5

The RouterOS docs show how to transparently proxy all web traffic via the HTTP proxy built into RouterOS:

/ip firewall nat 
add in-interface=ether1 dst-port=80 protocol=tcp action=redirect to-ports=8080 chain=dstnat 
/ip proxy
set enabled=yes port=8080

I'd like to run a proxy on another machine, so that I can take advantage of more sophisticated filtering rules available in Squid or the like. However, if I use NAT to redirect traffic to another machine running Squid it won't work, since the HTTP request will need to be rewritten in order to be a proxy HTTP request; just redirecting the traffic gives bad request errors from Squid.

3 Answers 3

4

No need of setting proxy in RouterOS. You can route all outgoing HTTP traffic to the server directly thru NAT:

ip firewall nat add in-interface=eth1 src-address=!<IP of Squid machine> dst-port=80 protocol=tcp action=dst-nat to-addresses=<IP of Squid machine> to-ports=8080 

The last parameter "src-address=!..." is needed in case which squid machine communicates thru same interface as the other machines. Otherwise it would go like this:

  1. Computer sends HTTP request
  2. RouterOS destinates this packet to squid
  3. Squid sends HTTP request to webserver
  4. RouterOS destinates squid request again to squid -> loop
2
  • I can do that, but when I originally did it I got Squid bad request errors, which I assumed was down to the fact that it ends up arriving at the Squid with the HTTP request as "GET /bar HTTP/1.1" rather than "GET foo.com/bar HTTP/1.1". I assumed something needed to rewrite the plain HTTP request into a proxy request.
    – Tim
    Sep 16, 2010 at 12:18
  • make sure squid is in "transparent" mode.. which it won't like if you aren't doing NAT on the Squidbox, but it will work.
    – Grizly
    Feb 24, 2013 at 23:25
3

It can be done with the parent-proxy setting:

/ip proxy
set parent-proxy=<IP of Squid machine> parent-proxy-port=3128
2
/ip proxy
set parent-proxy=<IP of Squid machine> parent-proxy-port=3128

/ip firewall nat
chain=dstnat src-address=!<IP of Squid machine> protocol=tcp dst-port=80  src-address-list=<IP of Local machine> action=redirect to-ports=8080

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .