Hi all,
I’m rather new to mikrotik, this is my very first question in this forum. I want to route http traffic to a transparent Squid proxy with the original ips. My aproach for this is to mark traffic in the prerouting chain. The problem I got is that when I add a layer7 protocol filter in the prerouting chain the marked traffic, although it is corrected routed, it gets source natted.
The configuration was not fully setup by me, it was already running. I just added the DNS traffic redirection to a Unbound cache and the load balancing over two WANs.
Here I post the pertinent parts of the configuration.
Squid is on 10.0.0.4, 172.16.0.0/24 network if for Squid and Unbound traffic out. 10.60.0.0/16 network is behind another device and it’s traffic gets forwarded to the Mikrotik and it comes in through the LANbridge.
/interface bridge
add name=LANbridge
/interface ethernet
set [ find default-name=ether1 ] name=WAN
set [ find default-name=ether3 ] name=WAN1
set [ find default-name=ether4 ] master-port=ether2
set [ find default-name=ether7 ] master-port=ether6
set [ find default-name=ether8 ] master-port=ether6
/ip firewall layer7-protocol
add name=http regexp="http/(0\\.9|1\\.0|1\\.1) [1-5][0-9][0-9] [\\x09-\\x0d -~]*(connection:|content-type:|content-length:|date:)|post [\\x09-\\x0d -~]* http/[01]\\.[019]"
/interface bridge port
add bridge=LANbridge interface=ether2
add bridge=LANbridge interface=ether6
/ip address
add address=10.0.0.1/24 interface=LANbridge network=10.0.0.0
add address=190.228.33.202/29 comment=inet interface=WAN network=190.228.33.200
add address=190.228.33.205/29 comment=nat interface=WAN network=190.228.33.200
add address=172.16.0.1/24 interface=ether5 network=172.16.0.0
/ip dhcp-client
add add-default-route=no dhcp-options=hostname,clientid disabled=no interface=WAN1 use-peer-dns=no use-peer-ntp=no
/ip firewall mangle
add action=mark-connection chain=prerouting dst-port=80 in-interface=LANbridge layer7-protocol=http new-connection-mark=http protocol=tcp src-address=10.60.0.0/16
add action=mark-routing chain=prerouting connection-mark=http in-interface=LANbridge new-routing-mark=http passthrough=no protocol=tcp src-address=10.60.0.0/16
add action=mark-connection chain=prerouting connection-mark=no-mark connection-state=new in-interface=LANbridge new-connection-mark=odd nth=2,1 protocol=tcp
add action=mark-routing chain=prerouting connection-mark=odd in-interface=LANbridge new-routing-mark=odd passthrough=no protocol=tcp
add action=mark-connection chain=prerouting connection-mark=no-mark connection-state=new in-interface=LANbridge new-connection-mark=odd nth=5,1 protocol=tcp
add action=mark-routing chain=prerouting connection-mark=odd in-interface=LANbridge new-routing-mark=odd passthrough=no protocol=tcp
add action=mark-connection chain=prerouting connection-mark=no-mark connection-state=new in-interface=LANbridge new-connection-mark=even protocol=tcp
add action=mark-routing chain=prerouting connection-mark=even in-interface=LANbridge new-routing-mark=even passthrough=no protocol=tcp
add action=passthrough chain=postrouting disabled=yes dst-port=80 layer7-protocol=http protocol=tcp src-addr
/ip firewall nat
add action=src-nat chain=srcnat out-interface=WAN src-address=172.16.0.0/24 to-addresses=190.228.33.205
add action=src-nat chain=srcnat out-interface=WAN src-address=10.0.0.0/24 to-addresses=190.228.33.202
add action=masquerade chain=srcnat out-interface=WAN1 routing-mark=odd src-address=10.60.0.0/16
add action=src-nat chain=srcnat out-interface=WAN src-address=10.60.0.0/16 to-addresses=190.228.33.205
add action=dst-nat chain=dstnat dst-port=53 in-interface=LANbridge protocol=udp src-address=10.60.0.0/16 to-
add action=dst-nat chain=dstnat dst-port=8022 in-interface=WAN protocol=tcp to-addresses=10.0.0.3 to-ports=2
add action=dst-nat chain=dstnat dst-port=4080 in-interface=WAN protocol=tcp to-addresses=10.0.0.3 to-ports=8
add action=dst-nat chain=dstnat dst-port=4023 in-interface=WAN protocol=tcp to-addresses=10.0.0.2 to-ports=2
/ip route
add distance=1 gateway=10.0.0.4 routing-mark=http
add distance=1 gateway=192.168.1.1 routing-mark=odd scope=255
add distance=1 gateway=190.228.33.201 routing-mark=even scope=255
Thanks in advance to anyone who takes the time to read my question.
Hope someone can explain me why it doesn’t work as I expect it to.
Regards.