Matching Proxy Rules

Each proxy is an independent program that reads its own policy file. The file for each proxy consists of policy rules selected by the compiler. Rules may in turn reference data in the user database.

Each proxy follows a sequence of tests to determine whether a rule matches:

1. Does the source address of the packet fall within the source-address range in the policy rule?

2. Is the destination address of the final connection (the host that the user specifies) in the destination address in the policy rule?

3. If the policy rule requires user authentication, did the user authenticate correctly? Is that user enabled?

4. Is this (possibly anonymous) authenticated user included in the policy rule, either directly or by group membership?