TPROXY is very interesting. I have been testing it on debian and it is very nice. Preserves src ip so it does not appear as a NAT, but rather as a regular router.
That said, I don’t think any routerboards have the horsepower necessary to make a real ISP great TPROXY setup. I’m thinking quad xeon with 8GB and half a GB of SSD.
A couple of things that you can do with TPROXY and squid that would be useful for a WISP
truly, non-nat, transparent caching proxy. May be of somewhat limited use in a world of dynamic and difficult to cache content, but still probably good for 20% bandwidth savings if tuned properly.
in stream http gz compression. I have run TPROXY on debian in this configuration (in the lab/test setup) and it is surprisingly effective. You can compress http data via gz which can reduce the size of txt streams by 80%. If you consider image content (not compressable) then you can save 20-40% of your transport throughput for delivering web pages to your clients. You can also gz compress inbound requests to hosted servers with this. All modern browsers support gz compressed content.
per client content filtering. via firewall rules you can direct traffic for a ‘content filtered’ client list through TPROXY and something like dansguardian and still preserve the src ip address. again, avoiding having the NAT device show up as the src address on the provider’s side.
I played with TProxy as well, but I wanted it to cache videos and other content. We are testing out Thundercache at the moment with uses Tproxy (completely transparent) and caches video including netflix. I have it setup with 650GB of cache at the moment on a 3Mbps Internet link. It helps a bunch. It looked like a lot of work to get the same content caching out of squid.
From Aug to now, did you have any hiccups or did the server require any software maintenance to run smoothly? Are you still recommending it? For how many clients ? Thanks.
*indirect advert here - but for the purpose of answering your question *
We’ve extensively deployed our neoCACHE (http://www.neology.co.za/products/neocache/) solution using both TPROXY and WCCP. TPROXY on Mikrotik works absolutely perfectly if you realise that the solution on the TIK is simply a set of policy routes. The TPROXY intelligence is on the cache setup itself.
In small environments this works quite happily on the 1100/1200’s but for most customers we make use of a 1U server platform with a lot more horsepower.
It works very effectively and has been running on some sites with no downtime for over a year carrying >350 Mbps of redirected traffic (TPROXY speciically). Our WCCP bits does far better
Can you demo this in a youtube video or something because still a bit mystical. Awesome if it delivers whats promised though, a must have for VSATs and 3g setups.