Hi all,

I need your help to solve my problem. My boss asked me to build proxy server very soon. I am using Mikrotik proxy and do not want to use Squid because I don't know any Linux script.

Please see my attached picture.
My question is:

Is it possible for MIKROTIK AS BRIDGE + INTERNAL PROXY to cache all clients' HTTP request ?
And I want my "Mikrotik Router" do bandwidth shapping, while my "Mikrotik Bridge" ONLY do web caching.

Config in this device are:
/interface bridge add name=bridge1 protocol=none disabled=no
/interface bridge port add interface=ether-to-client bridge=bridge1 disabled=no
/interface bridge port add interface=ether-to-router bridge=bridge1 disabled=no

/interface bridge settings
set use-ip-firewall=yes
use-ip-firewall-for-pppoe=no
use-ip-firewall-for-vlan=no

/ip firewall nat
add action=redirect chain=dstnat comment=Proxy disabled=no dst-port=80 in-interface=bridge1 protocol=tcp to-ports=3128

/ip proxy
set always-from-cache=yes cache-administrator=webmaster cache-hit-dscp=20
cache-on-disk=yes enabled=yes max-cache-size=200000000KiB
max-client-connections=5000 max-fresh-time=3d max-server-connections=5000
parent-proxy=0.0.0.0 parent-proxy-port=0 port=3128
serialize-connections=yes src-address=0.0.0.0

/ip dns
set allow-remote-requests=no cache-max-ttl=1w cache-size=2048KiB
max-udp-packet-size=512 primary-dns=0.0.0.0 secondary-dns=0.0.0.0


HTTP down (cannot browsing) when I am using that topology and configs
If I disabled DST-NAT to 3128, HTTP is up and normal.
Please show me where is my mistake ?

Thanks in advanced.

Regards,
YUJOBIKA

No one can help me ?
Please.....

36 users view this post, and no one can help me ?
I wonder...does Mikrotik support proxy in bridging ?

is your bridge allowed to access the Internet on your router?

Yes, from my bridge I can ping and traceroute to internet.

I still need someone who can help me
Please...

Intresting
i am not test in MT . i used Linux+squid instead of MT and its work for me. The problem was same as you facing in MT. Add the ip addresses and gateway on bridge interface. the ip range must be your client using. e.g 192.168.1.254/24 gw 192.168.1.1 .

Intresting
i am not test in MT . i used Linux+squid instead of MT and its work for me. The problem was same as you facing in MT. Add the ip addresses and gateway on bridge interface. the ip range must be your client using. e.g 192.168.1.254/24 gw 192.168.1.1 .

Thanks for reply, pokeman

If I add the ip addresses and gateway on bridge interface (in Mikrotik Bridge), so all traffic shapping will be done in Mikrotik Bridge, right ? And I won't like this.

I want all traffic shapping done in Mikrotik Router. And Mikrotik Bridge only do caching.

Please advice.

In your dst-nat rule, try using "in-bridge-port" (ethernet facing router).

The bridge will only shape traffic traffic if you have it configured to.

If it were me, I might put my dst-nat rule on the router pointing to the proxy bridge.....well actually, I'd run proxy on the router....unless it doesn't have the horsepower and disk space.

In your dst-nat rule, try using "in-bridge-port" (ethernet facing router).

The bridge will only shape traffic traffic if you have it configured to.

If it were me, I might put my dst-nat rule on the router pointing to the proxy bridge.....well actually, I'd run proxy on the router....unless it doesn't have the horsepower and disk space.

Hi Aug,

Thanks for your advice.
But if I put my dst-nat rule on the router pointing to the proxy bridge, all of my clients will using default route. Seems your advice could not work for multiple gateway.

My bad..looked at the picture backwards. Thought it was clients--router--bridge--wan

I think because your gateway is behind the bridge you will have difficulty doing it transparently except by redirecting it back using a firewall rule on the gateway router. That seems a bit inefficiant since it's sat before the router from the clients perspective. For it to be transparant you will need to run the proxy rule on the gateway redirecting port 80 to the port and IP of the proxy. It will work but slighty odd setup I think. Could you run web proxy on the router? Maybe beef up the hardware a bit.

I think because your gateway is behind the bridge you will have difficulty doing it transparently except by redirecting it back using a firewall rule on the gateway router. That seems a bit inefficiant since it's sat before the router from the clients perspective. For it to be transparant you will need to run the proxy rule on the gateway redirecting port 80 to the port and IP of the proxy. It will work but slighty odd setup I think. Could you run web proxy on the router? Maybe beef up the hardware a bit.

Hi spire2z,

Thanks for your reply.

I put my "mikrotik bridge + web proxy" before "mikrotik router" because my topology is multiple gateway. If I only use "mikrotik router + web proxy", without "mikrotik bridge" in the middle, seems impossible since mikrotik proxy does not support multiple gateway.

If I run the proxy rule on the gateway redirecting port 80 to the port and IP of the proxy....I tried too and all of my clients will always use WAN1 (my default gateway). So this way, also multiple gateway does not work.

Hi,

Please help me
where is my mistake ? I still need to solve this problem.

Regards

still waiting answer from all of you

Suggestion.
Replace the switch with an RB450 or similar.
From there you can redirect the packets to the proxy-bridge.

Suggestion.
Replace the switch with an RB450 or similar.
From there you can redirect the packets to the proxy-bridge.

Thanks Aug,

But I could not replace switch with RB or PC with ROS because actually those are 2 X 48 port switch (un-manageable switch).

I believe, "Mikrotik as bridge" can cache HTTP, because Mikrotik's document said so. But I don't know how to configure it

Hi,
Brother my english is not good but i can give you a idia, i think is working 100%
first: don't use bridge-router as a bridge mod, you need to use brige-router as a gatway but with live IP concept (IP Passthrough) and through all clint to man router with original ip but not just port 80
like that http://wiki.mikrotik.com/wiki/Live-IP-C ... riginal_ID
&
just chang, bypass all ip traffic but not port 80 !Dst Port 80 Protocol tcp

Thanks Muhammad
I will try your idea and will let you know the result.

Hi Muhammad,

I have tried your idea, I already "mark route" the traffic, but the traffic always go through "default gateway" of my bridge. So my router could not shapping my client's IP, because the router see my Proxy's IP

Please help me.

Thanks in advance.

Hi Muhammad,

I have tried your idea, I already "mark route" the traffic, but the traffic always go through "default gateway" of my bridge. So my router could not shapping my client's IP, because the router see my Proxy's IP

Please help me.

Thanks in advance.

Hi,
ok explain you how can you do it!
First I lay your Network Again hare Now Your Router is a Transparent-Router/ Transparent Firewall
Next you need to do Web-Proxy Turned ON
Now you have 2 ways to do this
1st) you can change Mangle-Rules in Clint-Proxy-Router (Protocol TCP Dst-Port !80)
2nd) Do not change any thing in Mangle-Rules in Clint-Proxy-Router but add some rules in Gateway-Router Firewall NAT
Like:
/ip firewall nat add chain=dstnat dst-address=0.0.0.0 src-address=192.168.1.0/24 protocol=tcp dst-port=80 action=dst-nat to-addresses=192.168.200.2 to-ports=80
/ip firewall nat add chain=dstnat dst-address=0.0.0.0 src-address=172.16.1.0/24 protocol=tcp dst-port=80 action=dst-nat to-addresses=192.168.200.2 to-ports=80
/ip firewall nat add chain=dstnat dst-address=0.0.0.0 src-address=10.0.1.0/24 protocol=tcp dst-port=80 action=dst-nat to-addresses=192.168.200.2 to-ports=80

just turned on web-proxy on port 80 at your clint-router

WOW !!! Thanks Muhammad

Great tutorial ! I will try again tonight.
100000x thanks Muhammad.

Dear Muhammad,

You said I have to choose only 1 way.

First way: you can change Mangle-Rules in Clint-Proxy-Router (Protocol TCP Dst-Port !80)
OR
Second way: Do not change any thing in Mangle-Rules in Clint-Proxy-Router but add some rules in Gateway-Router Firewall NAT

For First way, it does not work.
For Second way, IT WORK !!!

But I prefer First way, because Second way seems have looping traffic.

In the First way, my problem is HTTP could not redirect to proxy. How to redirect it ? Because you said I must not use NAT.

Thanks brother.

for 2nd way you have to set up correct NAT rule, so traffic is not looped, set, for example, src-address that can be directed to proxy using your NAT rule.

for 2nd way you have to set up correct NAT rule, so traffic is not looped, set, for example, src-address that can be directed to proxy using your NAT rule.

You mean set NAT in "Gateway Router" or in "Client Proxy Router" ?

Thanks

client proxy

if you want transparently (without configuration on client PC) to forward requests to proxy you set up simple rule in firewall nat and better use routing

hi i tried do this in my network bu dont work .any one can help me?