transparent proxy

Let's take a crack at this.  First, change the tunnel addresses so they don't conflict with your internal IP addresses:

(on the datacenter proxy router)
Interface Tunnel10
  ip address 10.0.0.1 255.255.255.252

On the router at the other end of the tunnel, you'll need the other tunnel IP address

(at the remote site where the tunnel is hooked to)
Interface Tunnel10
 ip address 10.0.0.2 255.255.255.252

Now make sure you can ping 10.0.0.1 from the datacenter router, and vice versa.  If you can't, check the tunnel source/destination that they are valid.

Now, you are going to have to add another subnet to your 192.168.250.x/24 subnet.  For example, you can have 192.168.250.x/23 at the computers located at the remote site, and 192.168.251.x/23 at the computers located at the datacenter.  However, the router will need to have the subnets set at /24.  That way the router will know how and when to route them, yet the computers at both sides can communicate as if they were in the same subnet.


Make sure proxy-arp is enabled at the datacenter and add a static route to the remote 192.168.251.x network.

Interface Ethernet1/0
 ip proxy-arp
ip route 192.168.251.0 255.255.255.0 10.0.0.2


At the remote router, set the IP address on it's LAN to the following:

Interface Ethernet1/0 (assuming this is the LAN interface on that router)
 ip address 192.168.251.1 255.255.255.0
 ip proxy-arp
ip route 192.168.250.0 255.255.255.0 10.0.0.1


Make sure you can ping both 192.168.251.1 and 192.168.250.1 from either router.  This traffic should be traveling through the tunnel.


Set up computers at the datacenter with 192.168.250.x 255.255.254.0 and the computers at the remote location with 192.168.251.x 255.255.254.0.


If all went well up to this point, the computers from both labs should be able to ping each other as if they were on the same subnet.  


Also, you can probably remove this line, unless you still need it for some reason.

 ip nat inside source static 192.168.250.1 192.168.250.2

I was thinking about this question.  Are you sure you even want a transparent proxy?  Or are you thinking more of a layer 2 switch being forwarded over the internet to the other lab?  If so, L2TPv3 will give you what you want.  Keep in mind that everything layer2 with MAC addresses goes though it including local LAN broadcast traffic.

You can route all your traffic over Datacenter(DC) router by doing VPN to DC. In this case you do not need transparent proxy.
However if you really need to pass your data traffic over DC's server, run VPN service and proxy service on the DC's server. And connect to the server with VPN and route all traffic over that VPN connection. Your proxy service can handle your web traffic transparently. Squid can do it for you.

Regards,
Rustamjon.

Brain2000:

L2TPv3 will forward all traffic to the DC this will make high delay I need to forward only http traffic to proxy and all another out of the tunnel

rustamonline:

VPN will make high delay

If you just want a transparent proxy, my first post shows that.  But based on what you are saying, I still don't think you want a transparent proxy because you said that you need to forward "http traffic" to the transparent proxy.  Let me explain further:

First, a transparent proxy is never forwarded to.  It is "transparent", and therefore plucks traffic off your lan and automatically forwards it.  It basically is "extending" your LAN, transparently.

Second, The proxy can only forward traffic based on layer 3, not layer 4 settings.  Meaning, it cannot transparently proxy for only a specific TCP port.  It only forwards based on IP addresses.

It sounds to me like you want a router that will send http traffic straight to the internet, and all other traffic over a tunnel.  Is that correct?  If so, that's not called a transparent proxy.  That's just a router.

Current configuration does not allow you routing based on layer 4.

At this point, if you would, clarify exactly what you are trying to do so I can provide a config change to match.

I have a gut feeling that we'll set up policy-based routing in order to handle what you are looking for.  Please let me know what you are trying to set up?

Dear Brain2000:
I want to send only  http traffic to the proxy ,and  all other traffic  straight to the internet

I think I'm getting it now. That's not s transparent proxy. That's an http proxy server.

You need policy based routing on the router. It will allow all to flow through except port 80, which will go to the http proxy instead. I need to know a couple things to make you some config changes. One, how is the http proxy hooked to the internet? Does it also go through the router or do you have a second line? Also, I need the IP address of the http proxy.

yas it's connect hooked to the internet through the router
the proxy ip 62.68.64.10

thanks for your help