Which Client IP Does a Parent Proxy See?

Allowlisting a workstation does not necessarily permit a new downstream proxy to connect on its behalf:

workstation → local proxy → corporate parent → website

The local proxy opens a new connection to the parent. Ordinarily, the parent sees that proxy's outgoing address, possibly after NAT. The original workstation's address does not become the new connection's source just because it initiated the overall request.

Find the immediate source actually received by the parent. Authorize the downstream proxy only for the intended service, and retain client restrictions on the downstream instance. Otherwise the permitted intermediate can provide access to anyone who can reach it.

There is a deliberate exception to the simple socket-peer interpretation. Squid 6 and 7 can follow X-Forwarded-For from explicitly trusted peers and use the resulting indirect client address for selected functions. The relevant settings decide whether a source ACL uses that derived identity; src is not always the raw peer when this feature is enabled.

Trust forwarded identity only from an intermediary that sanitizes and supplies it correctly. Arbitrary client-provided X-Forwarded-For is a claimed value, not an authenticated source. Where policy permits, log both the immediate peer and trusted original client: the first identifies who connected to the parent, the second whom the downstream served.