Keep One Subdomain Off Privoxy's Upstream Proxy

The main site should use the parent proxy. One internal subdomain should not. This is a routing exception, and it deserves a pattern narrow enough to express exactly that.

Privoxy has ordinary forwarding rules in its main configuration and per-request forwarding overrides in action files. Use the mechanism appropriate to the configuration you already maintain; do not add competing exceptions in both places just to see which works.

A main-configuration exception

forward / parent.example.net:8080
forward intranet.example.net .

For public destinations where an unauthenticated public HTTP parent is allowed, take a candidate for the default parent from the HTTP proxy list without carrying over another parent's credentials. Here the later exact-host rule selects direct forwarding for that hostname. Other destinations continue to match the default parent rule. Privoxy's forwarding rules use last-match ordering, so a later general rule can change that result.

Read the pattern syntax before adding a leading dot or wildcard. A suffix-style pattern can match more names than the single host you intended. Also keep the proxy's name distinct from the website's name: the pattern selects a requested destination.

An action-file override is another option

{+forward-override{forward .}}
intranet.example.net

This explicitly chooses direct forwarding for matching requests. Removing one earlier override is not necessarily the same as choosing direct forwarding; the ordinary configuration can still contain a parent rule.

Inspect the applicable action sections and their ordering when an exception appears ineffective. A host can match more than one action pattern, and the action you expected may be changed by a later match.

Direct means a different network decision

A direct exception can expose Privoxy's own outward address rather than the parent's exit. That may be exactly right for a private service, but it should be part of the requirement rather than a side effect discovered afterward.

The exception also does not grant network reachability. Privoxy's host still needs a route to the destination and appropriate access permissions. If only the parent can reach the service, bypassing it will fail even though the pattern works.

Keep the example to the required hostname and check related authentication or asset hosts separately. Expanding one exception to every subdomain can quietly move unrelated traffic onto a different outward path.