Redirect traffic to Squid ( Linux )

RouterOS General
1

Greetings,

I’ve just installed a squid cache server on a linux machine, the hierarchy is like this :

   WAN LINK
         |
 -------------             ---------------------
| Mikrotik Box |          |   Cache Linux Server  |
 -------------            ----------------------
         |                   /
         |                 /
 ----------------------
| Switch ( Cheap one ) |
 ----------------------
    |           |          |       
  Client1   Client2    Client3   etc.

What i’m trying to do is, I want all the traffic regarding to port 80 from Client1,Client2,Client3 to be forwarded to my Cache server at port 8080.
I tried with redirect rule, but it seems it only maps ports on his own and can’t redirect somewhere else.

Any idea how to do this?

Thanks

radius - pppoe redirect
Transperant Proxy setup
Best cache solution
2

You have to use action=dstnat, as well do not forget to specify to-addresses, where you have to put squid address.
action=redirect is used to redirect traffic to router itself.

3

Could you be more specific please?
Under linux it could be done easy via set & mark, but don’t know how to do this exactly in Mikrotik.

4 
ip firewall nat add action=dst-nat dst-port=80 protocol=tcp src-address="client's_used subnet" to-addresses="squid_address" to-ports=8080 chain=dstnat

http://www.mikrotik.com/testdocs/ros/2.9/ip/nat.php

5

Hello,

I tried this alredy a few minutes ago, but I get this error in return:

ERROR
The requested URL could not be retrieved

While trying to retrieve the URL: /firefox?client=firefox-a&rls=org.mozilla:en-US:official

The following error was encountered:

    * Invalid URL 

Some aspect of the requested URL is incorrect. Possible problems:

    * Missing or incorrect access protocol (should be `http://'' or similar)
    * Missing hostname
    * Illegal double-escape in the URL-Path
    * Illegal character in hostname; underscores are not allowed

I’m not sure why is this showing up, it is coming from my proxy server , altho when I point my browser to my proxy server it works fine.

rules on cache server are to Accept ANY ANY

6

Please, post you rules from ‘ip firewall nat’, when redirect to proxy is enabled.

7

Here’s the rules:

 1   chain=dstnat src-address=myip protocol=tcp dst-port=80 
     action=dst-nat to-addresses=proxyip to-ports=8080 

 2   chain=srcnat src-address=someinternalip/24 action=masquerade 

 3   chain=srcnat src-address=someinternalip/24 action=masquerade 

 4   chain=srcnat action=masquerade

Altho, there’s one thing i’d like to mention, i’m connecting to this internal network via VPN, because i’m not there physically, does that change anything?
I’m probably gettin beyond of mikrotik point, somewhere says I need my proxy in transparent mode, which I think it is, but still if it works like this just by pointing my browser to the proxy, it should work fine with redirection too.

Thanks
Sorry for the late response.

8

I think that you must configure Squid to work as transparent proxy.
http://www.deckle.co.za/squid-users-guide/Transparent_Caching/Proxy

9

Hello Zenoss,
I had the same problem some day ago.
I solved it configuring squid as a transparent proxy server.
To do this, if you have squid version 2.6 you have to edit the squid configuration file (squid.conf) putting the following line:

http_port 3128 transparent
instead of

http_port 3128

Of course the command “http_port 3128” is the default squid proxy port configuration.

If you are using Webmin, you have to specify the option “transparent” on:

Servers → Squid Proxy Server → Ports and Networking

Regards,
Alessio

10

Hello,

Thanks for your response,
I’ve alredy added transparent on the option, but still i get the same error.
Do i need probably to set some rules or something special?

Would really appreciate your help.

Thanks

11

I don’t know what exactly is myip in your configuration, but basically there should be two dstnat rules if you want to redirect all requests from local subnet. For example local subnet 192.168.1.0/24 and proxy is 192.168.1.250:8080

/ip firewall nat
add chain=dstnat src-address=192.168.1.250 dst-port=80 protocol=tcp action=accept

add chain=dstnat src-address=192.168.1.0/24 dst-port=80 protocol=tcp action=dst-nat to-address=192.168.1.250 to -port=8080

If it still isn’t working then definitely something wrong with your squid configuration.

12

Hello Zenoss,
I think that the problem could be on the access lists of the proxy server.
What happens should be the following:

  1. the hotspot receives your request no the Wireless interface and nat it to the proxy server address and proxy server port (to do it you should have configured the ip firewall nat rules on the Mikrotik);
  2. when the hotspot forwards the request to the proxy server, it is forwarded not with the original address, but with the address of the interface which communicates with the proxy as the source address (the WAN address??), and it happens even if you don’t enable the webproxy feature on it;
  3. then, if you at the moment on the proxy server have an access list which permits just the network configured on the hotspot interface, it could be not enough.

I hope this could help you.

Regards
Alessio

13

there is a way to redirect to an external proxy with the original client ip instead of the MT ip? in order to log the client web surf?

14

The only option is to use the squid proxy as gateway for your clients.

15

U can install squid whit Tproxy and set the squid as brigde this work great but you have use 2 NIC and if the power of squid goes you have to unplugg squid. as router-squid-switch-clients.
The good thing is that u do not have to change any thing to the network.

Im workin now whit triangel routing so the squid can stand as standalone server.
But have get this to work yet but have seen it done. more advance but the holle net do not crash if the server goes down.

16

problem is with your configs on the squid had similar issues but after maing changes in the squid it worked well

17

you may add route with gateway=squid and some routing mark, and then mark all traffic to port 80 and with src-mac-address=!squid’s_one with that mark

18

hmmm, i’m not so clear about but i will try exact that you suggest.. thanks

19

you problem is here “While trying to retrieve the URL: /firefox?client=firefox-a&rls=org.mozilla**:en-US:official**”
try only http://www.google.com whitout : in url

20

what did you try? wich config?
about the problem, check that you have the transparent configuration in your squid.conf file