Transparent proxy configuration - standalone proxy server

RouterOS General
1

I have the following configuration:

MIKROTIK LAN IP: 192.168.0.1
MIKROTIK WAN IP: 213...182
Mikrotik is doing NAT for local network

Squid proxy is on different server (Squid 2.6 on Solaris 10)

PROXY LAN IP: 192.168.0.2
PROXY WAN IP: 213...181

Now, I need Mikrotik to redirect HTTP traffic to this proxy server, i’ve put the following configuration on mikrotik but it is not working:

add chain=dstnat protocol=tcp dst-port=80 action=dst-nat to-addresses=192.168.0.2 to-ports=8001

Do I need to setup something else on Mikrotik / proxy server (maybe also configure NAT in ipfilter on proxy server), i am very confused :frowning: ?

2

I’m not entirely sure of this setup as I haven’t used anything like this in a while, but if you redirect traffic from .1 to .2, shouldn’t you have a rule saying that .2 is allowed to get out without being forwarded back to itself? :slight_smile:

add chain=dstnat protocol=tcp src-address=!192.168.0.2 dst-port=80 action=dst-nat to-addresses=192.168.0.2 to-ports=8001

Secondly, if the devices that are supposed to be receiving data from the proxy are on the same network, there may be some issues with triangular routing.

PC—>mikrotik—>proxy---->mikrotik—>internet—>mikrotik—>proxy—>PC
at this point the PC would get confused as its receiving a response back from 192.168.0.2 when it requested it via 192.168.0.1

Someone please correct me if I’m wrong, as I said haven’t used this setup in a long time.

3

you cannot simply dst-nat to the same subnet as src-address. you need the packets to return via the router, not directly from proxy machine to client

as a workaround, you may use RouterOS Web Proxy w/o cache, and set parent-proxy = your squid machine

4

Yes, but if I use this configuration, squid machine see incoming packets from Mikrotik IP, not original IP (I need this because of squidGuard, and monitoring). Is it possible to override this issue?

5

Just put the squid machine in a different network range to the computers. It can even be on the same port, just add a second ip address (say 192.168.1.1/24) to the mikrotik and make the proxy 192.168.1.2 and have mikrotik dst-nat the traffic to that instead.

Make sure you setup a nat rule for the 192.168.1.0/24 range thou :slight_smile:

6

You can also check these out.

http://wiki.mikrotik.com/wiki/Open_source_caching_server

http://wiki.mikrotik.com/wiki/Examples_for_Use_Caching_Server_(5_Main_Idea’s)

7

Ok, I’ll try these configurations. The last resort is to block outgoing port 80, and enter proxy manually to every user. My company is not too big, so it can also be solution. Thanks to everyone!