Встала задача настроить прозрачный прокси SQUID + разобраться с перенаправлением трафика на mikrotik.

 Я собирал из исходников v4.9 вот с такими опциями: ./configure --enable-ssl --enable-ssl-crtd --with-openssl --disable-arch-native --prefix=/usr --localstatedir=/var --sysconfdir=/etc/squid --libexecdir=/usr/lib/squid --datadir=/usr/share/squid --with-default-user=proxy --with-logdir=/var/log/squid --with-pidfile=/var/run/squid.pid

Вот конфиг SQUIDA:

acl localnet src 192.168.26.0/25
acl localnet src 192.168.41.0/25
acl localnet src 192.168.88.0/25
acl localnet src 192.168.77.0/25
acl localnet src 192.168.33.0/24

# Only allow cachemgr access from localhost
http_access allow localhost manager
http_access deny manager

# We strongly recommend the following be uncommented to protect innocent
# web applications running on the proxy server who think the only
# one who can access services on "localhost" is a local user
#http_access deny to_localhost

#
# INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS
#

# Example rule allowing access from your local networks.
# Adapt localnet in the ACL section to list your (internal) IP networks
# from where browsing should be allowed
http_access allow localnet
http_access allow localhost

# Uncomment and adjust the following to add a disk cache directory.
#cache_dir ufs /var/cache/squid 100 16 256

# Leave coredumps in the first cache dir
coredump_dir /var/cache/squid

#
# Add any of your own refresh_pattern entries above these.
#
refresh_pattern ^ftp:           1440    20%     10080
refresh_pattern ^gopher:        1440    0%      1440
refresh_pattern -i (/cgi-bin/|\?) 0     0%      0
refresh_pattern .               0       20%     4320

cache deny all
http_reply_access allow all

acl white_dst dstdom_regex "/etc/squid/lists/white_dst"
acl white_name ssl::server_name "/etc/squid/lists/white_name"
acl white_dns dstdomain "/etc/squid/lists/white_name"
acl white_url url_regex "/etc/squid/lists/white_url"

acl white any-of white_dst white_name white_dns white_url

acl foreignProtocol squid_error ERR_PROTOCOL_UNKNOWN ERR_TOO_BIG
acl unsup_http_ver squid_error ERR_UNSUP_HTTPVERSION

on_unsupported_protocol tunnel foreignProtocol
on_unsupported_protocol tunnel unsup_http_ver

http_port 3128
http_port 3129 intercept
https_port 3130 intercept ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=16MB cert=/etc/squid/ssl/squid.pem key=/etc/squid/ssl/squid.key
sslproxy_cert_error allow all
always_direct allow all

acl step1 at_step SslBump1
acl step2 at_step SslBump2
acl step3 at_step SslBump3

ssl_bump peek step1 all
ssl_bump splice white
ssl_bump stare step2 all !white
ssl_bump bump step3 all !white

sslcrtd_program /usr/lib/squid/security_file_certgen -s /var/lib/ssl_db -M 16MB
visible_hostname server2

Вот настройки MikroTik (в таблице mangle):

И на последок правила iptables для редиректа с портов 80, 443 на порты squid:

iptables -A PREROUTING -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 3129
iptables -A PREROUTING -p tcp -m tcp --dport 443 -j REDIRECT --to-ports 3130