Amos, I've also come across what Michael identified. This is actually a bug, right? The checklist() constructor initialises checklist.src_addr correctly based on acl_uses_indirect_client but it is then overridden with the request's "true" client_addr by the calling function. I filed it as #3895 http://bugs.squid-cache.org/show_bug.cgi?id=3895 -- View this message in context: http://squid-web-proxy-cache.1019090.n4.nabble.com/X-Forwarded-For-and-cache-peer-access-tp4661082p4661752.html Sent from the Squid - Users mailing list archive at Nabble.com.