Sometimes it is necessary to create an exception for proxy deny rule. For that you need to use proxy allow rule. Allow rules are always used before deny rules.

If it is necessary to allow access to some user to a particular site or host even if user’s quota is exceeded or he is switched off, then you need to use proxy allow rule with an option “allow even if user is switched off”.

Deny and allow rules are applied in the following way:

1. Profiles assigned to root group
2. Allow rules of root group
3. Deny rules of root group
4. …
5. Profiles assigned to parent group
6. Allow rules of parent group
7. Deny rules of parent group
8. Profiles assigned to user
9. Allow rules of user
10. Deny rules of user