Web Proxy · Topic 1 of 2
Web Proxy Basic Configuration
Learn how to enable the RouterOS web proxy, set its port and cache, redirect clients transparently with dstnat, chain a parent proxy and protect it.
- 5 min
- The proxy is configured in
/ip proxy, withenabled=yesand aport. - Clients can use it explicitly through the browser, or transparently through a dstnat redirect.
- A transparent setup redirects TCP port 80 to the proxy port with
action=redirect.
What it is
The web proxy is an HTTP proxy server inside RouterOS that fetches pages for LAN clients and can cache them.
A client asks the proxy for a page. The proxy fetches it from the web server and passes it back. If another client asks for the same page later, the proxy may reply from its cache, which saves bandwidth and time.
The service is configured in /ip proxy. Rule lists in the same menu control what it allows, caches and sends direct.
How it works
You enable the proxy, decide how clients reach it, and then set the cache and lists.
Enabling the proxy
/ip proxy set enabled=yes port=8080
/ip proxy printThe port is where the proxy listens for client requests. Clients can then be told to use the router address and this port as their proxy. The same menu holds settings such as the cache size, the cache location and an optional parent proxy.
| Parameter | Meaning |
|---|---|
| enabled | Turns the proxy on or off |
| port | The port that clients connect to |
| max-cache-size | The most the cache may store |
| cache-on-disk | Store the cache on disk and not only in memory |
| parent-proxy | Send requests on to another proxy |
| parent-proxy-port | The port of that parent proxy |
| anonymous | Hide client details in forwarded requests |
Two ways to reach the proxy
Clients can use the proxy in an explicit way or in a transparent way.
| Method | How it works |
|---|---|
| Explicit | Each browser is set to use the router address and proxy port |
| Transparent | A dstnat rule redirects web traffic to the proxy, with no browser setting |
For the transparent method, redirect outgoing HTTP traffic on the LAN interface to the proxy port.
/ip firewall nat add chain=dstnat in-interface=bridge protocol=tcp dst-port=80 action=redirect to-ports=8080The client believes it talks to the web server. The router answers on the proxy port instead. This is useful when you cannot change every browser, but it only works for plain HTTP traffic.
In a transparent setup, exempt the router own address and any servers that must be reached directly, by putting a narrower rule above the redirect rule.
The cache
The proxy stores responses so it can reuse them. How much and where is set with the cache parameters.
/ip proxy set max-cache-size=unlimited cache-on-disk=yesThe cache can be kept in memory or on disk. A disk cache survives a reboot and can be larger, but it needs storage and adds disk activity.
Plan the size for the available storage. Which responses are stored is controlled by the cache list on the next page.
Parent proxy
A parent proxy is another proxy that this router forwards requests to. This is common in a company where a central proxy handles all internet traffic.
/ip proxy set parent-proxy=10.0.0.10 parent-proxy-port=3128Requests go to the parent unless the direct access list says to send them straight out. The direct access list is explained on the next page.
The rule lists
Three lists, all under /ip proxy, give per request control.
| List | Menu | Question it answers |
|---|---|---|
| Access list | /ip proxy access | Is this request allowed or denied? |
| Direct access list | /ip proxy direct | Does it go straight out or through the parent? |
| Cache list | /ip proxy cache | May the response be stored? |
Each list is read from top to bottom, and the first matching rule decides. The next page describes each list and the regular expressions that make rules flexible.
Protecting the service
The proxy is a local service, so traffic to it arrives in the input chain. If the proxy port is reachable from the internet, outsiders could use your router as an open proxy.
/ip firewall filter add chain=input in-interface=ether1 protocol=tcp dst-port=8080 action=dropPlace this rule above any general accept rule that would let the traffic through. Allow the proxy port only from the LAN.
An open proxy on the WAN can be abused to hide attacks and to use your bandwidth. Always drop the proxy port on the WAN interface.
What to remember for the exam
Seven facts cover most questions on this topic.
- The proxy is configured in
/ip proxy, withenabled=yesand aport. - Clients can use it explicitly through the browser, or transparently through a dstnat redirect.
- A transparent setup redirects TCP port 80 to the proxy port with
action=redirect. - The cache can be kept in memory or on disk, with a size set by
max-cache-size. - A parent proxy is set with
parent-proxyandparent-proxy-port. - There are three lists: access, direct access and cache.
- The proxy port must be blocked from the WAN in the input chain.
Common mistakes
These four mistakes appear often.
Redirecting without enabling the proxy. The redirected traffic reaches a closed port and fails.
Leaving the proxy port open on the WAN. Outsiders can use the router as an open proxy.
Expecting a transparent proxy to handle every site. Only plain HTTP can be redirected and cached.
Forgetting storage for a disk cache. A disk cache needs space and may slow a small device.
Check yourself
Work through these three questions.
Which command enables the web proxy on a chosen port?
/ip proxy set enabled=yes port=8080.How are clients forced to use the proxy without changing browsers?
A dstnat rule with
action=redirectsends their port 80 traffic to the proxy port.Where do you stop outsiders from using the proxy?
In the input chain, with a rule that drops the proxy port on the WAN interface.
Topic 1 of 2 in Web Proxy
Test yourself on Web Proxy
The full MikroTik MTCTCE question bank has 479 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by MikroTik. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.