I needed a lab network on my laptop to reach package repositories through a local proxy. The stock configuration ships an ACL for exactly this, commented out:

acl localnet src 10.0.0.0/8
acl localnet src 172.16.0.0/12
acl localnet src 192.168.0.0/16
...
http_access allow localnet

Uncommenting that block works immediately, which is the problem. localnet covers every private range there is. On a laptop attached to a home, office or hotel network, 192.168.0.0/16 covers every other device on that wifi, and the machine has just become an open proxy for all of them.

Name the ranges you actually mean:

acl lab_net    src 10.20.0.0/16      # the lab segment, and nothing else
acl this_host  src 198.51.100.7/32   # this machine's own address

http_access allow lab_net
http_access allow this_host
http_access deny all

The /32 is the part that is easy to miss. Once the broad rule is gone, the host’s own traffic is denied too, because it arrives from the interface address rather than from loopback.

Two habits came out of this. Write the allow list as the set of sources you can name, with a comment explaining each. An ACL whose membership you cannot state is not a control. And verify from outside the intended set: bring up another device on the same wifi and confirm the proxy refuses it. Testing that the permitted path works proves nothing about who else is permitted.

A convenience default on a server behind a firewall becomes an exposure on a laptop that travels. The configuration did not change; the network around it did.