Tinyproxy Destination Filters, Client ACLs and CONNECT Ports

A Tinyproxy Allow line answers who may use the proxy. It does not mean that those clients can reach only the host written there. Destination filtering is a separate setting.

For a proxy intended to reach one named service, the filter can act as an allowlist:

Filter "/etc/tinyproxy/allowed-hosts"
FilterDefaultDeny Yes
FilterURLs No

The file then contains the destination patterns permitted by your chosen filter syntax. Keep a narrow exact-host pattern, and check the configured FilterType before choosing regular-expression anchors or wildcard syntax. A pattern written for one mode can mean something else in another.

There are three different controls

• Client Allow/Deny rules restrict source clients.
• Destination filtering restricts the requested host or URL.
• ConnectPort restricts CONNECT destination ports.

The Tinyproxy manual documents these separately. A destination filter does not add proxy authentication, and a port allowance does not confine requests to one hostname.

For HTTPS through a normal tunnel, work with the destination host. The encrypted request path is not available as ordinary proxy-visible text, so a path expression that works for plaintext HTTP should not be assumed to inspect HTTPS page paths.

Also consider the site's dependencies. One page can fetch images or authenticate through other hosts. Add only the destinations actually required; turning an exact-host rule into a broad suffix to fix one missing image can allow much more traffic. Keep the list understandable enough that each permitted destination has a reason.