1

I have installed squid proxy server to hide our network ips after some time it becomes slow then I read through NAT rules to achieve what I want by proxy server. As per this link the difference between NAT and proxy server is the way they handle nos of user. We are totally 8 people and our leased line internet speed is 2Mbps.

Suggest me should I improve the squid proxy server or just implement NAT rule in mikrotik router?

Additional info

Separate old machine for squid proxy server which has ubuntu server with 1280 MB RAM, 80GB Harddisk and Pentium 4(2.40Hz).

Mikrotik router to divert the traffic from my network to proxy server.

2 Answers 2

5

the difference between NAT and proxy server is the way they handle nos of user

Actually, the difference is they are almost totally different solutions.

NAT is a Layer 3/4 solution that was invented as a hack solution to the exhaustion of IPv4 addresses. It was never meant to be a security or "proxy" solution. All it does is change one address of the packet (either destination address, or in your use-case the source address) and then the kernel tracks which streams (and corresponding packets) have had NAT applied so it can "undo" the address replacement on the return packets. NAT requires no configuration on the clients beyond setting the appropriate gateway in the routing table. Operating at Layer 3 and 4 means that NAT can be applied to any IP connection regardless of the higher protocols, although can break some less common protocols.

Proxy is a Layer 7 solution that can perform much more in depth inspection of requests and provide things like caching, filtering (either policy and/or virus scanning etc), as well as "masking" the source address of the original request (although many HTTP proxy servers will add an X-Forwarded-For header to the HTTP request with the address of the original client). A proxy server generally requires the client to be configured to use the proxy, although there are some hacks to make "Transparent" proxy configurations, it tends to work better IME if the client actually knows it is supposed to use the proxy. Finally, operating at Layer 7, you need a proxy for each protocol you want to proxy - for example, you need separate HTTP/HTTPS and SMTP/POP3 proxies (these can be on the same hardware, but are different software packages with separate configurations)

NAT is less resource intensive and simpler to configure than Proxy servers, but Proxy servers are generally more powerful and flexible.

We are totally 8 people and our leased line internet speed is 2Mbps.

For 8 people, utilizing NAT would generally be sufficient. However with only a 2Mbps connection, you may see benefits in having a Proxy server that can cache content to reduce bandwidth use.

0

For 8 people I would go NAT. With proxy you have more options for placing filters/policies etc, you can safely allow ports other than 80 and 443, you can cache but you also add some latency. I don't thing that the benefits justify the burden of managing another server.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .