I've read a lot of post asking how we can make a load balance and web proxy can use it, to many people say that it's not possible, but yes it is, only we need to do it's mark in the output the packets go to destination port 80 and assign a routing mark, thats it.

I you found this useful don't forget about the karma http://forum.mikrotik.com/viewtopic.php?f=1&t=41148

Hi, I'm new to the forums but I have been reading them for a while, english is not my primary language.

Can you guys tell me how to set up the mangle rules to use the web proxy when I'm using PCC load balance.

This is my current set up.

/ ip address
add address=192.168.5.1/24 network=192.168.5.0 broadcast=192.168.5.255 interface=Local
add address=192.168.1.1/24 network=192.168.1.0 broadcast=192.168.1.255 interface=wan1
add address=192.168.2.1/24 network=192.168.2.0 broadcast=192.168.2.255 interface=wan2
add address=192.168.3.1/24 network=192.168.3.0 broadcast=192.168.3.255 interface=wan3

/ ip firewall mangle
add chain=input in-interface=wan1 action=mark-connection new-connection-mark=wan1_conn
add chain=input in-interface=wan2 action=mark-connection new-connection-mark=wan2_conn
add chain=input in-interface=wan3 action=mark-connection new-connection-mark=wan3_conn

add chain=output connection-mark=wan1_conn action=mark-routing new-routing-mark=to_wan1
add chain=output connection-mark=wan2_conn action=mark-routing new-routing-mark=to_wan2
add chain=output connection-mark=wan3_conn action=mark-routing new-routing-mark=to_wan3

add chain=prerouting dst-address=192.168.1.0/24 action=accept in-interface=Local
add chain=prerouting dst-address=192.168.2.0/24 action=accept in-interface=Local
add chain=prerouting dst-address=192.168.3.0/24 action=accept in-interface=Local

add chain=prerouting dst-address-type=!local in-interface=Local per-connection-classifier=both-addresses:3/0 \
action=mark-connection new-connection-mark=wan1_conn passthrough=yes
add chain=prerouting dst-address-type=!local in-interface=Local per-connection-classifier=both-addresses:3/1 \
action=mark-connection new-connection-mark=wan2_conn passthrough=yes
add chain=prerouting dst-address-type=!local in-interface=Local per-connection-classifier=both-addresses:3/2 \
action=mark-connection new-connection-mark=wan3_conn passthrough=yes

add chain=prerouting connection-mark=wan1_conn in-interface=Local action=mark-routing new-routing-mark=to_wan1
add chain=prerouting connection-mark=wan2_conn in-interface=Local action=mark-routing new-routing-mark=to_wan2
add chain=prerouting connection-mark=wan3_conn in-interface=Local action=mark-routing new-routing-mark=to_wan3

/ ip route
add dst-address=0.0.0.0/0 gateway=192.168.1.1 routing-mark=to_wan1 check-gateway=ping
add dst-address=0.0.0.0/0 gateway=192.168.2.1 routing-mark=to_wan2 check-gateway=ping
add dst-address=0.0.0.0/0 gateway=192.168.3.1 routing-mark=to_wan3 check-gateway=ping

add dst-address=0.0.0.0/0 gateway=192.168.1.1 distance=1 check-gateway=ping
add dst-address=0.0.0.0/0 gateway=192.168.2.1 distance=2 check-gateway=ping
add dst-address=0.0.0.0/0 gateway=192.168.3.1 distance=3 check-gateway=ping

/ ip firewall nat
add chain=srcnat out-interface=wan1 action=masquerade
add chain=srcnat out-interface=wan2 action=masquerade
add chain=srcnat out-interface=wan3 action=masquerade

Thank you.

I tried what you said but it does not work, I'm trying to get transparent web proxy to work. After I add the NAT rule to redirect traffic from port 80 to port 8080 of the proxy everything on the LAN stops, no packets can get through.

Could it be because I'm not using pppoe over the wan side?

I'm going to try your sample configuration late tonight or very early tomorrow morning and I will let you know how it goes.

I think that having 3 pppoe with pcc and web proxy does not work well, I already tried it. Maybe web proxy only works with 1 wan

you must put another line before that accepting the redirected site

 add action=mark-connection chain=prerouting comment="" disabled=no dst-address-type=!local dst-port=!80 in-interface=\
    LAN new-connection-mark=dsl2_pol passthrough=yes per-connection-classifier=both-addresses:6/4 protocol=tcp
 

Thanks Bawolek, I know what I will do next, I will buy another RB450G just to do the load balancing and a second RB450G just to do the web proxy, I think that will work.

Ok

Thank you , I will try it as soon as I can and I will let you know.

/ip proxy access
add action=allow disabled=no dst-port=80 src-address=192.168.13.0/24
/ip proxy cache
add action=allow disabled=no dst-port=80 src-address=192.168.13.0/24

Is this your local LAN 192.168.13.0/24 ?

in my post Fri Jun 18, 2010 4:28 pm I forgot about UDP protocol ! ...

so @yinxiangyn in your config I think that you should add roules for udp

so you have roules 10,11,12,13 this roules mangle protocol TCP without port 80
but what about UDP ? ;p

if your proxy is working on 4 wan with yours config, that fact is very interesting


PS do not worry about your English, my English also is poor but I think everyone know what's going on ;p

greetings from Polish

After 15 minutes of trying your setup I can confirm that it WORKS yinxiangyn, it is balancing 3 wans and the web proxy is working. Thank You yinxiangyn !

so... "UDP" maybe this is not good word...

I mean that yours rules not balance all traffic from clients,
but only tcp protocol (without port 80)

but what about for example UDP.... etc

for example this rule mark all traffic from clients....

Code: Select all

add action=mark-connection chain=prerouting comment="" disabled=no dst-address-type=!local in-interface=LAN new-connection-mark=dsl1_pol \
    passthrough=yes per-connection-classifier=both-addresses:6/3 

if you use "protocol=tcp dst-port=!80" then roule mark only tcp (without port 80) but rest traffic goes through by default gateway

After 15 minutes of trying your setup I can confirm that it WORKS yinxiangyn, it is balancing 3 wans and the web proxy is working. Thank You yinxiangyn !

you must put another line before that accepting the redirected site

thanks, one point karma is for you ;p


@gtpro im not sure but i think that is impossible to run web-proxy for more than one wan .... proxy works on one WAN, you can load-balance traffic to any output interfaces but traffic which goes thrue proxy is going by only one WAN
(maybe because is one process for cpu and use one routing table)

so you have to load-balance all traffic, but not http

Code: Select all

 add action=mark-connection chain=prerouting comment="" disabled=no dst-address-type=!local dst-port=!80 in-interface=\
    LAN new-connection-mark=dsl2_pol passthrough=yes per-connection-classifier=both-addresses:6/4 protocol=tcp
 

It is still working fine here, what kind of problems do you have?

@yinxiangyn my idea is still evolving
I think that better way is add accept before rule 10 for tcp 80 port

then in prerouting roules 10,11,12,13 will be the same pair of dst adres (and will be in the same mark)

now 10,11,12,13 rules creates one group of dst adres pair and 14,15,16,17 creates another pairs for rest of traffic

so it can hapen that the same group of adress will goes through not by the same WAN interfaces (for example tcp from client will goes through by pppoe1, and UDP from the same client (AND THE SAME ADDRESSES PAIR) will go through pppoe2 )

(because you markt the same adres in two steps: one for tcp (without 80 tcp), two for the rest of the traffic from the same address)


if you add accept for 80 tcp, you will not need a 14,15,16,17 rules
and 10,11,12,13 will look:

Code: Select all

 add action=mark-connection chain=prerouting comment="" disabled=no dst-address-type=!local in-interface=LAN new-connection-mark=dsl1_pol \
    passthrough=yes per-connection-classifier=both-addresses:6/3 

I hope that I wrote is understandable ;p

greet