http filter

[Bernhard]

Hello,

in the (nice) tutorial
https://www.qubes-os.org/doc/config/http-filtering-proxy/ it is
suggested to run the tinyproxy inside the FirewallVM. That is
estonishing to me. I would think the qubes way were to have a proxyVM
(based on some minimal template) that is set *behind* Firewall and on in
it. one ascii picture replaces ten phrases:

Jungle <-> SysNet <-> FirewallVM <-> ProxyVM <-+-> AppVM1

<-+-> AppVM2

So here are my two questions:

- is this better than the suggested tinyproxy-in-FirewallVM ?

- did someone set up his filtering that way and give some hints / errors
to avoid?

Thanks, Bernhard