<form>
    <tab id="proxy-general" description="General Proxy Settings">
        <subtab id="proxy-general-settings" description="General Proxy Settings">
            <field>
                <id>proxy.general.enabled</id>
                <label>Enable proxy</label>
                <type>checkbox</type>
                <help>Enable or disable the proxy service.</help>
            </field>
            <field>
                <id>proxy.general.error_pages</id>
                <label>User error pages</label>
                <type>dropdown</type>
                <help>
                  The proxy error pages can be altered, default layout uses OPNsense content, when Squid is selected
                  the content for the selected language will be used (standard squid layout), Custom offers the possibility
                  to upload your own theme content.
                </help>
            </field>
            <field>
                <id>proxy.general.icpPort</id>
                <label>ICP port</label>
                <type>text</type>
                <help>The port number where Squid sends and receives ICP queries to and from neighbor caches. Leave blank to disable (default). The standard UDP port for ICP is 3130.</help>
                <advanced>true</advanced>
            </field>
            <field>
                <id>proxy.general.logging.enable.accessLog</id>
                <label>Enable access logging</label>
                <type>checkbox</type>
                <help>Enable access logging.</help>
                <advanced>true</advanced>
            </field>
            <field>
                <id>proxy.general.logging.target</id>
                <label>Access log target</label>
                <type>dropdown</type>
                <help>Send log data to the selected target. When syslog is selected, facility local 4 will be used to send messages of info level for these logs.</help>
                <advanced>true</advanced>
            </field>
            <field>
                <id>proxy.general.logging.enable.storeLog</id>
                <label>Enable store logging</label>
                <type>checkbox</type>
                <help>Enable store logging.</help>
                <advanced>true</advanced>
            </field>
            <field>
                <id>proxy.general.logging.ignoreLogACL</id>
                <label>Ignore hosts in access.log</label>
                <type>select_multiple</type>
                <style>tokenize</style>
                <help>Type subnets/addresses you want to ignore for the access.log.</help>
                <hint>Type subnet addresses (ex. 192.168.2.0/24)</hint>
                <allownew>true</allownew>
                <advanced>true</advanced>
            </field>
            <field>
                <id>proxy.general.alternateDNSservers</id>
                <label>Use alternate DNS-servers</label>
                <type>select_multiple</type>
                <style>tokenize</style>
                <help>Type IPs of alternative DNS servers you like to use.</help>
                <hint>Type IP addresses, followed by Enter or comma.</hint>
                <allownew>true</allownew>
                <advanced>true</advanced>
            </field>
            <field>
                <id>proxy.general.dnsV4First</id>
                <label>Enable DNS v4 first</label>
                <type>checkbox</type>
                <help>This option reverses the order of preference to make Squid contact dual-stack websites over IPv4 first. Squid will still perform both IPv6 and IPv4 DNS lookups before connecting. This option will restrict the situations under which IPv6 connectivity is used (and tested) and will hide network problems which would otherwise be detected and warned about.</help>
                <advanced>true</advanced>
            </field>
            <field>
                <id>proxy.general.useViaHeader</id>
                <label>Use Via header</label>
                <type>checkbox</type>
                <help>If set (default), Squid will include a Via header in requests and replies as required by RFC2616.</help>
                <advanced>true</advanced>
            </field>
            <field>
                <id>proxy.general.forwardedForHandling</id>
                <label>X-Forwarded-For header handling</label>
                <type>dropdown</type>
                <help>Select what to do with X-Forwarded-For header. If set to: "on", Squid will append your client's IP address in the HTTP requests it forwards. By default it looks like X-Forwarded-For: 192.1.2.3; If set to: "off", it will appear as X-Forwarded-For: unknown; "transparent", Squid will not alter the X-Forwarded-For header in any way; If set to: "delete", Squid will delete the entire X-Forwarded-For header; If set to: "truncate", Squid will remove all existing X-Forwarded-For entries, and place the client IP as the sole entry.</help>
                <advanced>true</advanced>
            </field>
            <field>
                <id>proxy.general.VisibleHostname</id>
                <label>Visible Hostname</label>
                <type>text</type>
                <help>This is the hostname to be displayed in proxy server error messages.</help>
                <advanced>true</advanced>
            </field>
            <field>
                <id>proxy.general.VisibleEmail</id>
                <label>Administrator's Email</label>
                <type>text</type>
                <help>This is the email address displayed in error messages to the users.</help>
                <advanced>true</advanced>
            </field>
            <field>
                <id>proxy.general.suppressVersion</id>
                <label>Suppress version string</label>
                <type>checkbox</type>
                <help>Suppress Squid version string info in HTTP headers and HTML error pages.</help>
                <advanced>true</advanced>
            </field>
            <field>
                <id>proxy.general.connecttimeout</id>
                <label>Connection Timeout</label>
                <type>text</type>
                <help>This can help you when having connection issues with IPv6 enabled servers. Set a value in seconds</help>
                <advanced>true</advanced>
            </field>
            <field>
                <id>proxy.general.uriWhitespaceHandling</id>
                <label>Whitespace handling of URI</label>
                <type>dropdown</type>
                <help>Select what to do with URI that contain whitespaces. The current Squid implementation of encode and chop violates RFC2616 by not using a 301 redirect after altering the URL.</help>
                <advanced>true</advanced>
            </field>
            <field>
                <id>proxy.general.enablePinger</id>
                <label>Enable pinger</label>
                <type>checkbox</type>
                <help>Toggles the Squid pinger service. This service is used in the selection of the best parent proxy.</help>
                <advanced>true</advanced>
            </field>
        </subtab>
        <subtab id="proxy-general-cache-local" description="Local Cache Settings">
            <field>
                <id>proxy.general.cache.local.cache_mem</id>
                <label>Memory Cache size in Megabytes</label>
                <type>text</type>
                <help>Enter the cache memory size to use or zero to disable completely.</help>
            </field>
            <field>
                <id>proxy.general.cache.local.enabled</id>
                <label>Enable local cache</label>
                <type>checkbox</type>
                <help>Enable or disable the local cache. Only UFS directory cache type is supported. Do not enable on embedded systems with SD or CF cards as this will wear down your drive.</help>
            </field>
            <field>
                <id>proxy.general.cache.local.size</id>
                <label>Cache size in Megabytes</label>
                <type>text</type>
                <help>Enter the storage size for the local cache (default is 100).</help>
                <advanced>true</advanced>
            </field>
            <field>
                <id>proxy.general.cache.local.directory</id>
                <label>Cache directory location</label>
                <type>text</type>
                <help>Enter the directory location for the local cache (default is /var/squid/cache).</help>
                <advanced>true</advanced>
            </field>
            <field>
                <id>proxy.general.cache.local.l1</id>
                <label>Number of first-level subdirectories</label>
                <type>text</type>
                <help>Enter the number of first-level subdirectories for the local cache (default is 16).</help>
                <advanced>true</advanced>
            </field>
            <field>
                <id>proxy.general.cache.local.l2</id>
                <label>Number of second-level subdirectories</label>
                <type>text</type>
                <help>Enter the number of second-level subdirectories for the local cache (default is 256).</help>
                <advanced>true</advanced>
            </field>
            <field>
                <id>proxy.general.cache.local.maximum_object_size</id>
                <label>Maximum object size (MB)</label>
                <type>text</type>
                <help>Set the maximum object size (default 4MB when left empty).</help>
                <advanced>true</advanced>
            </field>
            <field>
                <id>proxy.general.cache.local.maximum_object_size_in_memory</id>
                <label>Maximum object size in memory (KB)</label>
                <type>text</type>
                <help>Set the maximum object size in memory (default 512KB when left empty).</help>
                <advanced>true</advanced>
            </field>
            <field>
                <id>proxy.general.cache.local.memory_cache_mode</id>
                <label>Memory cache mode</label>
                <type>dropdown</type>
                <help>
                    Controls which objects to keep in the memory cache (cache_mem)
                    always:	Keep most recently fetched objects in memory (default)
                    disk: Only disk cache hits are kept in memory, which means an object must first be cached on disk and then hit a second time before cached in memory.
                    network: Only objects fetched from network is kept in memory
                </help>
                <advanced>true</advanced>
            </field>
            <field>
                <id>proxy.general.cache.local.cache_linux_packages</id>
                <label>Enable Linux Package Cache</label>
                <type>checkbox</type>
                <help>Enable or disable the caching of packages for linux distributions. This makes sense if you have multiple servers in your network and do not host your own package mirror. This will reduce internet traffic usage but increase disk access.</help>
            </field>
            <field>
                <id>proxy.general.cache.local.cache_windows_updates</id>
                <label>Enable Windows Update Cache</label>
                <type>checkbox</type>
                <help>Enable or disable the caching of Windows updates. This makes sense if you don't have a WSUS server. If you can setup a WSUS server, this solution should be preferred.</help>
            </field>
        </subtab>
        <subtab id="proxy-general-traffic" description="Traffic Management Settings">
            <field>
                <id>proxy.general.traffic.enabled</id>
                <label>Enable traffic management.</label>
                <type>checkbox</type>
                <help>Enable or disable traffic management.</help>
            </field>
            <field>
                <id>proxy.general.traffic.maxDownloadSize</id>
                <label>Maximum download size (kB)</label>
                <type>text</type>
                <help>Enter the maximum size for downloads in kilobytes (leave empty to disable).</help>
            </field>
            <field>
                <id>proxy.general.traffic.maxUploadSize</id>
                <label>Maximum upload size (kB)</label>
                <type>text</type>
                <help>Enter the maximum size for uploads in kilobytes (leave empty to disable).</help>
            </field>
            <field>
                <id>proxy.general.traffic.OverallBandwidthTrotteling</id>
                <label>Overall bandwidth throttling (kbps)</label>
                <type>text</type>
                <help>Enter the allowed overall bandwidth in kilobits per second (leave empty to disable).</help>
            </field>
            <field>
                <id>proxy.general.traffic.perHostTrotteling</id>
                <label>Per host bandwidth throttling (kbps)</label>
                <type>text</type>
                <help>Enter the allowed per host bandwidth in kilobits per second (leave empty to disable).</help>
            </field>
        </subtab>
        <subtab id="proxy-general-parentproxy" description="Parent Proxy Settings">
            <field>
                <id>proxy.general.parentproxy.enabled</id>
                <label>Enable Parent Proxy</label>
                <type>checkbox</type>
                <help>Enable parent proxy feature.</help>
            </field>
            <field>
                <id>proxy.general.parentproxy.host</id>
                <label>Host</label>
                <type>text</type>
                <help>Parent proxy IP address or hostname.</help>
            </field>
            <field>
                <id>proxy.general.parentproxy.port</id>
                <label>Port</label>
                <type>text</type>
                <help>Parent proxy port.</help>
            </field>
            <field>
                <id>proxy.general.parentproxy.enableauth</id>
                <label>Enable Authentication</label>
                <type>checkbox</type>
                <help>Enable authentication against the parent proxy.</help>
            </field>
            <field>
                <id>proxy.general.parentproxy.user</id>
                <label>Username</label>
                <type>text</type>
                <help>Set a username if parent proxy requires authentication.</help>
            </field>
            <field>
                <id>proxy.general.parentproxy.password</id>
                <label>Password</label>
                <type>password</type>
                <help>Set a password if parent proxy requires authentication.</help>
            </field>
            <field>
                <id>proxy.general.parentproxy.localdomains</id>
                <label>Local Domains</label>
                <type>select_multiple</type>
                <style>tokenize</style>
                <allownew>true</allownew>
                <help>List of domains not to be sent via parent proxy.</help>
            </field>
            <field>
                <id>proxy.general.parentproxy.localips</id>
                <label>Local IPs</label>
                <type>select_multiple</type>
                <style>tokenize</style>
                <allownew>true</allownew>
                <help>List of IP addresses not to be sent via parent proxy.</help>
            </field>
        </subtab>
    </tab>
    <tab id="proxy-forward" description="Forward Proxy">
        <subtab id="proxy-forward-general" description="General Forward Settings">
            <field>
                <id>proxy.forward.interfaces</id>
                <label>Proxy interfaces</label>
                <type>select_multiple</type>
                <help>Select interface(s) the proxy will bind to.</help>
                <hint>Type or select interface.</hint>
            </field>
            <field>
                <id>proxy.forward.port</id>
                <label>Proxy port</label>
                <type>text</type>
                <help>The port the proxy service will listen to.</help>
            </field>
            <field>
                <id>proxy.forward.transparentMode</id>
                <label>Enable Transparent HTTP proxy</label>
                <type>checkbox</type>
                <help><![CDATA[Enable transparent proxy mode. You will need a firewall rule to forward traffic from the firewall to the proxy server. You may leave the proxy interfaces empty, but remember to set a valid ACL in that case. <a href="/firewall_nat_edit.php?template=transparent_proxy"> Add a new firewall rule </a>]]></help>
            </field>
            <field>
                <id>proxy.forward.sslbump</id>
                <label>Enable SSL inspection</label>
                <type>checkbox</type>
                <help><![CDATA[Enable SSL inspection mode, which allows to log HTTPS connections information, such as requested URL and/or make the proxy act as a man in the middle between the internet and your clients. Be aware of the security implications before enabling this option. If you plan to use transparent HTTPS mode, you need nat rules to reflect your traffic.<a href="/firewall_nat_edit.php?template=transparent_proxy&https=1">Add a new firewall rule </a>]]></help>
            </field>
            <field>
                <id>proxy.forward.sslurlonly</id>
                <label>Log SNI information only</label>
                <type>checkbox</type>
                <help>Do not decode and/or filter SSL content, only log requested domains and IP addresses. Some old servers may not provide SNI, so their addresses will not be indicated.</help>
            </field>
            <field>
                <id>proxy.forward.sslbumpport</id>
                <label>SSL Proxy port</label>
                <type>text</type>
                <help>The port the ssl proxy service will listen to.</help>
            </field>
            <field>
                <id>proxy.forward.sslcertificate</id>
                <label>CA to use</label>
                <type>dropdown</type>
                <help><![CDATA[Select a Certificate Authority to use. To create a CA, go to <a href="/system_camanager.php">CA Manager</a>.]]></help>
            </field>
            <field>
                <id>proxy.forward.sslnobumpsites</id>
                <label>SSL no bump sites</label>
                <type>select_multiple</type>
                <style>tokenize</style>
                <allownew>true</allownew>
                <help>Create a list of sites which may not be inspected, for example bank sites. Prefix the domain with a . to accept all subdomains (e.g. .google.com).</help>
            </field>
            <field>
                <id>proxy.forward.ssl_crtd_storage_max_size</id>
                <label>SSL cache size</label>
                <type>text</type>
                <help>Enter the maximum size (in MB) to use for SSL certificates.</help>
                <advanced>true</advanced>
            </field>
            <field>
                <id>proxy.forward.sslcrtd_children</id>
                <label>SSL cert workers</label>
                <type>text</type>
                <help>Enter the number of ssl certificate workers to use (sslcrtd_children).</help>
                <advanced>true</advanced>
            </field>
            <field>
                <id>proxy.forward.addACLforInterfaceSubnets</id>
                <label>Allow interface subnets</label>
                <type>checkbox</type>
                <help>When enabled the subnets of the selected interfaces will be added to the allow access list.</help>
                <advanced>true</advanced>
            </field>
        </subtab>
        <subtab id="proxy-forward-ftp" description="FTP Proxy Settings">
            <field>
                <id>proxy.forward.ftpInterfaces</id>
                <label>FTP proxy interfaces</label>
                <type>select_multiple</type>
                <help>Select interface(s) the ftp proxy will bind to.</help>
                <hint>Type or select interface (Leave blank to disable ftp proxy).</hint>
            </field>
            <field>
                <id>proxy.forward.ftpPort</id>
                <label>FTP proxy port</label>
                <type>text</type>
                <help>The port the proxy service will listen to.</help>
            </field>
            <field>
                <id>proxy.forward.ftpTransparentMode</id>
                <label>Enable Transparent mode</label>
                <type>checkbox</type>
                <help>Enable transparent ftp proxy mode to forward all requests for destination port 21 to the proxy server without any additional configuration.</help>
            </field>
        </subtab>
        <subtab id="proxy-forward-acl" description="Access Control List">
            <field>
                <id>proxy.forward.acl.allowedSubnets</id>
                <label>Allowed Subnets</label>
                <type>select_multiple</type>
                <style>tokenize</style>
                <help>Type subnets you want to allow access to the proxy server.</help>
                <hint>Type subnet addresses (ex. 192.168.2.0/24)</hint>
                <allownew>true</allownew>
            </field>
            <field>
                <id>proxy.forward.acl.unrestricted</id>
                <label>Unrestricted IP addresses</label>
                <type>select_multiple</type>
                <style>tokenize</style>
                <help>Type IP addresses you want to allow access to the proxy server.</help>
                <hint>Type IP addresses (ex. 192.168.1.100)</hint>
                <allownew>true</allownew>
            </field>
            <field>
                <id>proxy.forward.acl.bannedHosts</id>
                <label>Banned host IP addresses</label>
                <type>select_multiple</type>
                <style>tokenize</style>
                <help>Type IP addresses you want to deny access to the proxy server.</help>
                <hint>Type IP addresses (ex. 192.168.1.100)</hint>
                <allownew>true</allownew>
            </field>
            <field>
                <id>proxy.forward.acl.whiteList</id>
                <label>Whitelist</label>
                <type>select_multiple</type>
                <style>tokenize</style>
                <help>Whitelist destination domains. You may use a regular expression, use a comma or press Enter for new item. Examples: "mydomain.com" matches on "*.mydomain.com"; "^https?:\/\/([a-zA-Z]+)\.mydomain\." matches on "http(s)://textONLY.mydomain.*"; "\.gif$" matches on "\*.gif" but not on "\*.gif\test"; "\[0-9]+\.gif$" matches on "\123.gif" but not on "\test.gif"</help>
                <hint>Regular expressions are allowed.</hint>
                <allownew>true</allownew>
            </field>
            <field>
                <id>proxy.forward.acl.blackList</id>
                <label>Blacklist</label>
                <type>select_multiple</type>
                <style>tokenize</style>
                <help>Blacklist destination domains. You may use a regular expression, use a comma or press Enter for new item. Examples: "mydomain.com" matches on "*.mydomain.com"; "^https?:\/\/([a-zA-Z]+)\.mydomain\." matches on "http(s)://textONLY.mydomain.*"; "\.gif$" matches on "*.gif" but not on "\*.gif\test"; "\[0-9]+\.gif$" matches on "\123.gif" but not on "\test.gif"</help>
                <hint>Regular expressions are allowed.</hint>
                <allownew>true</allownew>
            </field>
            <field>
                <id>proxy.forward.acl.browser</id>
                <label>Block browser/user-agents</label>
                <type>select_multiple</type>
                <style>tokenize</style>
                <help>Block user-agents. You may use a regular expression, use a comma or press Enter for new item. Examples: "^(.)+Macintosh(.)+Firefox/37\.0" matches on "Macintosh version of Firefox revision 37.0"; "^Mozilla" matches on "all Mozilla based browsers"</help>
                <hint>Regular expressions are allowed.</hint>
                <allownew>true</allownew>
                <advanced>true</advanced>
            </field>
            <field>
                <id>proxy.forward.acl.mimeType</id>
                <label>Block specific MIME type reply</label>
                <type>select_multiple</type>
                <style>tokenize</style>
                <help>Block specific MIME type reply. You may use a regular expression, use a comma or press Enter for new item. Examples: "video/flv" matches on "Flash Video"; "application/x-javascript" matches on "javascripts"</help>
                <hint>Regular expressions are allowed.</hint>
                <allownew>true</allownew>
                <advanced>true</advanced>
            </field>
            <field>
                <id>proxy.forward.acl.googleapps</id>
                <label>Google GSuite restricted</label>
                <type>text</type>
                <advanced>true</advanced>
                <help><![CDATA[Insert here the domain that will be allowed to use Google GSuite.
                All accounts that are not in this domain will be blocked to use it.]]></help>
            </field>
            <field>
                <id>proxy.forward.acl.youtube</id>
                <label>YouTube Filter</label>
                <type>dropdown</type>
                <advanced>true</advanced>
                <help><![CDATA[Select the Youtube filter level.]]></help>
            </field>
            <field>
                <id>proxy.forward.acl.safePorts</id>
                <label>Allowed destination TCP port</label>
                <type>select_multiple</type>
                <style>tokenize</style>
                <help>Allowed destination TCP ports, you may use ranges (ex. 222-226) and add comments with colon (ex. 22:ssh).</help>
                <hint>Type port number or range.</hint>
                <allownew>true</allownew>
                <advanced>true</advanced>
            </field>
            <field>
                <id>proxy.forward.acl.sslPorts</id>
                <label>Allowed SSL ports</label>
                <type>select_multiple</type>
                <style>tokenize</style>
                <help>Allowed destination SSL ports, you may use ranges (ex. 222-226) and add comments with colon (ex. 22:ssh).</help>
                <hint>Type port number or range.</hint>
                <allownew>true</allownew>
                <advanced>true</advanced>
            </field>
        </subtab>
        <subtab id="proxy-icap" description="ICAP Settings">
            <field>
                <id>proxy.forward.icap.enable</id>
                <label>Enable ICAP</label>
                <type>checkbox</type>
                <style>tokenize</style>
                <help>If this checkbox is checked, you can use an ICAP server to filter or replace content.</help>
                <hint>Select if you want to use ICAP.</hint>
                <allownew>true</allownew>
                <advanced>false</advanced>
            </field>
            <field>
                <id>proxy.forward.icap.RequestURL</id>
                <label>Request Modify URL</label>
                <type>text</type>
                <style>tokenize</style>
                <help>Enter the url where the REQMOD requests should be sent to.</help>
                <hint>Enter the URL of the ICAP Server</hint>
                <allownew>true</allownew>
                <advanced>false</advanced>
            </field>
            <field>
                <id>proxy.forward.icap.ResponseURL</id>
                <label>Response Modify URL</label>
                <type>text</type>
                <style>tokenize</style>
                <help>Enter the url where the RESPMOD requests should be sent to.</help>
                <hint>Enter the URL of the ICAP Server</hint>
                <allownew>true</allownew>
                <advanced>false</advanced>
            </field>
            <field>
                <id>proxy.forward.icap.OptionsTTL</id>
                <label>Default Options TTL</label>
                <type>text</type>
                <style>tokenize</style>
                <help>Default ttl</help>
                <hint>Enter the default ttl.</hint>
                <allownew>true</allownew>
                <advanced>true</advanced>
            </field>
            <field>
                <id>proxy.forward.icap.SendClientIP</id>
                <label>Send Client IP</label>
                <type>checkbox</type>
                <style>tokenize</style>
                <help>If you enable this option, the client IP address will be sent to the ICAP server. This can be useful if you want to filter traffic based on IP addresses.</help>
                <hint>Send the client IP address to the ICAP server.</hint>
                <allownew>true</allownew>
                <advanced>true</advanced>
            </field>
            <field>
                <id>proxy.forward.icap.SendUsername</id>
                <label>Send Username</label>
                <type>checkbox</type>
                <style>tokenize</style>
                <help>If you enable this option, the username of the client will be sent to the ICAP server. This can be useful if you want to filter traffic based on usernames. Authentication is required to use usernames.</help>
                <hint>Check if the username should be sent to the ICAP server.</hint>
                <allownew>true</allownew>
                <advanced>true</advanced>
            </field>
            <field>
                <id>proxy.forward.icap.EncodeUsername</id>
                <label>Encode Username</label>
                <type>checkbox</type>
                <style>tokenize</style>
                <help>Use this option if your usernames need to be encoded.</help>
                <hint>Check if you want to encode the username using base64.</hint>
                <allownew>true</allownew>
                <advanced>true</advanced>
            </field>
            <field>
                <id>proxy.forward.icap.UsernameHeader</id>
                <label>Username Header</label>
                <type>text</type>
                <style>tokenize</style>
                <help>The header which should be used to send the username to the ICAP server.</help>
                <hint>Enter the name of the header.</hint>
                <allownew>true</allownew>
                <advanced>true</advanced>
            </field>
            <field>
                <id>proxy.forward.icap.EnablePreview</id>
                <label>Enable Preview</label>
                <type>checkbox</type>
                <style>tokenize</style>
                <help>If you use previews, only a part of the data is sent to the ICAP server. Setting this option can improve the performance.</help>
                <hint>Enable if you want to use previews.</hint>
                <allownew>true</allownew>
                <advanced>true</advanced>
            </field>
            <field>
                <id>proxy.forward.icap.PreviewSize</id>
                <label>Preview Size</label>
                <type>text</type>
                <style>tokenize</style>
                <help>Enter the size of the preview which is sent to the ICAP server.</help>
                <hint>Enter the size of the preview.</hint>
                <allownew>true</allownew>
                <advanced>true</advanced>
            </field>
            <field>
                <id>proxy.forward.icap.exclude</id>
                <label>Exclusion List</label>
                <type>select_multiple</type>
                <style>tokenize</style>
                <help>Exclusion list destination domains.You may use a regular expression, use a comma or press Enter for new item. Examples: "mydomain.com" matches on "*.mydomain.com"; "https://([a-zA-Z]+)\.mydomain\." matches on "http(s)://textONLY.mydomain.*"; "\.gif$" matches on "\*.gif" but not on "\*.gif\test"; "\[0-9]+\.gif$" matches on "\123.gif" but not on "\test.gif"</help>
                <hint>Regular expressions are allowed.</hint>
                <allownew>true</allownew>
            </field>
        </subtab>
        <subtab id="proxy-general-authentication" description="Authentication Settings">
            <field>
                <id>proxy.forward.authentication.method</id>
                <label>Authentication method</label>
                <type>select_multiple</type>
                <help>Select Authentication method</help>
            </field>
            <field>
                <id>proxy.forward.authentication.authEnforceGroup</id>
                <label>Enforce local group</label>
                <type>select_multiple</type>
                <help><![CDATA[Restrict access to users in the selected (local)group. <br/>
                <b>NOTE:</b> please be aware that users (or vouchers) which aren't administered locally will be denied when using this option.]]>
                </help>
            </field>
            <field>
                <id>proxy.forward.authentication.realm</id>
                <label>Authentication Prompt</label>
                <type>text</type>
                <help>The prompt will be displayed in the authentication request window.</help>
            </field>
            <field>
                <id>proxy.forward.authentication.credentialsttl</id>
                <label>Authentication TTL (hours)</label>
                <type>text</type>
                <help>This specifies for how long (in hours) the proxy server assumes an externally validated username and password combination is valid (Time To Live). When the TTL expires, the user will be prompted for credentials again.</help>
            </field>
            <field>
                <id>proxy.forward.authentication.children</id>
                <label>Authentication processes</label>
                <type>text</type>
                <help>The total number of authenticator processes to spawn.</help>
            </field>
        </subtab>
        <subtab id="proxy-forward-snmp" description="SNMP Agent Settings">
            <field>
                <id>proxy.forward.snmp_enable</id>
                <label>Enable SNMP Agent</label>
                <type>checkbox</type>
                <help>Enable or disable the squid SNMP Agent.</help>
            </field>
            <field>
                <id>proxy.forward.snmp_port</id>
                <label>SNMP port</label>
                <type>text</type>
                <help>The port number where Squid listens for SNMP requests. To enable SNMP support set this to a suitable port number. Port number 3401 is often used for the Squid SNMP agent.</help>
            </field>
            <field>
                <id>proxy.forward.snmp_password</id>
                <label>SNMP password</label>
                <type>text</type>
                <help>The password for access to SNMP agent</help>
            </field>
        </subtab>
    </tab>

    <activetab>proxy-general-settings</activetab>
</form>
