PCC with SQUID

RouterOS General
1

Dear All,

I have Mikrotik PPPoE Server with 3 LAN cards. (Max interface support in this pc is 3)

1 interface for LAN users / pppoe, ip = 172.16.0.1/16
2 interfaces for WANs, for PCC Load Balancing.

DHCP Pool for LAN Users = 172.16.0.10-172.16.0.255
PPPoE Pool for PPPoE Users = 10.0.0.1-10.0.0.255
Now I want to Add SQUID Proxy Server, so all HTTP request can be redirect to SQUID server.

(Note: Currently SQUID (in transparent mode) is on same Subnet as LAN users, SQUID IP is = 172.16.0.2, (Squid have 2 lan interfsace, one for lan, one for WAN connected with isp) I know its not secure to place Squid in user Subnet, But I want it this way for a time being, )

What rules need to be added ? Will PCC be a problem in forwarding HTTP request to squid ???

I have tried this rule but its not forwarding any request to SQUID. Its counting very little packets, but when I check squid logs, I don’t see any actvity, SQUID is working fine in transparent mode if I directly access it via user end (pointing proxy in browser or by defining default gw to squid), its connectivity is ok.

/ip firewall nat
add chain=dstnat src-address=10.0.0.1/24 dst-port=80 protocol=tcp action=accept

add chain=dstnat src-address=10.0.0.1/24 dst-port=80 protocol=tcp action=dst-nat to-address=172.16.0.2 to -port=8080


Is PCC having some problem with redirecting rule ?

~ Mickey Mouse ~

2

PCC is just a routing decision, and it won’t affect your redirects, especially if they are going to a local address. It just gets complicated when you throw in extra services like hotspot etc. I’m not sure of the effect it will have on PPPoE users either since I don’t use PPPoE. Is your rule not incrementing, if it’s not check to see if there is a rule further up that is catching their traffic.

You may need to set up a mangle rule that will exclude local subnets from being processed, so a simple accept for your local subnets above the mark-connection/route rules will do it.

If you want to send users in the DHCP pool to the squid server as well, you will need to setup hairpin NAT for them if you don’t want to move the server to another subnet.
http://wiki.mikrotik.com/wiki/Hairpin_NAT