Mikrotik and Squid Proxy

RouterOS General
1

Dear All,

I’ve some trouble with mikrotik web-proxy and Squid cache.
these are my HW/SW specification:
Mikrotik: HW: RouterBoard 1100 - RouterOS version: 4.13
Squid Cache: 2.7 stable 7.
I set mikrotik web-proxy as transparent proxy with Squid as parent-proxy:

enabled: yes
src-address: 0.0.0.0
port: 3128
parent-proxy: 10.1.1.3
parent-proxy-port: 3128
cache-administrator: "webmaster"
max-cache-size: 16000KiB
cache-on-disk: no
max-client-connections: 600
max-server-connections: 600
max-fresh-time: 3d
serialize-connections: no
always-from-cache: no
cache-hit-dscp: 4
cache-drive: system

I set Squid as transparent proxy.
I added a dst-nat rule that redirect all traffic web traffic (tcp port 80) to port 3128:

;;; redirect PROXY
     chain=dstnat action=redirect to-ports=3128 protocol=tcp 
     src-address=!10.1.1.3 in-interface=ether2 dst-port=80

with these settings I cannot surf internet.
If I set the proxy directly in client browser everything works fine.
Could someone help me???
thank you!

2

Your NAT rule is redirecting port 80 to the router on port 3128, so it won’t work unless the router is set up to be the proxy and is listening on that port. Change the action to dst-nat and set the to-address to the Squid server’s IP.

3

Hi Feklar, thanks for your reply.
the mikrotik is set up to be a proxy and I set up Squid server as parent-proxy.
If I add a rule, as you told me, the connection timed out.
I set up the same settings in another Mikrotik (v.4.2) with squid parent proxy and works perfectly.
have you some other suggestion?

thanks,
Teo2586

4

You didn’t mention that you had a parent-proxy setup. The rule I posted was to redirect all HTTP to the proxy server itself.

Since you are running a proxy on the MikroTik itself, that means your first rule was right. What are your firewall filter rules? It’s possible that is blocking something you don’t want it to.

5

I added OPEN ALL rules in input and forward chains but the problem still be present…

6

@ teo2586

Try this thread http://forum.mikrotik.com/t/mikrotik-squid-parent-proxy/35828/3

I use a Parent-Proxy too.

7

Hi,

sorry for my delay but I still having troubles to use Squid-cache as parent-proxy.
Thanks steve0 for your suggestions, I’ve tried but nothing changes.
I manage 5 different network with 5 Mikrotik Firewall and I have problem only in this Mikrotik - Squid installation.
In the other 4 network I use Squid 2.7STABLE4, I’ve also downgraded this Squid from 2.7STABLE7 to 2.7STABLE4.
Could someone help me?
thanks!

8

Have you got firewall nat rule for parent proxy

ip firewall nat print
Flags: X - disabled, I - invalid, D - dynamic
0 ;;; Parent proxy
chain=dstnat action=accept protocol=tcp src-address=“your parent proxy ip” dst-address=!“your parent proxy ip”

9

@ kaas
I’ve tried but the problem still be present…