Hi,
I have internet cafe where I have two internet connections. One connection works with proxy, so I have to store proxy in client computers to get the internet running.
The second internet connection does not require proxy. So, when I need to connect the second connection then I have to disable proxy from all my client computers.
Can you please look at the attached picture. You may understand more from it.
If possible, please provide me with a script.
Thanks
I’m assuming you are doing load balancing then with the two connections?
What you have there is a bit of a complex setup to get what you want, though with the PCC firewall matcher, you should be able to hammer something out.
Basically what you are going to want to do is determine what ratio of traffic you want going out one connection vs the other, and then use NAT rules to redirect connections going out of one link to the proxy.
So lets assume you are doing 2/1 for load balancing with PCC. This will set you up for load balancing across both links.
/ip firewall mangle
add action=mark-connection chain=prerouting connection-state=new disabled=no new-connection-mark=outside1_connection passthrough=yes per-connection-classifier=both-addresses:3/0 src-address-list=Local_NAT_Network
add action=mark-connection chain=prerouting connection-state=new disabled=no new-connection-mark=outside1_connection passthrough=yes per-connection-classifier=both-addresses:3/1 src-address-list=Local_NAT_Network
add action=mark-connection chain=prerouting connection-state=new disabled=yes new-connection-mark=outside2_connection passthrough=yes per-connection-classifier=both-addresses:3/2 src-address-list=Local_NAT_Network
add action=mark-routing chain=prerouting connection-mark=outside1_connection disabled=no new-routing-mark=to_outside1 passthrough=yes src-address-list=Local_NAT_Network
add action=mark-routing chain=prerouting connection-mark=outside2_connection disabled=no new-routing-mark=to_outside2 passthrough=yes src-address-list=Local_NAT_Network
Then you have to start using the transparent proxy on the link that you want. The best way to do this is by using NAT rules to redirect people transparently to your proxy, so they aren’t even aware that they are using it. It is very important that you use the same PCC classifiers and values that you do in mangle as in NAT so that they hash to the same value.
/ip firewall nat
add action=dst-nat chain=dstnat disabled=no dst-address-type=!local dst-port=80 hotspot=auth in-interface="LAN" protocol=tcp src-address="LAN SUBNET" to-ports=8080 to-address="PROXY IP ADDRESS" per-connection-classifier=both-addresses:3/0
add action=dst-nat chain=dstnat disabled=no dst-address-type=!local dst-port=80 hotspot=auth in-interface="LAN" protocol=tcp src-address="LAN SUBNET" to-ports=8080 to-address="PROXY IP ADDRESS" per-connection-classifier=both-addresses:3/1
add action=accept chain=dstnat disabled=no dst-address-type=!local dst-port=80 hotspot=auth in-interface="LAN" protocol=tcp src-address="LAN SUBNET" per-connection-classifier=both-addresses:3/2
This way you get load balancing, and only one of the two links will use a transparent proxy for web traffic.
If you just wanted simple failover, then you would want to use scripts that would enable/disable the NAT rules for you.
I don’t want to balance these connections.
I will only use one connection at a time.
Then set up a NAT rule that you will enable when you unplug a port, or enable the NAT rule with a script on a link failure. Just modify the NAT rule to fit into your situation.
Okay, Now I have configured a simple router. Now how do I redirect clients through proxy? Give me script.
I want to put the following proxy in between ‘WAN 1’ and ‘LAN’.
proxy address = proxy.isec.ae
port = 8088
Thanks
On the first router add redirect rules for traffic you want to proxy to be rerouted to port 8080, e.g. port 80 for any destination needs to go to your routers LAN IP to port 8080
The second router you should setup as required to provide internet access without proxy.
Now you can choose the configuration by setting the default gateway on the computers to one router or the other.
See also
http://forum.mikrotik.com/t/routeros-v5-1-transparent-proxy/56348/1
I have configure proxy using the following script, but now I want this proxy in between WAN 1 and LAN.
Please guide me on how to bypass WAN2 to LAN without using proxy?
/ip firewall nat
add chain=dstnat action=redirect to-ports=8080 protocol=tcp dst-port=80
/ip proxy
enabled: yes
src-address: 0.0.0.0
port: 8080
parent-proxy: 213.42.21.101
parent-proxy-port: 8088
cache-administrator: Admin
max-cache-size: none
cache-on-disk: no
max-client-connections: 600
max-server-connections: 600
max-fresh-time: 3d
serialize-connections: no
always-from-cache: no
cache-hit-dscp: 4
cache-drive: system
Thanks
I would sugest this approach:
Add 1 rule for each computer:
/ip firewall nat add chain=dstnat action=redirect to-ports=8080 protocol=tcp dst-port=80 src-address=192.168.1.1
/ip firewall nat add chain=dstnat action=redirect to-ports=8080 protocol=tcp dst-port=80 src-address=192.168.1.2
…and so on
Now force the local http from proxy to use wan1:
First mark the packets:
/ip firewall mangle add action=mark-routing chain=output dst-port=80 new-routing-mark=PROXIED passthrough=yes protocol=tcp
And then define a gateway for them:
/ip route add 0.0.0.0/0 gateway=wan1 routing-mark=PROXIED
Set the default gateway to wan2:
/ip route add 0.0.0.0/0 gateway=wan2
Now all that passes the proxy will go out via wan1, anything else via wan2.
You just have to enable/disable the redirect firewall routes for the needed computers which is done easy using Winbox or the web interface.
All computers with enabled redirect will go via proxy and wan1, the others directly via wan2.
My proxy requires authentication.
Does this type of proxy works with mikrotik?
You probably mean that your parent proxy needs authentication.
Transparent proxies can not use authentication (because they are… duh… transparent).
AFAIK RouterOs can not do that.