Hello

now i use squid, and use diferent external ip for diferent internal network.

ej 192.168.10.0/ 24 nat -} 200.30.45.10
192.168.11.0/ 24 nat -} 200.30.45.11
192.168.12.0/ 24 nat -} 200.30.45.12

and rules in squid to do same external ip for corresponding internal.

i want to use mikrotik with webproxy, but can´t find the rule for diferent external ip.

can help me? without this, vatious sites with ssl can´'t authenticate the user out in http with webproxy ip and in https with nat ip (diferent) and cause error login

nobody uses a similar setup and found this problem?

is posible? imposible?

rules for diferent output address in webproxy?

any opinion?

Well this is interesting question!

When you use web-proxy packets will NOT originate from 192.168.10.0/ 24 , 192.168.11.0/ 24, 192.168.12.0/ 24, but will originate from the router itself - so there are no way how you can distinguish one subnet's request from another....

But you can create a src-nat rule to masquerade all packets on the interface - that might help

i use src-nat... and work well
different internal subnet have different external ip
, but when redirect to proxy on mtik, all http traffic have the same ip..
in my testing, now using parent proxy (squid) and using on it tcp_outgoing address + src_as rule, can modifi external for different internal subnet.

but that would be interesting Mikrotik incorporate this feature, for use only internal proxy, being able to go out with the same ip in the proxy leaving the other connections src-nat

I have this same issue, have High end server with 4gb ram and two high capacity SATA drives one was intended for webproxy.

On this server I have all internal (private subnets) traffic going out one public IP but also have about 30 NAT's in place for certain customers, so they have their own dedicated public IP's, once I switch on the proxy redirect rule the 30 NAT addresses stop applying to http bound traffic, SSH, telnet, https etc are all fine but port 80 defaults to the main address and I can't have this, I understand reasoning behind this based on above thread but has anyone found a workaround, have spent a lot on server and would be silly now to have to ignore proxy feature and buy 2nd machine as proxy and redirect to this, really need it all to work on the one machine,

Any help greatly appreciated, thanks

Hi,

I had run into similar situations as you have, and have found my solution (as you've mentioned) in a 2 box setup with 1 box running MT and 1 box running squid. In my testing while I was setting this up, the following is important:

1. MT box is not good at handling proxy for "very large" (I had 800+ users back then) users, even with 2nd HDD.
2. Separate squid also gives more control on server features and is interesting to use.

No we have 4,000+ users. Our original separate proxy server had Core 2 Duo (more than 2 procs doesn't help squid) with 8 GB RAM and 1 x 80 GB IDE HDD as OS Drive, and 4 x 160 GB SATA (64 GB as cache_dir on each). This server also maxed out at 2000+ users, on a 30 Mbps link. Now we have another proxy server with same configuration, and peered as sibling to each other. Mikrotik is configured to send the users to these servers depending on the IP block they come from.

We have around 20% of BW savings.

Regards
HASSAN