I’m not a specialist in networking, please can somebody help me with the setup steps for a reverse proxy ?
I found in the manual the instructions for this, but in version V6.2 the options described are not available.
(http://wiki.mikrotik.com/wiki/Multiple_Web_Servers)
RouterOs: V6.2
Hardware: RB2011L
Situation:
1 public IP Address (xxx.xxx.xxx.xxx)
Public DNS 3 A-records to xxx.xxx.xxx.xxx, www1.domain.nl , www2.domain.nl, www3.domain.nl
RouterOs: public adress xxx.xxx.xxx.xxx (WAN)
RouterOs: local adresses 192.168.88.x
Web server1: 192.168.88.11, www1.domain.nl
Web server2: 192.168.88.12, www2.domain.nl
Web server3: 192.168.88.13, www3.domain.nl
All webservers runs IIS on port 80
What I want is that from the internet from your browser you go to Web server1 with url www1.domain.nl, you go to Web server2 with url www2.domain.nl and you go to Web server3 with url www3.domain.nl.
Do you have 3 different public IP addresses or only one?
If you have one, you have to redirect on one’s of them. If you have three, create appropriate NAT rules.
I’ve only 1 public IP address.
3 DNS A records all pointed to the same public IP Address
Internal 3 servers with private IP adresses 192.168.88.11, 192.168.88.12 and 192.168.88.13)
See the link of Mikrotik manual page, that’'s what I need (multiple web servers)
The problem is that the options in the manual (transparant proxy etc.) are not in V6.2 or RouterOs
Simply try it without missing options. The following seems to work just fine (just a quick test that I get pages from two different servers). You should at least add access rules to /ip proxy access for real use, to not become an open proxy.
/ip proxy
set enabled=yes max-cache-size=none
/ip dns static
add address=192.168.80.3 name=www.123.comadd address=192.168.84.2 name=www.456.com/ip firewall nat
add action=redirect chain=dstnat dst-address=192.168.80.80 dst-port=80
protocol=tcp to-ports=8080
Hi thanks, I tried but no success
I don´t have /ip proxy but /ip webproxy
in line 7 what´s dst-address=192.168.80.80 , I have there my public address 213.125.xxx.xxx
I have no explanation how I can have “/ip proxy” and you “/ip webproxy”, when we both should have same RouterOS 6.2. We should sort this out first. In fact, the whole wiki example seems a little strange. I have currently access to RouterOS 2.9.51, 3.30, 5.24 and 6.2 and in all of them it’s named “/ip proxy” and none of them has transparent-proxy option you were missing. So where exactly is that example from, I have no idea.
192.168.80.80 is just an address I tested it with. If you put your public address there (to which the hostnames resolve), it’s correct.
So what exactly you did? Did you enable proxy? Did you add firewall rule? Did you add dns entries? Do required hostnames correctly resolve to your public address? What happens when you try to open the web in browser? You can also run /export command and post the output here, that should answer a lot of these questions.
Hi, thanks for your reply, see below my /export
From my internal network I can reach my servers test.xxxx.com , from the internet not
In dns I have an a-record for test.xxx.com thats point to a public address
this public address is configured to port 1 of my RouterBoard
From the internet I can ping to test.xxx.com and it shows the IP address of port 1
\
MMM MMM KKK TTTTTTTTTTT KKK
MMMM MMMM KKK TTTTTTTTTTT KKK
MMM MMMM MMM III KKK KKK RRRRRR OOOOOO TTT III KKK KKK
MMM MM MMM III KKKKK RRR RRR OOO OOO TTT III KKKKK
MMM MMM III KKK KKK RRRRRR OOO OOO TTT III KKK KKK
MMM MMM III KKK KKK RRR RRR OOOOOO TTT III KKK KKK
That’s because when LAN clients use your router as DNS server, they get 192.168.88.225 and connect there directly (that’s not a bad thing).
Your problem is firewall, you don’t allow anyone from internet to connect to proxy. Add this and move it before drop rule:
/ip firewall filter
add chain=input protocol=tcp dst-port=8080 action=acceptAlso don’t forget to set proxy access as indicated at the end of wiki article!
Btw, your firewall for forward chain is useless, because it accept just anything except invalid packets. You probably want to add something like this at the end:
/ip firewall filter
add chain=forward in-interface=bridge-local action=accept
add chain=forward action=drop
