The Access Control List, ACL, allow to combie the previous object definitions into distinct rulesets for each source (client group) or in a default ACL.

The default section defines fallbacks for all acl rulesets. Thus if you define a rewrite rule here it will be used in acls where there are no rewrite rules defined. (i.e. the other acls inherits the definitions in the default acl optionally overruled by own definitions). The default rule set is used for all clients that match no sources (client group) and for client groups (sources) with no acls declared.

The Deny ip addresses in Urls can be used to enforce the use of domainnames over IP addresses in the host part of URLs.

The Default access allow you to choose the default behaviour of the acl. Only the selected list (none) should be used to terminate pass rules where only the listed destination groups should pass. All Internet (all | any) is the default and be used to allow full access to Internet provide that the destination is not found in the blacklist groups.

Allow access to must be used to define whitelist groups to terminate pass rules when the destination is found in a list.

Deny access to must be used to define blacklist groups that should not pass (i.e. be redirected to the actual redirect URL). That mean that there must also be a redirect definition for eiter that destination group, the actual acl or the default acl.

The DNS Whitelist allow you to use a set of Internet DNS blacklist engine to allow destinations for the actual acl.

The DNS Blacklist allow you to use a set of Internet DNS blacklist engine to block destinations for the actual acl.

The Use rewrite rules allow you to declares the substitution rulsets that applies to the actual acl.

The Redirect url declares the altenative URL to be used for blocked destination groups for the actual acl.

The else part of the acl can be used only if you have defined a time constraint to the acl.