MikroTik and transparent Squid with 1 nic

DarkAbraxas · 12-23-2013, 08:52 AM

Hi guys.
I need help with transparent Squid configuration on box that have one network card.
I managed to setup MikroTik to redirect all traffic on port 80 to Linux machine (Slackware 14.0) and Squid works fine when he is not transparent and when I manually setup proxy in browser. So the problem is in iptables configuration. I tried couple of things I found on the internet, but nothing helped me so far.

For the sake of easy explanation and understanding lets say this:
1. MikoTik is gateway for internet on address 192.168.1.1/24
2. Linux machine with Squid is on address 192.168.1.10/24
3. I have computers in the same subnet (192.168.1.0/24) and I have other computers in subnets 192.168.2.0/24 and 192.168.3.0/24.

I want all computers in those networks to be on transparent Squid.

As I said, I redirected traffic on port 80 to Squid, but when its transparent I get something like this:

Quote:

ERROR
The requested URL could not be retrieved

The following error was encountered while trying to retrieve the URL: http://www.some-address.com/

Connection to xxx.xxx.xxx.xxx failed.

The system returned: (110) Connection timed out

The remote host or network may be down. Please try the request again.

Your cache administrator is webmaster.

I hope someone can help...

DarkAbraxas · 12-24-2013, 03:21 AM

Here is simplified diagram of mentioned network:

http://www.linuxquestions.org/questions/attachment.php?attachmentid=14308&stc=1&d=1387876634

picassofb · 06-14-2014, 09:02 PM

Hi, did u solved your problem? I want to do the same.

kelbel.muller · 06-16-2014, 04:16 PM

Hi.
Have you solved your problem?

If not, below are configs that works for me:
----------------------------
* NETWORK DESIGN *
LAN: 10.5.5.0/24, 10.6.6.0/24 and 10.7.7.0/24
WAN: 192.168.0.0/29
SQUID SUBNET: 10.9.9.0/30

* IP ADDRESSES *
Mirotik:
eth-LAN: 10.5.5.1/24, 10.6.6.1/24 and 10.7.7.1/24
eth-WAN: 192.168.0.2/29
eth-SQUID: 10.9.9.1/30

Squid Cache:
10.9.9.2/30
----------------------------
* MIKROTIK CONFIGURATION *
## ADDRESS LIST ##

Quote:

/ip firewall address-list add list=SQUID_CLIENTS address=10.5.5.0/24
/ip firewall address-list add list=SQUID_CLIENTS address=10.6.6.0/24
/ip firewall address-list add list=SQUID_CLIENTS address=10.7.7.0/24
/ip firewall address-list add list=SQUID_CLIENTS address=192.168.0.2

## MANGLE RULES ##

Quote:

/ip firewall mangle add chain=prerouting action=mark-routing new-routing-mark=TO_SQUID passthrough=yes protocol=tcp src-address-list=!SQUID_CLIENTS dst-address-list=SQUID_CLIENTS in-interface=eth-WAN src-port=80 comment="## FROM LAN TO INTERNET"
/ip firewall mangle add chain=prerouting action=mark-routing new-routing-mark=TO_SQUID passthrough=yes protocol=tcp src-address-list=SQUID_CLIENTS dst-address-list=!SQUID_CLIENTS in-interface=!eth-SQUID dst-port=80 comment="## FROM INTERNET TO LAN"

## ROUTE CONFIGURATION ##

Quote:

/ip route add dst-address=0.0.0.0/0 gateway=10.9.9.2 distance=1 scope=30 target-scope=30 routing-mark=TO_SQUID disabled=no comment="## ROUTE TO SQUID"

----------------------------

Please tell if it worked or not for you.

l1nkers · 07-22-2015, 06:11 AM

Good day,

I have been using the exact same setup and I am getting the logs. But for some reason I am getting my ISP provider's ip adress for all websites visited from Mikrotik src-adress list. So there is no way to determine who is visiting what sites. How can I solve this?

L1nkers