AFAIK, the Authentication Exception Sites are for where you see DENIED in /var/log/squid/access.log and you want to access the site. The content filter logs are /var/log/dansguardian/access.log and you would use Content filter exceptions on any unwanted blocks you see here.

I don't use the content filter/proxy, so I can't answer you question about the content filter policies, but I would expect it to be like the firewall. Once a policy matches, no more policies are checked. If you can confirm how it works, please post back.

OK - so I finally got the google backup and sync to work... had to add "googleapis.com" to the Web Proxy Server Authentication Exception Sites. Adding it to the Content Filter "Default" Exception Sites did not work. This leads me to want a better understanding of the difference in the two methods of filtering urls. Why does the Content Filter "Default" Exception Sites not work?

What exactly is the Content Filter "Default" Exception Sites used for then? Is this for a logged into proxy user that is not a member of a set group policy?

I guess what I am trying to figure out - does a member of another group policy ever reach the default policy?

example:

default group > allow exception to site A

user group 1 > no exceptions to Site A

Does this user in user group 1 ever hit the default group to get the exception to site A?

Thanks for clarifying...