(HELP) Internal Web Proxy in Mikrotik Bridge...still mystery

RouterOS General
1

Hi,

Anyone had succeed building Mikrotik Bridge as Web Proxy ?
I tried search whole forum and google, but nothing :frowning:

Since 3 years ago, I have a solid network like this:
Clients ----- Mikrotik Gateway ----- Internet (4 WAN load balance).

Now, I want to add web proxy in my network, so it will be like this:
Client ----- Mikrotik Bridge (port ether1 + ether2 in bridge1) + Internal Web Proxy ----- Mikrotik Gateway ----- Internet (4 WAN load balance).


I have to use Mikrotik Bridge and its Internal Web Proxy. I don’t want to use any other external proxy, because Mikrotik internal proxy is good enough for me. And I am fans of Mikrotik :smiley:

I tried to setup Mikrotik Bridge as follow:
(using RB750 just for testing. If working good, will change to Mikrotik PC)


BRIDGE
/interface bridge> pr
0 R name=“bridge1” mtu=1500 l2mtu=1524 arp=enabled
mac-address=00:0C:42:80:92:07 protocol-mode=none priority=0x8000
auto-mac=yes admin-mac=00:00:00:00:00:00 max-message-age=20s
forward-delay=15s transmit-hold-count=6 ageing-time=5m
/interface bridge port> pr
0 ether1 - IN bridge1 0x80 10 none
1 ether5 - OUT bridge1 0x80 10 none
/interface bridge settings> pr
use-ip-firewall: yes
use-ip-firewall-for-vlan: no
use-ip-firewall-for-pppoe: no


NAT
/ip firewall nat> pr
0 chain=dstnat action=redirect to-ports=9999 protocol=tcp dst-port=80
in-bridge-port=ether1 - IN


WEB PROXY
/ip proxy> pr
enabled: yes
src-address: 0.0.0.0
port: 9999
parent-proxy: 0.0.0.0
parent-proxy-port: 0
cache-administrator: “webmaster”
max-cache-size: 8000KiB
cache-on-disk: yes
max-client-connections: 600
max-server-connections: 600
max-fresh-time: 3d
serialize-connections: no
always-from-cache: no
cache-hit-dscp: 9
cache-drive: system


And Mikrotik Bridge as PPPoE Client, Mikrotik Gateway as PPPoE Server.
So Mikrotik Bridge got internet from Mikrotik Gateway.

If I disable “NAT Redirect”, client have internet from Mikrotik Gateway, but if “NAT Redirect” enabled, clients disconnect from internet :frowning:

Please somebody, where is my mistake ?


Thanks

2

Is there any specific reason you want to run the proxy on a bridge, and not in a routed scenario? Connect the machine that is supposed to be a proxy to the existing gateway on a separate layer 3 routed interface, do a NAT redirect to the proxy port on it on the gateway machine based on source address so that only clients behind the gateway get redirected.

Much more elegant than a bridge, makes it easy to turn off the proxy by just removing the NAT rule in case of problems, doesn’t come with any of the issues associated with running a layer 3 service on a layer 2 network - which I am not even entirely sure is possible.

3

Hi fewi,

My reason because my Mikrotik Gateway serves 354 clients. I don’t want to make its load more high than now (about 20%).

I have tried my Mikrotik Gateway + internal Web Server, the result…minimum load was 75% :frowning:
And sometimes it reached 100%…then packet loss happend :frowning: