Community discussions

MikroTik App
 
marceloru
newbie
Topic Author
Posts: 47
Joined: Tue Jul 08, 2008 12:00 am
Location: Argentina

WEBPROXY with multiple output address

Sat Aug 09, 2008 7:27 pm

Hello

now i use squid, and use diferent external ip for diferent internal network.

ej 192.168.10.0/ 24 nat -} 200.30.45.10
192.168.11.0/ 24 nat -} 200.30.45.11
192.168.12.0/ 24 nat -} 200.30.45.12

and rules in squid to do same external ip for corresponding internal.

i want to use mikrotik with webproxy, but can´t find the rule for diferent external ip.

can help me? without this, vatious sites with ssl can´'t authenticate the user out in http with webproxy ip and in https with nat ip (diferent) and cause error login
 
marceloru
newbie
Topic Author
Posts: 47
Joined: Tue Jul 08, 2008 12:00 am
Location: Argentina

Re: WEBPROXY with multiple output address

Mon Aug 11, 2008 7:56 pm

nobody uses a similar setup and found this problem?
 
marceloru
newbie
Topic Author
Posts: 47
Joined: Tue Jul 08, 2008 12:00 am
Location: Argentina

Re: WEBPROXY with multiple output address

Thu Aug 14, 2008 6:47 am

is posible? imposible?

rules for diferent output address in webproxy?
 
marceloru
newbie
Topic Author
Posts: 47
Joined: Tue Jul 08, 2008 12:00 am
Location: Argentina

Re: WEBPROXY with multiple output address

Tue Aug 19, 2008 6:27 am

any opinion?
 
User avatar
macgaiver
Forum Guru
Forum Guru
Posts: 1732
Joined: Wed May 18, 2005 5:57 pm
Location: Sol III, Sol system, Sector 001, Alpha Quadrant

Re: WEBPROXY with multiple output address

Tue Aug 19, 2008 9:37 am

Well this is interesting question!

When you use web-proxy packets will NOT originate from 192.168.10.0/ 24 , 192.168.11.0/ 24, 192.168.12.0/ 24, but will originate from the router itself - so there are no way how you can distinguish one subnet's request from another....

But you can create a src-nat rule to masquerade all packets on the interface - that might help
With great knowledge comes great responsibility, because of ability to recognize id... incompetent people much faster.
 
marceloru
newbie
Topic Author
Posts: 47
Joined: Tue Jul 08, 2008 12:00 am
Location: Argentina

Re: WEBPROXY with multiple output address

Tue Aug 19, 2008 10:01 am

i use src-nat... and work well
different internal subnet have different external ip
, but when redirect to proxy on mtik, all http traffic have the same ip..
in my testing, now using parent proxy (squid) and using on it tcp_outgoing address + src_as rule, can modifi external for different internal subnet.

but that would be interesting Mikrotik incorporate this feature, for use only internal proxy, being able to go out with the same ip in the proxy leaving the other connections src-nat
 
rickashe
just joined
Posts: 17
Joined: Tue Oct 18, 2005 4:39 pm
Location: Dublin, Ireland

Re: WEBPROXY with multiple output address

Sun Nov 23, 2008 9:48 pm

I have this same issue, have High end server with 4gb ram and two high capacity SATA drives one was intended for webproxy.

On this server I have all internal (private subnets) traffic going out one public IP but also have about 30 NAT's in place for certain customers, so they have their own dedicated public IP's, once I switch on the proxy redirect rule the 30 NAT addresses stop applying to http bound traffic, SSH, telnet, https etc are all fine but port 80 defaults to the main address and I can't have this, I understand reasoning behind this based on above thread but has anyone found a workaround, have spent a lot on server and would be silly now to have to ignore proxy feature and buy 2nd machine as proxy and redirect to this, really need it all to work on the one machine,

Any help greatly appreciated, thanks
 
cartes
newbie
Posts: 41
Joined: Fri Oct 12, 2007 12:23 am

Re: WEBPROXY with multiple output address

Tue Nov 25, 2008 8:36 am

Hi,

I had run into similar situations as you have, and have found my solution (as you've mentioned) in a 2 box setup with 1 box running MT and 1 box running squid. In my testing while I was setting this up, the following is important:

1. MT box is not good at handling proxy for "very large" (I had 800+ users back then) users, even with 2nd HDD.
2. Separate squid also gives more control on server features and is interesting to use.

No we have 4,000+ users. Our original separate proxy server had Core 2 Duo (more than 2 procs doesn't help squid) with 8 GB RAM and 1 x 80 GB IDE HDD as OS Drive, and 4 x 160 GB SATA (64 GB as cache_dir on each). This server also maxed out at 2000+ users, on a 30 Mbps link. Now we have another proxy server with same configuration, and peered as sibling to each other. Mikrotik is configured to send the users to these servers depending on the IP block they come from.

We have around 20% of BW savings.

Regards
HASSAN

Who is online

Users browsing this forum: No registered users and 87 guests