nano bridge - How to to accredit Mikrotik RouterOS Web Proxy in Transparent Mode

Web proxy is a account that is placed amid a applicant and the internet for HTTP web surfing. It can accumulation assertive capacity / http pages in its bounded cache. Mikrotik accept basal PROXY amalgamation builtin alleged WEB PROXY. It is acceptable for basal caching for baby to mid admeasurement networks.

For beforehand caching capabilities, Use 3rd affair alien proxy server like SQUID.

MikroTik WEB.PROXY Recommendation

Always try NOT to use the aforementioned accumulator deejay to abundance your your accumulation and your your Router OS, to ensure there is consistently abundant amplitude on your router OS Deejay for logs, advancement / amend bales & Backups. Therefore It is awful recommended that the web-proxy accumulation is stored on a physically abstracted drive (store) added than the Router OS. Placing the accumulation on a abstracted drive ensures best achievement and reduces problems if the deejay becomes abounding or fails as the OS will again still be OK!

Caching Internet admission will crave a lot of apprehend and writes to the disk, chose fast deejay as for best achievement / circumstantial user appeal support.

Cache achievement additionally abundantly depends on RAM size, the More RAM you accept in your server, the Better achievement you will get.

We will bisect this commodity in 3 Sections.

1# Preparing Accessory Partition for Accumulation

2# Configuring Web Proxy

3# Transparent Proxy

Let’s BEGIN . . .

1# Preparing Accessory Drive for CACHE

First we will Format accessory harddrive (to be acclimated for accumulation ), IF YOU DON’T WANT TO USE SECONDARY HARD-DIVE, SKIP THIS STEP.

Goto SYSTEM > STORES > DISKS

Select the Accessory Hard drive and bang on FORMAT DRIVE

As apparent in the angel below.

.

Now go to STORES tab (by abyssal to SYSTEM > STORES)

Select the WEB-Proxy amalgamation and bang on COPY

It will ask you area to archetype WEB-Proxy package, Select Secondary Drive in TO box.

As apparent in the angel below.

2# Configuring Web Proxy

Now We accept to Enable Mikrotik Web Proxy by abyssal to

IP > WEB PROXY

As apparent in the angel below.

.

Now Click on “Enable”

in Port, Type 8080

Max Accumulation Admeasurement , Select Unlimited from bead bottomward menu, OR if you accept bound Disk Space, again use your adapted amount.

You accept to specify amplitude in KiloBytes for archetype 1024 KB = 1MB , so if you appetite to set 5 GB Cache, again use 5242880 , I am application 5 GB in this example.The accumulation admeasurement is absolutely based off of how abundant RAM you accept in the machine

As apparent in the angel beneath . . .

.

Click on Apply and your Mikrotik’s Web Proxy is Ready to be used, But Every applicant accept to set proxy abode pointing to Mikrotik IP to be able to use Proxy Service.

3# Transparent Proxy

If we appetite that every user charge be automatically redirected to Proxy transparently, again we accept to actualize added aphorism to angrily alter users to proxy service, which is alleged TRANSPARENT PROXY.

.

Goto IP > FIREWALL > NAT and actualize fresh rule

In Chain , Select dsntant,

In Protocol, Select 6 (tcp)

In Dst. Port, Type 80

As apparent in the angel beneath . . .

.

Now goto Action Tab,

In Action, Select redirct

In To Ports, Type 8080

As apparent in the angel beneath . . .

.

Now your anew created aphorism will attending like article beneath image.

As apparent in the angel beneath . . .

OR the CLI adaptation of aloft aphorism would be article like below.

1

/ip firewall nat add action=redirect chain=dstnat disabled=no dst-port=80 protocol=tcp to-ports=8080

Done. Now Mikrotik web proxy will accomplish as TRANSPARENT PROXY , Every user’s HTTP PORT 80 appeal will automatically be redirected to Mikrotik congenital Web Proxy.

You can View Proxy Status and added advice via activity to IP > WEB PROXY > SETTINGS > STATUS and added tabs in the aforementioned window.

As apparent in the angel beneath . . .

=========================================
WEB-PROXY Tips ‘N’ Tricks !! by Zaib (December, 2011)
=========================================

.

Howto Send CACHED Contents to user at Full Speed / Ignoring QUEUE Limit for cached-hits marked packets 

First Mark Cached Contents by MANGLE Rule.

1 2 3

/ip firewall mangle add action=mark-packet chain=output comment="CACHE HIT/Zaib" disabled=no dscp=4 \ new-packet-mark=cache-hits passthrough=no

Now Create an Queue Tree which will send cache-hits packets to users at full LAN speed, ignoring the user’s Static OR Dynamic QUEUES

1 2 3 4

/queue tree add burst-limit=0 burst-threshold=0 burst-time=0s disabled=no limit-at=0 \ max-limit=0 name="Unlimited Speed for CACHE by zaib" packet-mark=cache-hits \ parent=global-out priority=8 queue=default

Now Try to download any cacheable content , for example download following file,

http://www.rarlab.com/rar/wrar410b5a.exe

Once Downloaded, Try to download it again from any other computer or via same test pc. You will see the Queues and rules in action, sending cache-hits packets to users at full LAN speed.Remember Mikrotik web proxy is very basic and simple proxy server with not much tweaks and nuts ‘N’ Bolts  to set, So it will cache what it can. For advancements, Use SQUID instead.

As shows in the image below . . .

.

Also you can appearance the accumulation capacity via activity to IP > WEBPROXY > CACHE CONTENTS

As shows in the angel beneath . . .

Howto Block Web Sites by Domain Name

You can block any web site via domain name as shown below.

1 2	/ip proxy access add action=deny disabled=no dst-host=yahoo.com /ip proxy access add action=deny disabled=no dst-host=www.yahoo.com

Howto Block Downloading via File EXTENSION Types

You can block Downloading by file types using following code,

1	/ip proxy access add path=*.mp3 action=deny

Howto Block OPEN PROXY

Please Make sure You are not running your proxy in OPEN PROXY mode, If so any one cane use your proxy service over the internet, and can use perform any illegal activity and your proxy IP will be logged at remote server, So Block it immediately.
Use the following.

1 2	/ip firewall filter add action=drop chain=input comment="Block Open PROXY <img src="http://s0.wp.com/wp-includes/images/smilies/icon_smile.gif?m=1129645325g" alt=":)" class="wp-smiley">  Zaib" disabled=no dst-port=8080 in-interface=wan protocol=tcp  src-address=0.0.0.0/0

In in-interface , select your WANinterface.

Howto Add LOGO and Edit Proxy Default ERROR Pages

Goto IP > WEB PROXY
Click on RESET HTML
It will ask you that “Current html pages will be lost ! Reset anyway?” CLick on YESAs shown in the image below . . .

,
Now goto FILES and you will see webproxy/error.html ,
As shown in the image below . . .

Just copy this error.html file to your desktop and edit it using your favorite html editor.
(I personally use MS FRONTPAGE 2003 due to its easy and user friendly interface, You can use notepad to edit this file content as its very small and contains basic text only. just don’t mess with the codes, only change the text you want, for example network name support numbers etc. after saving , upload it back to Mikrotiok under web-proxy section.)

Howto Block Web Site for Single User

To block any website for a single user , Use the following …

1 2 3

/ip proxy access add action=deny comment="Block yahoo for single user" disabled=no dst-host=www.yahoo.com src-address=192.168.2.5 (192.168.2.5 is the user ip)

To block single user and redirect him to your policy page on any loacl web server defining the reason why he is blocked , use the following.

1 2	/ip proxy access add action=deny comment="Block yahoo for single user" disabled=no dst-host=www.yahoo.com redirect-to=192.168.2.3/policy/deny.htm src-address=192.168.2.5

(192.168.2.3 is the web server ip , & 192.168.2.5 is the user ip)

As shown in the image below . . .

.