This tells Squid to use the parent for all domains other than home.nl . The firewall doesn't need to run large applications like Squid. The internal Squid-server still gives you the benefit of caching. Run a nameserver on the firewall or use an internal nameserver. When a proxy-cache is used, a server does not see the connection coming from the originating client.
Many people like to implement access controls based on the client address.
We must note that access controls based on this header are extremely weak and simple to fake. Anyone may hand-enter a request with any IP address whatsoever. Yes it can, however the way of doing it has changed from earlier versions of squid. As of squid-2.2 a more customisable method has been introduced. Please follow the instructions for the version of squid that you are using.