How Far Can a Squid MAC Rule Reach?
Understand what Squid can learn from a client's MAC address on a local link and what disappears across a router.
A MAC-based proxy rule may work for a desktop beside the Squid server and fail for an otherwise identical desktop on another subnet. The router changes what the proxy can observe.
ARP resolves an IPv4 neighbor's link-layer address on the local link. It does not carry the original Ethernet address through every routed hop. A remotely routed client is therefore not equivalent to a directly connected neighbor just because Squid can see its IP address.
For IPv4, Squid's ACL documentation limits MAC lookup to clients on the same subnet and requires a build with the relevant support. Check both conditions before treating a non-matching MAC ACL as a spelling mistake.
Use the identifier at the right boundary
For directly connected clients, a supported MAC rule can describe a device-level network condition. It still does not authenticate the person operating that device. Nor does it make a reported hardware address impossible to change.
Across a router, use information available at the proxy: a controlled source subnet, an authenticated proxy identity, or an explicitly designed trusted identity integration. Reading a DHCP server's lease table is an additional correlation system, not an extension of ARP's reach.
When reviewing a rule, draw the path from client to Squid and mark every router. Then ask whether the installed build actually supports the ACL and lookup mode. Those two checks explain far more than repeatedly pasting the client's MAC into the same rule.