edmarmega

Ola pessoal eu sofri pra caramba por causa do proxy e hotspot e cheguei a uma configuração bem simples e funcional.

ACEITA CONEXÕES VINDAS DO PROXY
/ ip firewall filter
add chain=forward in-interface=Proxy action=accept comment="Aceita CONEX ES VINDAS DO PROXY" disabled=no

REGRAS NAT
/ ip firewall nat
(nat placas de rede)
add chain=srcnat out-interface=Clientes action=masquerade comment="NAT REDE clientes" disabled=no
add chain=srcnat out-interface=Proxy action=masquerade comment="NAT REDE Proxy" disabled=no
add chain=srcnat out-interface=Dedicado action=masquerade comment="NAT LINK DEDICADO" disabled=no

(redirecionamentos das redes 10.0.0.0/24 e 10.0.1.0/24 para o proxy do mikrotik)
add chain=dstnat in-interface=Clientes src-address=10.0.0.0/24 protocol=tcp dst-port=80 hotspot=auth action=redirect \
to-ports=3128 comment="REDIRECIONAMENTO PROXY" disabled=no
add chain=dstnat in-interface=Clientes src-address=10.0.1.0/24 protocol=tcp dst-port=80 action=redirect to-ports=3128 \
comment="" disabled=no

REGRAS IP-PROXY MIKROTIK
(10.10.0.2:5128 ip squidorta)
/ ip proxy
set enabled=yes port=3128 parent-proxy=10.10.0.2:5128 maximal-client-connecions=1000 maximal-server-connectons=1000

(aceitando conecxões de acesso ao proxy para as redes 10.0.0.0/24 e 10.0.1.0/24)
/ ip proxy access
add dst-port=23-25 action=deny comment="block telnet & spam e-mail relaying" disabled=no
add src-address=10.0.0.0/24 action=allow comment="" disabled=no
add src-address=10.0.1.0/24 action=allow comment="" disabled=no

REGRAS HOTSPOT
#
/ ip hotspot
add name="hotspot" interface=Clientes profile=hsprof idle-timeout=1d keepalive-timeout=none disabled=no
/ ip hotspot service-port
set ftp ports=21 disabled=no

(redirecionamento para a porta 3128 do proxy mikrotik, 10.0.0.1 ip da interface cliente e hotspot)
/ ip hotspot profile
add name="hsprof" hotspot-address=10.0.0.1 dns-name="" html-directory=hotspot rate-limit="" http-proxy=0.0.0.0:3128 \
smtp-server=0.0.0.0 login-by=mac,cookie,http-chap http-cookie-lifetime=1d split-user-domain=no use-radius=no

(obs, em USERS PROFILES marque a opção Transparent Proxy)

Espero que sirva para alguem.