Mikrotik Webproxy with PCC ~ Learn It

I received few requests from friends on how to configure mikrotik web proxy with PCC on same box to save hardware resources and ease of management. Although I never recommend to use Mikrotik web proxy as it is designed for SOHO usage, and suitable for small networks. It have basic capability of simple objects and it have only few options to tune.
- Usually when you enable web proxy on pcc, it wont work. To make it work you have to mark web proxy connection in output chain, and exlude port 80 traffic from pre-routing PCC rules. Example is as below. (I assume you have dual wan pcc already configured and in running state)
.

Add Rules in Output Chain & exclue port 80 traffic from PCC prerouting chain

Add following rules (Output chain)
/ip firewall mangle
add action=mark-connection chain=output comment=”Marking Web Proxy Connection for WAN-1″ disabled=no dst-port=80 new-connection-mark=WAN1_conn passthrough=yes per-connection-classifier=\
    both-addresses-and-ports:2/0 protocol=tcp
add action=mark-connection chain=output comment=”Marking Web Proxy Connection for WAN-2″ disabled=no dst-port=80 new-connection-mark=WAN2_conn passthrough=yes per-connection-classifier=\
    both-addresses-and-ports:2/1 protocol=tcp
.
Now exclude port 80 from the PCC rules in pre-routing chain.
add action=mark-connection chain=prerouting comment=”Excluding Port 80 from PCC – WAN1″ disabled=no dst-address-type=!local dst-port=!80 in-interface=LAN new-connection-mark=WAN1_conn passthrough=yes \
    per-connection-classifier=both-addresses-and-ports:2/0 protocol=tcp
add action=mark-connection chain=prerouting comment=”Excluding Port 80 from PCC – WAN2″ disabled=no dst-address-type=!local dst-port=!80 in-interface=LAN new-connection-mark=WAN2_conn passthrough=yes \
    per-connection-classifier=both-addresses-and-ports:2/1 protocol=tcp
As showed in the image below . . .

.
.
.

Enable Mikrotik Web Proxy

Now Enable Web proxy.
/ip proxy
set always-from-cache=no cache-administrator=webmaster cache-hit-dscp=4 cache-on-disk=yes enabled=yes max-cache-size=unlimited max-client-connections=600 max-fresh-time=3d \
max-server-connections=600 parent-proxy=0.0.0.0 parent-proxy-port=0 port=8080 serialize-connections=no src-address=0.0.0.0
As showed in the image below . . .

.
.

Redirect port 80 traffic to web proxy (Transparent Proxy)

Now redirect users port 80 traffic to web proxy by creating a NAT rule so all users browsing (port 80) request should automatically be redirected to mikrotik web proxy, (aka Transparent Proxy) (Move this rule at end in NAT section)
/ip firewall nat
add action=redirect chain=dstnat comment=”Redirect port 80 request to Web Proxy” disabled=no dst-port=80 protocol=tcp to-ports=8080
As showed in the image below . . .

.
.
.
Now try to browse from client side, or download using IDM etc, and see the both WAN usage and web proxy status.
WAN USAGE STATUS >

.
.
WEB PROXY USAGE STATUS >

.
.
.
Mikrotik EXPORT with complete script for Dual WAN and Proxy.

[admin@MikroTik-2] > /ip ad ex

# may/16/2013 09:09:34 by RouterOS 5.20

# software id = zaib-home

/ip address

add address=10.0.0.1/8 disabled=no interface=WAN1 network=10.0.0.0

add address=192.168.0.1/24 disabled=no interface=WAN2 network=192.168.0.0

add address=192.168.5.1/24 disabled=no interface=LAN network=192.168.5.0

/ip dns

set allow-remote-requests=yes cache-max-ttl=1w cache-size=5000KiB max-udp-packet-size=512 servers=8.8.8.8

/ip proxy

set
 always-from-cache=no cache-administrator=webmaster cache-hit-dscp=4 
cache-on-disk=yes enabled=yes max-cache-size=unlimited 
max-client-connections=600 max-fresh-time=3d \

max-server-connections=600 parent-proxy=0.0.0.0 parent-proxy-port=0 port=8080 serialize-connections=no src-address=0.0.0.0

/ip firewall mangle

add action=mark-connection chain=input disabled=no in-interface=WAN1 new-connection-mark=WAN1_conn passthrough=yes

add action=mark-connection chain=input disabled=no in-interface=WAN2 new-connection-mark=WAN2_conn passthrough=yes

add
 action=mark-connection chain=output comment="Marking Web Proxy 
Connection for WAN-1" disabled=no dst-port=80 
new-connection-mark=WAN1_conn passthrough=yes 
per-connection-classifier=\

both-addresses-and-ports:2/0 protocol=tcp

add
 action=mark-connection chain=output comment="Marking Web Proxy 
Connection for WAN-2" disabled=no dst-port=80 
new-connection-mark=WAN2_conn passthrough=yes 
per-connection-classifier=\

both-addresses-and-ports:2/1 protocol=tcp

add
 action=mark-connection chain=prerouting comment="Excluding Port 80 from
 PCC - WAN1" disabled=no dst-address-type=!local dst-port=!80 
in-interface=LAN new-connection-mark=WAN1_conn passthrough=yes \

per-connection-classifier=both-addresses-and-ports:2/0 protocol=tcp

add
 action=mark-connection chain=prerouting comment="Excluding Port 80 from
 PCC - WAN2" disabled=no dst-address-type=!local dst-port=!80 
in-interface=LAN new-connection-mark=WAN2_conn passthrough=yes \

per-connection-classifier=both-addresses-and-ports:2/1 protocol=tcp

add
 action=mark-routing chain=prerouting connection-mark=WAN1_conn 
disabled=no in-interface=LAN new-routing-mark=to_WAN1 passthrough=yes

add
 action=mark-routing chain=prerouting connection-mark=WAN2_conn 
disabled=no in-interface=LAN new-routing-mark=to_WAN2 passthrough=yes

add action=mark-routing chain=output connection-mark=WAN1_conn disabled=no new-routing-mark=to_WAN1 passthrough=yes

add action=mark-routing chain=output connection-mark=WAN2_conn disabled=no new-routing-mark=to_WAN2 passthrough=yes

add action=accept chain=prerouting disabled=no dst-address=10.0.0.0/8 in-interface=LAN

add action=accept chain=prerouting disabled=no dst-address=192.168.0.0/24 in-interface=LAN

/ip firewall nat

add action=masquerade chain=srcnat comment="Masquerade WAN1 Traffic" disabled=no out-interface=WAN1

add action=masquerade chain=srcnat comment="Masquerade WAN2 Traffic" disabled=no out-interface=WAN2

add
 action=redirect chain=dstnat comment="Redirect port 80 request to 
Mikrotik Web Proxy" disabled=no dst-port=80 protocol=tcp to-ports=8080

/ip route

add
 check-gateway=ping disabled=no distance=2 dst-address=0.0.0.0/0 
gateway=10.0.0.1 routing-mark=to_WAN1 scope=30 target-scope=10

add
 check-gateway=ping disabled=no distance=1 dst-address=0.0.0.0/0 
gateway=192.168.0.1 routing-mark=to_WAN2 scope=30 target-scope=10

add check-gateway=ping disabled=no distance=1 dst-address=0.0.0.0/0 gateway=192.168.0.1 scope=30 target-scope=10

add check-gateway=ping disabled=no distance=2 dst-address=0.0.0.0/0 gateway=10.0.0.1 scope=30 target-scope=10

[admin@MikroTik-2] >

Regard’s
Naveed Ahmad

Please Give Us Your 1 Minute In Sharing This Post!

SOCIALIZE IT → ,

Learn It

Sunday, 24 November 2013