0

I want to setup proxy server for my Mikrotik router. There is inbuilt web-proxy for Mikrotik router but I can extend this up to transparent proxy (kind of proxy server) only. We need High anonymity proxy so that we can hide our LAN static IPs(we don't have private IP) from outside Intruder/hackers.

And also I know I can setup NAT rule to hide our IP(only private IP not public/static IP) as per this link, but I can't hide static/public IP.

Essentially I want to hide our Public/Static IP (there is static/public IP for all systems in our company) from outside Internet. To achieve this I guess I need other software apart from Mikrotik router gateway setup.

can anyone suggest me Is there any other software to achieve my requirement? I know about squid proxy but am not sure whether It can hide our static/public IP.

Note: we have assigned public/Static IP to all systems of our company since we have rights to access our company's system from anywhere by dedicated laptop(given by our company with more security) through VPN connection.

1 Answer 1

2

Firstly, there's nothing special about the private IP ranges; NAT will work just as well on any address, it's just that there's really no need for it with publicly-routable addresses.

For a proxy to use with MikroTik Router OS, I'd suggest Squid but probably any HTTP proxy server would work; if you're in a Microsoft environment you may prefer their proxy offering.

In terms of 'hiding' internal IPs, what I believe you're referring to is the HTTP X-Forwarded-For header. You should be able to configure most proxy servers to omit this header (it's not part of the standard anyway, hence the X- prefix). I'd strongly recommend testing this before deploying to production by connecting through the new proxy to a server you control and examining the HTTP headers the server receives.

2
  • "NAT will work just as well on any address." If this is the case then the rule from NAT Mikrotik is /ip firewall nat add chain=srcnat action=masquerade out-interface=ether1-Input should work for me. where ether1-Input is interface get connection from ISP. But this rule doesn't allow me to connect to internet. I try with out-interface=ether2 where ether2 is Interface for our LAN setup, I do connect internet with this setup but Cann't hide my IP from proxy test.
    – niren
    Oct 24, 2013 at 10:49
  • The masquerade action is a MikroTik-specific option designed for convenience (it automatically selects the public IP); you can use the src-nat action to do the same thing, but you'll need to manually specify the public IP.
    – Calrion
    Oct 26, 2013 at 5:19

Not the answer you're looking for? Browse other questions tagged .