a) You are redirecting to port 800. Is that a typo?
b) Packets can only have one packet mark. Are you overwriting the http_conn mark? Your mangle rules don’t ever show that mark being applied.
c) Once you proxy chains change, and there are two connections instead of just one. The second connection from the router proxy process does not inherit packet marks.
d) Be careful not to set routing marks on that traffic as it interferes with the redirect.
ip firewall mangle print>
3 X ;;; Mark 80 TCP Connection for proxy
chain=prerouting action=mark-connection new-connection-mark=http_conn passthrough=no protocol=tcp dst-port=80
But does exist any way to do traffic/bandwidth optimization and transparent proxy?
The two as such are completely independent of one another, so generally speaking: yes. Even when you add a proxy there are still IP packets, so you can manipulate them.
You have an error in your configuration. If you need help troubleshooting it you’ll have to post the entire ruleset, and you will have to explain what you mean when you say “traffic/bandwidth optimization” and what you are trying to achieve.
I am trying to mangle with prerouting packets and than to give priority to queue tree.
Also must mangle prerouting tcp port 80 connection for than redirect that to port 800 (port of proxy).
But in this way does not work. Does exist any other way to do so?
Config:
ip firewall mangle print>
;;; Download All
chain=prerouting action=mark-packet new-packet-mark=all_dw passthrough=yes in-interface=!Local
ip queue tree pr>
name="Download_All_New" parent=global-in packet-mark=all_dw limit-at=0 priority=1 max-limit=3M burst-limit=0
burst-threshold=0 burst-time=0s
name="Prio2" parent=Download_All_New packet-mark=prio2_ABCom limit-at=2M queue=default priority=2 max-limit=3M
burst-limit=0 burst-threshold=0 burst-time=0s
So, I have separated LAN on 2 pieces, one piece route to one gateway and other piece to other 2nd gateway. But I want to
do transparent web proxy also.
Pls, I need any idea on how may will be it possible.
In prerouting add rules before the routing marks that match the same traffic as the rule that will redirect in the proxy and have an action of ‘accept’. Now that traffic won’t get a routing mark and goes to the proxy as it is exempt
If you need to add routing marks to the traffic from the proxy to the Internet you can add them in the output mangle chain instead of prerouting. If you need to match reliably for traffic coming from the proxy only (and not other router processes) you can create a mock loopback interface by creating a bridge and adding to ports to it, and assigning an IP address to that loopback interface (can be a /32). You can then use that IP as the source address in the proxy configuration, and match in the output mangle chain based on source address. You have to make sure your WAN source NAT rules include that loopback IP, of course.
But I want a solution that ‘Group IP A’ of LAN to connect with ISP1 and ‘Group IP B’ of LAN to connect with ISP2 via Mikrotik Router with buildin Web Proxy (traffic must not bypassing proxy).
Is it possible to separate traffic based on source IP address after proxy?
The proxy builds a completely new connection out to the WAN, that connection has absolutely nothing to do - from a routing point of view - with the initial client request. There are no provisions in the built in web proxy to apply any marking to the WAN connection it builds based on the original client request, so in the output mangle queue you are unable to determine whether the original client request came from group A or group B.
Because proxies take the ONE original connection and make it TWO: client to server becomes client to proxy and proxy to server. If you have no way to determine in the mangle rules what the client IP was in the unrelated client to proxy connection (and I know of no way to do that), you cannot make routing decisions based on that information when mangle is looking at the proxy to server connection.
Maybe squid has something built in that lets you do that, I am not a squid expert.
Are enough this 2 rules below for doing config like on attached picture (clients and Squid proxy are on the same subnet and squid will not serve as parent proxy for mikrotik web proxy):
ip firewall nat>print
2 X ;;; To Squid
chain=dstnat action=dst-nat to-addresses=192.168.12.66 to-ports=3128 protocol=tcp src-address=192.168.12.0/24 dst-port=80
3 ;;; To Squid
chain=dstnat action=accept protocol=tcp src-address=192.168.12.66 dst-address=!192.168.12.66 dst-port=80
