Community discussions

 
Madrox
Frequent Visitor
Frequent Visitor
Topic Author
Posts: 80
Joined: Mon Sep 03, 2007 12:24 am

Mikrotik, squid and tproxy

Sun Apr 11, 2010 1:08 am

Hello, I have a problem making an trancparent proxy whit tproxy working whit mikrotik.
Have read mutch about how to do it, but can't get it to work.
Everybody use the proxy as a brigde, but i se this ass one more point that can make everything to go down.
So what i want is to use it on core switch, whit one NIC.

Is it sombody here that have done this?

Im surce that i have to send all the port 80 from core router to proxy
but want then?
You do not have the required permissions to view the files attached to this post.
 
Madrox
Frequent Visitor
Frequent Visitor
Topic Author
Posts: 80
Joined: Mon Sep 03, 2007 12:24 am

Re: Mikrotik, squid and tproxy

Wed Apr 14, 2010 9:37 pm

edit. bump
 
User avatar
Chupaka
Forum Guru
Forum Guru
Posts: 8140
Joined: Mon Jun 19, 2006 11:15 pm
Location: Minsk, Belarus
Contact:

Re: Mikrotik, squid and tproxy

Wed Apr 21, 2010 5:41 pm

this picture is very interesting (oh, seems like Malevich's Black Squares :) )

but there's lack of detailed info like addresses. and what is 'PTP' boxes? and where's RouterOS?
Russian-speaking forum: https://forum.mikrotik.by/. Welcome!

For every complex problem, there is a solution that is simple, neat, and wrong.

MikroTik. Your life. Your routing.
 
gmidia
Member Candidate
Member Candidate
Posts: 223
Joined: Sun Sep 02, 2007 3:28 pm

Re: Mikrotik, squid and tproxy

Wed Apr 21, 2010 8:12 pm

where is your mikrotik box? and how is placed in relation to the squid server? what are the ips on the squid, mikroitik etc
 
leemarven
just joined
Posts: 3
Joined: Tue Feb 15, 2011 3:54 pm

Re: Mikrotik, squid and tproxy

Tue Feb 15, 2011 4:21 pm

squidbox: 192.168.0.254
clients: 192.168.0.2-192.168.0.253
mikrotik: 192.168.0.1

squidbox running tproxy.

http request clients-> mikrotik -> squidbox -> mikrotik -> www
http reply www-> mikrotik -> squidbox -> mikrotik -> clients.

but i'm not sure how to voodoo in mangle :D
 
jtroybailey
Member Candidate
Member Candidate
Posts: 176
Joined: Thu Oct 07, 2010 10:24 am
Location: Brisbane, Australia

Re: Mikrotik, squid and tproxy

Tue Feb 15, 2011 4:28 pm

i would split up the network to start with. EG:

Clients: 172.19.64.0/24
Network Devices: 172.19.65.0/24

That will let you firewall better and set the nat rules better. then you would add something like:
/ip firewall nat
add action=dst-nat chain=dstnat disabled=no dst-port=80 in-interface=ether3 protocol=tcp to-addresses=172.19.65.10 to-ports=3128
eth3 being the interface the clients are on and 172.19.65.10 being the squid proxy
 
leemarven
just joined
Posts: 3
Joined: Tue Feb 15, 2011 3:54 pm

Re: Mikrotik, squid and tproxy

Tue Feb 15, 2011 4:41 pm

i would split up the network to start with. EG:

Clients: 172.19.64.0/24
Network Devices: 172.19.65.0/24

That will let you firewall better and set the nat rules better. then you would add something like:
/ip firewall nat
add action=dst-nat chain=dstnat disabled=no dst-port=80 in-interface=ether3 protocol=tcp to-addresses=172.19.65.10 to-ports=3128
eth3 being the interface the clients are on and 172.19.65.10 being the squid proxy
your talking about intercept proxy using DNAT
 
jtroybailey
Member Candidate
Member Candidate
Posts: 176
Joined: Thu Oct 07, 2010 10:24 am
Location: Brisbane, Australia

Re: Mikrotik, squid and tproxy

Wed Feb 16, 2011 6:01 am

i would call it transparent proxy and yes, using dst-nat.
 
leemarven
just joined
Posts: 3
Joined: Tue Feb 15, 2011 3:54 pm

Re: Mikrotik, squid and tproxy

Wed Feb 16, 2011 6:11 am

i would call it transparent proxy and yes, using dst-nat.
maybe you don't have any idea about tproxy.
tproxy is spoofing clients ip in which the web server would see clients IP NOT squidbox.

im using http_port 3128 transparent tproxy

yours is http_port **** transparent
 
User avatar
Chupaka
Forum Guru
Forum Guru
Posts: 8140
Joined: Mon Jun 19, 2006 11:15 pm
Location: Minsk, Belarus
Contact:

Re: Mikrotik, squid and tproxy

Fri Feb 18, 2011 5:38 pm

try that:
/ip route add gateway=squid_ip routing-mark=tproxied
/ip fi man add chain=prerouting protocol=tcp port=80 src-mac-address=!squid_mac action=mark-routing new-routing-mark=tproxied
Russian-speaking forum: https://forum.mikrotik.by/. Welcome!

For every complex problem, there is a solution that is simple, neat, and wrong.

MikroTik. Your life. Your routing.
 
emanuelmc
just joined
Posts: 1
Joined: Fri Jun 10, 2011 5:19 am

Re: Mikrotik, squid and tproxy

Fri Jun 10, 2011 5:43 am

Hello Chupak
I'm currently using Lusca + tproxy because my users are using fixed ips and valid as there is a need for them to use some services where these services limits the amount User with the same ip eg megaupload!
As I have 4 blocks of ip / 24 decided to allocate a fixed IP to each User!
I'm using slackware 64bit with Lusca tproxy making and using a few rules and marking of packages to make the tproxy work!
I'll put an example:
$ {IPTABLES}-t mangle-N FUN
$ {IPTABLES}-t mangle-to amuse j MARK - set-mark 1
$ {IPTABLES}-t mangle-j ACCEPT to amuse

$ {IPTABLES}-t mangle-A PREROUTING-p tcp-m socket-j FUN
$ {IPTABLES}-t mangle-A PREROUTING-p tcp - dport 80-j TPROXY - tproxy-mark 0x1/0x1 - on-port 3129

ip rule add lookup fwmark 1 100
ip route add local 0.0.0.0 / 0 dev table it 100
And how to use a PPPoE concentrator RB1100!
But I'm wanting to use linux only for tproxy and dns and how to use Mikrotik firewall, qos, pppoe ......
But I need a help on how to do this redirection of Mikrotik for Linux running on tproxy!
The tproxy esa runs on port 3129!
I am very grateful for your help!

Greetings, Emanuel Magalhães Cunha
 
User avatar
Chupaka
Forum Guru
Forum Guru
Posts: 8140
Joined: Mon Jun 19, 2006 11:15 pm
Location: Minsk, Belarus
Contact:

Re: Mikrotik, squid and tproxy

Fri Jun 10, 2011 12:40 pm

just setup policy routing like in my previous post
Russian-speaking forum: https://forum.mikrotik.by/. Welcome!

For every complex problem, there is a solution that is simple, neat, and wrong.

MikroTik. Your life. Your routing.
 
senthil
just joined
Posts: 4
Joined: Fri Jun 17, 2011 7:19 am

Re: Mikrotik, squid and tproxy

Fri Jun 17, 2011 7:38 am

My tproxy setup is as follows.
Webserver(172.16.1.0/24)
|
client(192.168.2.0/24)------Microtik(172.16.1.0/2)-----------------squid tproxy( 192.168.1.0/24)

Squid listens of port 3128 and we need to redirect port 80 traffic from clients to squid proxy in the same port.

The below rule was not doing any redirection so how can i redirect traffic.

/ip route add gateway=squid_ip routing-mark=tproxied
/ip fi man add chain=prerouting protocol=tcp port=80 src-mac-address=!squid_mac action=mark-routing new-routing-mark=tproxied
 
User avatar
Chupaka
Forum Guru
Forum Guru
Posts: 8140
Joined: Mon Jun 19, 2006 11:15 pm
Location: Minsk, Belarus
Contact:

Re: Mikrotik, squid and tproxy

Mon Jun 20, 2011 3:44 pm

/ip fi nat add chain=dstnat protocol=tcp port=80 action=dst-nat to-addresses=squid-address to-ports=3128

make sure you're not masquerading that traffic
Russian-speaking forum: https://forum.mikrotik.by/. Welcome!

For every complex problem, there is a solution that is simple, neat, and wrong.

MikroTik. Your life. Your routing.
 
senthil
just joined
Posts: 4
Joined: Fri Jun 17, 2011 7:19 am

Re: Mikrotik, squid and tproxy

Tue Jun 21, 2011 12:12 pm

/ip fi nat add chain=dstnat protocol=tcp port=80 action=dst-nat to-addresses=squid-address to-ports=3128

make sure you're not masquerading that traffic
Thank you very much sir. I got working with the below rules
/ip route add gateway=squid_ip routing-mark=tproxied
/ip fi man add chain=prerouting protocol=tcp port=80 src-mac-address=!squid_mac action=mark-routing new-routing-mark=tproxied

May i know why we we use "src-mac-address=!squid_mac?". Can we use ip instead of it?,
 
User avatar
Chupaka
Forum Guru
Forum Guru
Posts: 8140
Joined: Mon Jun 19, 2006 11:15 pm
Location: Minsk, Belarus
Contact:

Re: Mikrotik, squid and tproxy

Tue Jun 21, 2011 12:38 pm

you cannot, Layer2 uses MAC addresses; IP addresses are for Layer3
Russian-speaking forum: https://forum.mikrotik.by/. Welcome!

For every complex problem, there is a solution that is simple, neat, and wrong.

MikroTik. Your life. Your routing.
 
nina
Frequent Visitor
Frequent Visitor
Posts: 51
Joined: Sat Jan 29, 2011 1:30 am

Re: Mikrotik, squid and tproxy

Mon Feb 20, 2012 1:12 am

what is the difference between redirect dst nat and static route with mark routing for transparent cacher?

What is better? Because i was used redirection - work very well (squid with one ethernet-transparent)
 
User avatar
Chupaka
Forum Guru
Forum Guru
Posts: 8140
Joined: Mon Jun 19, 2006 11:15 pm
Location: Minsk, Belarus
Contact:

Re: Mikrotik, squid and tproxy

Mon Feb 20, 2012 11:18 am

what is the difference between redirect dst nat and static route with mark routing for transparent cacher?
difference is that when you're doing NAT, it changes dst. ip address; when routed, packet passes unchanged

so, in first case packet is routed to the squid machine due to changed destination, and in second case you route it by policy routing

NAT needs Connection Tracking enabled; when you do plain routing, you don't need ConnTrack
Russian-speaking forum: https://forum.mikrotik.by/. Welcome!

For every complex problem, there is a solution that is simple, neat, and wrong.

MikroTik. Your life. Your routing.
 
nina
Frequent Visitor
Frequent Visitor
Posts: 51
Joined: Sat Jan 29, 2011 1:30 am

Re: Mikrotik, squid and tproxy

Wed Feb 22, 2012 12:06 am

Clear,chupaka

So that mean whatever is putted in squid.conf // squid port tproxy or squid port transparent

Everything depend on if its routed or nated ex. Own ip or router ip
 
nina
Frequent Visitor
Frequent Visitor
Posts: 51
Joined: Sat Jan 29, 2011 1:30 am

Re: Mikrotik, squid and tproxy

Wed Feb 22, 2012 12:06 am

Clear,chupaka

So that mean whatever is putted in squid.conf // squid port tproxy or squid port transparent

Everything depend on if its routed or nated ex. Own ip or router ip
 
User avatar
Chupaka
Forum Guru
Forum Guru
Posts: 8140
Joined: Mon Jun 19, 2006 11:15 pm
Location: Minsk, Belarus
Contact:

Re: Mikrotik, squid and tproxy

Wed Feb 22, 2012 1:47 pm

yes, it's just two different modes

and seems like you can use tproxy together with dst-nat on the router
Russian-speaking forum: https://forum.mikrotik.by/. Welcome!

For every complex problem, there is a solution that is simple, neat, and wrong.

MikroTik. Your life. Your routing.
 
nina
Frequent Visitor
Frequent Visitor
Posts: 51
Joined: Sat Jan 29, 2011 1:30 am

Re: Mikrotik, squid and tproxy

Wed Feb 22, 2012 10:26 pm

Thanks
 
alv1n
just joined
Posts: 6
Joined: Mon Jun 04, 2012 7:45 pm

Re: Mikrotik, squid and tproxy

Mon Jun 04, 2012 7:54 pm

/ip fi nat add chain=dstnat protocol=tcp port=80 action=dst-nat to-addresses=squid-address to-ports=3128

make sure you're not masquerading that traffic
Thank you very much sir. I got working with the below rules
/ip route add gateway=squid_ip routing-mark=tproxied
/ip fi man add chain=prerouting protocol=tcp port=80 src-mac-address=!squid_mac action=mark-routing new-routing-mark=tproxied

May i know why we we use "src-mac-address=!squid_mac?". Can we use ip instead of it?,
I got these working before I changed the clients from static IP to pppoe, and it stopped working, if I disable the src-mac-address it can redirect the packets but arrived at the proxy server as errorneous tcp packets, thus the clients can't browse. And with src-mac-address=!squid_mac it redirects nothing (0 hit).

Mr. Chupaka, please advise..
 
alv1n
just joined
Posts: 6
Joined: Mon Jun 04, 2012 7:45 pm

Re: Mikrotik, squid and tproxy

Mon Jun 04, 2012 8:10 pm

/ip fi nat add chain=dstnat protocol=tcp port=80 action=dst-nat to-addresses=squid-address to-ports=3128

make sure you're not masquerading that traffic
Thank you very much sir. I got working with the below rules
/ip route add gateway=squid_ip routing-mark=tproxied
/ip fi man add chain=prerouting protocol=tcp port=80 src-mac-address=!squid_mac action=mark-routing new-routing-mark=tproxied

May i know why we we use "src-mac-address=!squid_mac?". Can we use ip instead of it?,
I got these working before I changed the clients from static IP to pppoe, and it stopped working, if I disable the src-mac-address it can redirect the packets but arrived at the proxy server as errorneous tcp packets, thus the clients can't browse. And with src-mac-address=!squid_mac it redirects nothing (0 hit).

Mr. Chupaka, please advise..
 
User avatar
Chupaka
Forum Guru
Forum Guru
Posts: 8140
Joined: Mon Jun 19, 2006 11:15 pm
Location: Minsk, Belarus
Contact:

Re: Mikrotik, squid and tproxy

Tue Jun 05, 2012 3:21 pm

try to accept packets with src-mac-address=squid_mac and then mark routing w/o src-mac-address matcher
Russian-speaking forum: https://forum.mikrotik.by/. Welcome!

For every complex problem, there is a solution that is simple, neat, and wrong.

MikroTik. Your life. Your routing.
 
alv1n
just joined
Posts: 6
Joined: Mon Jun 04, 2012 7:45 pm

Re: Mikrotik, squid and tproxy

Tue Jun 05, 2012 3:44 pm

try to accept packets with src-mac-address=squid_mac and then mark routing w/o src-mac-address matcher
Ok, succeed. Thanks a lot.
 
alv1n
just joined
Posts: 6
Joined: Mon Jun 04, 2012 7:45 pm

Re: Mikrotik, squid and tproxy

Thu Jun 14, 2012 7:02 am

Mr. Chupaka, although with the above rules I can successfully redirect the tcp packets to TPROXY, they seems to be very slow, I've analyzed the packets, there are so many TCP Retransmission, TCP DUP Ack, and TCP Lost Segment packets.

Please advise..
 
User avatar
Chupaka
Forum Guru
Forum Guru
Posts: 8140
Joined: Mon Jun 19, 2006 11:15 pm
Location: Minsk, Belarus
Contact:

Re: Mikrotik, squid and tproxy

Thu Jun 14, 2012 7:01 pm

on what part of path do you see those retransmissions? are they absent w/o tproxy?
Russian-speaking forum: https://forum.mikrotik.by/. Welcome!

For every complex problem, there is a solution that is simple, neat, and wrong.

MikroTik. Your life. Your routing.
 
alv1n
just joined
Posts: 6
Joined: Mon Jun 04, 2012 7:45 pm

Re: Mikrotik, squid and tproxy

Sun Jun 17, 2012 9:12 pm

on what part of path do you see those retransmissions? are they absent w/o tproxy?
On paths from clients to origin servers and vice versa. They appear either with or w/o tproxy (no iptables rules to intercept port 80).
 
User avatar
Chupaka
Forum Guru
Forum Guru
Posts: 8140
Joined: Mon Jun 19, 2006 11:15 pm
Location: Minsk, Belarus
Contact:

Re: Mikrotik, squid and tproxy

Mon Jun 18, 2012 6:47 pm

They appear either with or w/o tproxy
then seems like the reason is somewhere else
Russian-speaking forum: https://forum.mikrotik.by/. Welcome!

For every complex problem, there is a solution that is simple, neat, and wrong.

MikroTik. Your life. Your routing.
 
alv1n
just joined
Posts: 6
Joined: Mon Jun 04, 2012 7:45 pm

Re: Mikrotik, squid and tproxy

Mon Jun 18, 2012 9:24 pm

They appear either with or w/o tproxy
then seems like the reason is somewhere else
I'm suspecting the routing / mark-routing process on Mikrotik that caused this problem, since the clients are pppoe-clients and Mikrotik acts as pppoe server and gateway for the clients. AFAIK, pppoe connections have MTU issue, right?

Maybe I should move to tproxy with bridging mode?
But I've tried it once : pppoe clients -- Mikrotik (pppoe server + gateway) --- Linux bridge + tproxy --- via Catalyst VLAN -- core router (also a Mikrotik, RB1000) --- Internet
The proxy can't intercept the http traffic from clients' IPs with ebtables rules.
Was it because the pppoe connections don't have ARP while the bridge is in LAyer2 mode?
Or because I didn't set the bridge ip within the same subnet as client's subnet?
Or maybe because a bridging STP priority problem? (I didn't set the linux bridge's STP priority to be higher than the Catalyst VLAN's priority)

Please advise, thanks in advance.
 
User avatar
Chupaka
Forum Guru
Forum Guru
Posts: 8140
Joined: Mon Jun 19, 2006 11:15 pm
Location: Minsk, Belarus
Contact:

Re: Mikrotik, squid and tproxy

Wed Jun 20, 2012 12:56 am

Maybe I should move to tproxy with bridging mode?
you may try
The proxy can't intercept the http traffic from clients' IPs with ebtables rules.
then it was something wrong with your setup
Was it because the pppoe connections don't have ARP while the bridge is in LAyer2 mode?
no, pppoe was behind the router, squid machine didn't know about that
Or because I didn't set the bridge ip within the same subnet as client's subnet?
I don't know how ho setup ebtables for tproxy, RTFM
Or maybe because a bridging STP priority problem?
STP just disables and enables interfaces, it's not about tproxy, I think
Russian-speaking forum: https://forum.mikrotik.by/. Welcome!

For every complex problem, there is a solution that is simple, neat, and wrong.

MikroTik. Your life. Your routing.
 
ScarlettZoe
just joined
Posts: 2
Joined: Sat Oct 11, 2014 12:33 pm

Re: Mikrotik, squid and tproxy

Thu Jan 14, 2016 8:14 am

Hello, I have a problem making an trancparent proxy whit tproxy working whit mikrotik.
Have read mutch about how to do it, but can't get it to work.
Everybody use the proxy as a brigde, but i se this ass one more point that can make everything to go down.
So what i want is to use it on core switch, whit one NIC.

Is it sombody here that have done this?

Im surce that i have to send all the port 80 from core router to proxy
but want then?

where you see this problem?
 
Zorro
Long time Member
Long time Member
Posts: 676
Joined: Wed Apr 16, 2014 2:43 pm

Re: Mikrotik, squid and tproxy

Thu Jan 14, 2016 9:03 pm

caching its on dedicated proxy outside RB - works also and quite popular.
but apparently thats nearly 1/3 use built-in proxy - solely for access control and filtering(in absence of things/tech/code like zorp - they simply had no other options to ensure that).
as for particular solutions - you can google several (somewhat/partially)obsoleted guides, which can be usable for.
somewhat more complete than thos, if you search carefully:
http://wirelessconnect.eu/articles/mikr ... up_guide/1
https://youtu.be/fVsNdJ2OwPg
and of course, original/genuine wiki part
http://wiki.mikrotik.com/wiki/Manual:IP/Proxy ;)
you can both use meta-spiders/agreggators to search or simply use local search on platform, prefered by you, eg Facebook, linked-in, blogspot, lj, vk and many-many others alike.
for simplicity/learning beenfits, vimeo or yt - may be one of interesting among them.
(try https://www.youtube.com/results?search_ ... +Web+Proxy for example, then. for youtube).

if you had free money/budget - you can simply hire MT-certified/trained Pro's to do this job for you.
 
carryonjutta
just joined
Posts: 2
Joined: Sat Jan 03, 2015 1:42 pm

Re: Mikrotik, squid and tproxy

Tue Jan 19, 2016 7:44 am

Hello, I have a problem making an trancparent proxy whit tproxy working whit mikrotik.
Have read mutch about how to do it, but can't get it to work.
Everybody use the proxy as a brigde, but i se this ass one more point that can make everything to go down.
So what i want is to use it on core switch, whit one NIC.

Is it sombody here that have done this?

Im surce that i have to send all the port 80 from core router to proxy
but want then?

same problem with me please let me know also



-----------------------------------------------------
win-on-slots.com - slots free online

Who is online

Users browsing this forum: pcunite, Wyz4k and 16 guests