and supported parent protocols.

Rule ordering matters as well. The manual describes last-match behavior, so an apparently correct exception can be hidden by a later matching rule. Review the complete set, not only the line being edited.

The selected parent's public exit is still separate from Tinyproxy's local outgoing source. If the intention is to preserve a particular outward identity, document what happens when the parent is unavailable and which destinations are allowed to go direct.

Finally, keep destination routing separate from client access. An upstream rule is not an authentication rule and does not limit which machines can use the local listener. A tidy route table cannot compensate for an exposed proxy service.