Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

The RouterOS docs show how to transparently proxy all web traffic via the HTTP proxy built into RouterOS:

/ip firewall nat 
add in-interface=ether1 dst-port=80 protocol=tcp action=redirect to-ports=8080 chain=dstnat 
/ip proxy
set enabled=yes port=8080

I'd like to run a proxy on another machine, so that I can take advantage of more sophisticated filtering rules available in Squid or the like. However, if I use NAT to redirect traffic to another machine running Squid it won't work, since the HTTP request will need to be rewritten in order to be a proxy HTTP request; just redirecting the traffic gives bad request errors from Squid.

share|improve this question

No need of setting proxy in RouterOS. You can route all outgoing HTTP traffic to the server directly thru NAT:

ip firewall nat add in-interface=eth1 src-address=!<IP of Squid machine> dst-port=80 protocol=tcp action=dst-nat to-addresses=<IP of Squid machine> to-ports=8080 

The last parameter "src-address=!..." is needed in case which squid machine communicates thru same interface as the other machines. Otherwise it would go like this:

  1. Computer sends HTTP request
  2. RouterOS destinates this packet to squid
  3. Squid sends HTTP request to webserver
  4. RouterOS destinates squid request again to squid -> loop
share|improve this answer
I can do that, but when I originally did it I got Squid bad request errors, which I assumed was down to the fact that it ends up arriving at the Squid with the HTTP request as "GET /bar HTTP/1.1" rather than "GET HTTP/1.1". I assumed something needed to rewrite the plain HTTP request into a proxy request. – Tim Sep 16 '10 at 12:18
make sure squid is in "transparent" mode.. which it won't like if you aren't doing NAT on the Squidbox, but it will work. – Grizly Feb 24 '13 at 23:25
up vote 1 down vote accepted

It can be done with the parent-proxy setting:

/ip proxy
set parent-proxy=<IP of Squid machine> parent-proxy-port=3128
share|improve this answer
/ip proxy
set parent-proxy=<IP of Squid machine> parent-proxy-port=3128

/ip firewall nat
chain=dstnat src-address=!<IP of Squid machine> protocol=tcp dst-port=80  src-address-list=<IP of Local machine> action=redirect to-ports=8080
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.