Hi
I have a RB493AH with version 5.7 at a client and i need to block facebook/myspace and other social network junk
With no proxy the web traffic works perfectly. The moment i enable webproxy the web traffic stops working, the pages are barely getting loaded and i mean www.google.com gets loaded in 2 mins if it isn’t timing out.
With same settings it works on my RB750 version 5.7. I have no ideea why it does not on this one. There aren’t more then 20 users so it is not that, the cpu does not go over 5%
Any input would be greatly appreciated
Thank you
My config:
/ip address print detail
Flags: X - disabled, I - invalid, D - dynamic
0 ;;; Data SubNet
address=192.168.0.1/24 network=192.168.0.0 interface=E2-Data-SW01
actual-interface=E2-Data-SW01
1 address=x.x.x.x/29 network=108.58.120.120 interface=E1-Wan
actual-interface=E1-Wan
2 ;;; SubNet for Voip Phones
address=10.10.0.1/24 network=10.10.0.0 interface=E3-Voip-SW02
actual-interface=E3-Voip-SW02
3 address=192.168.254.9/29 network=192.168.254.8 interface=MgtVlan
actual-interface=MgtVlan
/ip route print detail
Flags: X - disabled, A - active, D - dynamic,
C - connect, S - static, r - rip, b - bgp, o - ospf, m - mme,
B - blackhole, U - unreachable, P - prohibit
0 A S dst-address=0.0.0.0/0 gateway=x.x.x.y
gateway-status=x.x.x.y reachable E1-Wan distance=1 scope=30
target-scope=10
1 ADC dst-address=10.10.0.0/24 pref-src=10.10.0.1 gateway=E3-Voip-SW02
gateway-status=E3-Voip-SW02 reachable distance=0 scope=10
2 ADC dst-address=x.x.x.x/29 pref-src=x.x.x.x gateway=E1-Wan
gateway-status=E1-Wan reachable distance=0 scope=10
3 ADC dst-address=192.168.0.0/24 pref-src=192.168.0.1 gateway=E2-Data-SW01
gateway-status=E2-Data-SW01 reachable distance=0 scope=10
4 ADC dst-address=192.168.254.8/29 pref-src=192.168.254.9 gateway=MgtVlan
gateway-status=MgtVlan reachable distance=0 scope=10
/ip firewall nat print detail
Flags: X - disabled, I - invalid, D - dynamic
0 chain=srcnat action=masquerade out-interface=E1-Wan
1 chain=dstnat action=redirect to-ports=8080 protocol=tcp
in-interface=E2-Data-SW01 dst-port=80
/ip proxy> print
enabled: yes
src-address: 0.0.0.0
port: 8080
parent-proxy: 0.0.0.0
parent-proxy-port: 0
cache-administrator: webmaster
max-cache-size: none
cache-on-disk: no
max-client-connections: 600
max-server-connections: 600
max-fresh-time: 3d
serialize-connections: no
always-from-cache: no
cache-hit-dscp: 4
cache-drive: system
/ip proxy access print detail
Flags: X - disabled
0 src-address=192.168.0.0/24 dst-host=*.facebook.com action=deny hits=0
1 src-address=192.168.0.0/24 dst-host=*.myspace.com action=deny hits=0
/ip firewall filter print detail
Flags: X - disabled, I - invalid, D - dynamic
0 chain=input action=accept src-address-list=Company in-interface=E1-Wan
1 ;;; Port scanners to list
chain=input action=add-src-to-address-list protocol=tcp psd=21,3s,3,1
address-list=port scanners address-list-timeout=2w in-interface=E1-Wan
2 ;;; NMAP FIN Stealth scan
chain=input action=add-src-to-address-list
tcp-flags=fin,!syn,!rst,!psh,!ack,!urg protocol=tcp
address-list=port scanners address-list-timeout=2w in-interface=E1-Wan
3 ;;; SYN/FIN scan
chain=input action=add-src-to-address-list tcp-flags=fin,syn
protocol=tcp address-list=port scanners address-list-timeout=2w
in-interface=E1-Wan
4 ;;; SYN/RST scan
chain=input action=add-src-to-address-list tcp-flags=syn,rst
protocol=tcp address-list=port scanners address-list-timeout=2w
in-interface=E1-Wan
5 ;;; FIN/PSH/URG scan
chain=input action=add-src-to-address-list
tcp-flags=fin,psh,urg,!syn,!rst,!ack protocol=tcp
address-list=port scanners address-list-timeout=2w in-interface=E1-Wan
6 ;;; ALL/ALL scan
chain=input action=add-src-to-address-list
tcp-flags=fin,syn,rst,psh,ack,urg protocol=tcp
address-list=port scanners address-list-timeout=2w in-interface=E1-Wan
7 ;;; NMAP NULL scan
chain=input action=add-src-to-address-list
tcp-flags=!fin,!syn,!rst,!psh,!ack,!urg protocol=tcp
address-list=port scanners address-list-timeout=2w in-interface=E1-Wan
8 ;;; dropping port scanners
chain=input action=drop src-address-list=port scanners
9 ;;; ICMP
chain=input action=accept protocol=icmp in-interface=E1-Wan limit=5,0
10 ;;; PPTP
chain=input action=accept protocol=tcp in-interface=E1-Wan dst-port=1723
11 chain=input action=accept protocol=gre in-interface=E1-Wan
12 ;;; SNMP
chain=input action=accept protocol=udp src-address=y.y.y.y
in-interface=E1-Wan dst-port=161
13 ;;; Allow packets belonging to existing connections
chain=input action=accept connection-state=established protocol=tcp
in-interface=E1-Wan
14 ;;; Allow packets belonging to existing connections
chain=forward action=accept connection-state=established protocol=tcp
in-interface=E1-Wan
15 ;;; Allow packets related to existing connections
chain=input action=accept connection-state=related in-interface=E1-Wan
16 ;;; Allow packets related to existing connections
chain=forward action=accept connection-state=related in-interface=E1-Wan
17 ;;; Allow SSH safe hosts
chain=input action=accept connection-state=new protocol=tcp
src-address-list=safe dst-port=22
18 ;;; Drop SSH brute forcers
chain=input action=drop protocol=tcp src-address-list=ssh_blacklist
dst-port=22
19 ;;; SSH brute forcers blacklisting
chain=input action=add-src-to-address-list connection-state=new
protocol=tcp src-address-list=ssh_stage3 address-list=ssh_blacklist
address-list-timeout=1w3d dst-port=22
20 ;;; SSH brute forcers the third stage
chain=input action=add-src-to-address-list connection-state=new
protocol=tcp src-address-list=ssh_stage2 address-list=ssh_stage3
address-list-timeout=1m dst-port=22
21 ;;; SSH brute forcers the second stage
chain=input action=add-src-to-address-list connection-state=new
protocol=tcp src-address-list=ssh_stage1 address-list=ssh_stage2
address-list-timeout=1m dst-port=22
23 ;;; Allow WinBox safe hosts
chain=input action=accept connection-state=new protocol=tcp
src-address-list=safe dst-port=8291
24 ;;; Drop WinBox brute forcers
chain=input action=drop protocol=tcp src-address-list=wb_blacklist
dst-port=8291
25 ;;; WinBox brute forcers blacklisting
chain=input action=add-src-to-address-list connection-state=new
protocol=tcp src-address-list=wb_stage3 address-list=wb_blacklist
address-list-timeout=1w3d dst-port=8291
26 ;;; WinBox brute forcers the third stage
chain=input action=add-src-to-address-list connection-state=new
protocol=tcp src-address-list=wb_stage2 address-list=wb_stage3
address-list-timeout=1m dst-port=8291
27 ;;; WinBox brute forcers the second stage
chain=input action=add-src-to-address-list connection-state=new
protocol=tcp src-address-list=wb_stage1 address-list=wb_stage2
address-list-timeout=1m dst-port=8291
28 ;;; WinBox brute forcers the first stage
chain=input action=add-src-to-address-list connection-state=new
protocol=tcp address-list=wb_stage1 address-list-timeout=1m
dst-port=8291
29 ;;; Allow SSH
chain=input action=accept connection-state=new protocol=tcp dst-port=22
30 ;;; Allow WinBox
chain=input action=accept connection-state=new protocol=tcp
dst-port=8291
31 ;;; Allow FTP
chain=input action=accept connection-state=new protocol=tcp
dst-port=20-21
32 ;;; Drop everything else
chain=input action=drop connection-state=new in-interface=E1-Wan
33 ;;; Drop FTP brute forcers
chain=input action=drop protocol=tcp src-address-list=ftp_blacklist
dst-port=21
34 ;;; Allow only 10 FTP login incorrect answers per minute
chain=output action=accept protocol=tcp content=530 Login incorrect
dst-limit=1/1m,9,dst-address/1m
35 ;;; FTP brute forcers blacklisting
chain=output action=add-dst-to-address-list protocol=tcp
address-list=ftp_blacklist address-list-timeout=3h
content=530 Login incorrect