I have a Linux box running Squid 3.1.4 set up as the default gateway for my user desktops. The O/S is configured for NAT and forwarding incoming traffic on port 80 to port 3128. It is doing interception caching, and working well, and has the following line in squid.conf: http_port 192.168.1.121:3128 transparent But having re-read your FAQ, I'm wondering if it should say "intercept" instead. What is the difference? Ken Shelby | Automation Specialist United States Bankruptcy Court ? Southern District of New York One Bowling Green | New York, NY 10004-1408 office: 212-668-2870 x-3525 mobile: 914-907-2388 email: Ken_Shelby@xxxxxxxxxxxxxxxxx web: http://www.nysb.uscourts.gov