How do I set up RouterOS to use web proxy on another machine?

Question

The RouterOS docs show how to transparently proxy all web traffic via the HTTP proxy built into RouterOS:

/ip firewall nat 
add in-interface=ether1 dst-port=80 protocol=tcp action=redirect to-ports=8080 chain=dstnat 
/ip proxy
set enabled=yes port=8080

I'd like to run a proxy on another machine, so that I can take advantage of more sophisticated filtering rules available in Squid or the like. However, if I use NAT to redirect traffic to another machine running Squid it won't work, since the HTTP request will need to be rewritten in order to be a proxy HTTP request; just redirecting the traffic gives bad request errors from Squid.

score 4 · Answer 1 · answered Sep 16 '10 at 11:19

No need of setting proxy in RouterOS. You can route all outgoing HTTP traffic to the server directly thru NAT:

ip firewall nat add in-interface=eth1 src-address=!<IP of Squid machine> dst-port=80 protocol=tcp action=dst-nat to-addresses=<IP of Squid machine> to-ports=8080

The last parameter "src-address=!..." is needed in case which squid machine communicates thru same interface as the other machines. Otherwise it would go like this:

Computer sends HTTP request
RouterOS destinates this packet to squid
Squid sends HTTP request to webserver
RouterOS destinates squid request again to squid -> loop

score 3 · Accepted Answer · answered Sep 16 '10 at 08:23

3

It can be done with the parent-proxy setting:

/ip proxy
set parent-proxy=<IP of Squid machine> parent-proxy-port=3128

answered Sep 16 '10 at 08:23

Tim

277

score 2 · Answer 3 · edited Jun 22 '13 at 08:37

2

/ip proxy
set parent-proxy=<IP of Squid machine> parent-proxy-port=3128

/ip firewall nat
chain=dstnat src-address=!<IP of Squid machine> protocol=tcp dst-port=80  src-address-list=<IP of Local machine> action=redirect to-ports=8080

edited Jun 22 '13 at 08:37

slm

8,010

answered Jun 22 '13 at 05:38

vhickry

21

How do I set up RouterOS to use web proxy on another machine?

3 Answers3