I’ve made transparent caching proxy by redirecting with firewall rules all incoming port 80 connections to port of web-proxy (3128), just as in manual. All is fine. But in netflow-records all http-requests are now have form of requests to proxy (addr. of Mikrotik and port 3128), so it’s now really impossible to divide traffic on classes. How can I solve this problem? Does it mean that redirection, which is made in ‘prerouting’ chain goes before any netflowing?