Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I encountered the problem with configuration of two squid servers. I have the following scheme -

enter image description here

The main idea is to download all files from rackspace and amazon through parent squid and store all files in his cache.

On the main_squid server was configured PBR (iptables + ip route). All packets go through the same channels through which the requests were received

# ip ru sh
0:      from all lookup local
1000:   from all fwmark 0x3e8 lookup ISP1
2000:   from all fwmark 0x7d0 lookup ISP2
3011:   from all fwmark 0xbc3 lookup ISP3
32762:  from xxx.xxx.xxx.62 lookup ISP1
32763:  from yyy.yyy.yyy.239 lookup ISP2
32764:  from zzz.zzz.zzz.10 lookup ISP3
32766:  from all lookup main
32767:  from all lookup default

main_squid squid.conf http_port 192.168.210.1:3128 transparent

cache_peer 192.168.220.2 sibling 3128 3130
dead_peer_timeout 5 seconds

acl AMAZON dstdom_regex -i (.*)s3\.amazonaws\.com
cache_peer_access 192.168.220.2 allow AMAZON

acl RACKSPACE dstdom_regex -i (.*)rackcdn\.com
cache_peer_access 192.168.220.2 allow RACKSPACE

url_rewrite_program /usr/bin/squidguard
url_rewrite_children 32

cache_dir null /tmp
cache_store_log none
cache deny all

acl local_net src 192.168.0.0/16
http_access allow local_net

parent_squid squid.conf

http_port 192.168.220.2:3128
acl main_squid src 192.168.220.1

http_access allow main_squid
http_access allow manager localhost
http_access allow manager main_squid

icp_access allow main_squid

cache_mem 30 GB
maximum_object_size_in_memory 128 MB
cache_dir aufs /squid 400000 16 256
minimum_object_size 16384 KB
maximum_object_size 1024 MB
cache_swap_low 93
cache_swap_high 98

acl PSD urlpath_regex -i \.psd$
cache allow PSD

acl ZIP urlpath_regex -i \.zip$
cache allow ZIP

acl OTHER url_regex -i ^http://*
cache deny OTHER

refresh_pattern \.psd$ 2592000 100 2592000 override-lastmod
override-expire ignore-reload ignore-no-cache
refresh_pattern \.zip$ 2592000 100 2592000 override-lastmod
override-expire ignore-reload ignore-no-cache

All work fine, until I uncomment on main_squid the following line

tcp_outgoing_address yyy.yyy.yyy.239

When I try to download any zip file from amazon I see the following message in cache.log

2013/04/22 01:00:41| TCP connection to 192.168.220.2/3128 failed

If I run tcpdump on yyy.yyy.yyy.239 I see that main_squid trying to connect to parent via external interface without success.

So my question. How may I configure main_squid that it could connect to the parent even with configured tcp_outgoing_address option?

P.S.

# squid -v
Squid Cache: Version 2.6.STABLE21
configure options:  '--host=x86_64-unknown-linux-gnu'
'--build=x86_64-unknown-linux-gnu' '--program-prefix=' '--prefix=/usr'
'--exec-prefix=/usr' '--bindir=/usr/bin' '--sbindir=/usr/sbin'
'--sysconfdir=/etc' '--includedir=/usr/include' '--libdir=/usr/lib64'
'--libexecdir=/usr/libexec' '--sharedstatedir=/var/lib'
'--mandir=/usr/share/man' '--infodir=/usr/share/info'
'--exec_prefix=/usr' '--bindir=/usr/sbin'
'--libexecdir=/usr/lib64/squid' '--localstatedir=/var'
'--datadir=/usr/share' '--sysconfdir=/etc/squid' '--enable-arp-acl'
'--enable-epoll' '--enable-snmp' '--enable-removal-policies=heap,lru'
'--enable-storeio=aufs,coss,diskd,null,ufs' '--enable-ssl'
'--with-openssl=/usr/kerberos' '--enable-delay-pools'
'--enable-linux-netfilter' '--with-pthreads'
'--enable-ntlm-auth-helpers=SMB,fakeauth'
'--enable-external-acl-helpers=ip_user,ldap_group,unix_group,wbinfo_group'
'--enable-auth=basic,digest,ntlm,negotiate'
'--enable-negotiate-auth-helpers=squid_kerb_auth'
'--enable-digest-auth-helpers=password'
'--with-winbind-auth-challenge' '--enable-useragent-log'
'--enable-referer-log' '--disable-dependency-tracking'
'--enable-cachemgr-hostname=localhost' '--enable-underscores'
'--enable-basic-auth-helpers=LDAP,MSNT,NCSA,PAM,SMB,YP,getpwnam,multi-domain-NTLM,SASL'
'--enable-cache-digests' '--enable-ident-lookups'
'--enable-follow-x-forwarded-for' '--enable-wccpv2'
'--enable-fd-config' '--with-maxfd=16384'
'build_alias=x86_64-unknown-linux-gnu'
'host_alias=x86_64-unknown-linux-gnu' 'CFLAGS=-D_FORTIFY_SOURCE=2
-fPIE -Os -g -pipe -fsigned-char' 'LDFLAGS=-pie'

Any help would be highly appreciated

share|improve this question

migrated from stackoverflow.com Apr 23 '13 at 23:14

This question came from our site for professional and enthusiast programmers.

2 Answers 2

Take a look at squid's tcp_outgoing_address documentation

You can use an acl to limit the scope of tcp_outgoing_address. Add the following to the main_squid config

acl parent_squid dst 192.168.220.2/32
tcp_outgoing_address 192.168.220.1 parent_squid
tcp_outgoing_address yyy.yyy.yyy.239 !parent_squid

But it's mostly unused feature which has lots of bugs (I've seen it crash squid in some cases). I'd recommend to use iptables to force the right interface/ip. Something like this should work

iptables -t nat -A PREROUTING -d 192.168.220.2/32 -j SNAT --to 192.168.220.1
share|improve this answer
    
It wouldn't work at all. Because in my case dst ip would be s3.amazonaws.com and not 192.168.220.2. To resolve my issue I must upgrade to at least squid-3.1 and use acl peername. –  ALex_hha May 17 '13 at 11:16

if someone is interested, below I have added working configuration files (main/parent squid)

main squid (192.168.220.1) configuration file

acl local_net src 192.168.0.0/16
acl parent_peer peername PARENT_PEER
acl parent_squid dst 192.168.220.2

acl FILE_TO_CACHE urlpath_regex \.(zip|iso|rar)$
acl STORAGE dstdomain storage.example.net

http_port 192.168.220.1:3128 intercept
icp_port 3130

cache_peer 192.168.220.2 parent 3128 3130 name=PARENT_PEER connect-timeout=7 proxy-only
cache_peer_access PARENT_PEER allow STORAGE FILE_TO_CACHE

# to connect to parent via internal interface
tcp_outgoing_address 192.168.220.1 parent_peer

# to properly get cache digest from parent
tcp_outgoing_address 192.168.220.1 parent_squid

# sent all other packets via ISP2
tcp_outgoing_address yyy.yyy.yyy.239 local_net

parent squid (192.168.220.2) configuration file

acl main_squid src 192.168.220.1
acl FILE_TO_CACHE urlpath_regex -i \.(zip|iso|rar)$

cache allow FILE_TO_CACHE
cache deny all

http_access allow main_squid
http_access allow localhost
http_access deny all

icp_port 3130
icp_access allow main_squid
icp_access deny all

http_port 192.168.220.2:3128

cache_mem 12 GB
maximum_object_size_in_memory 64 MB
minimum_object_size 16384 KB
maximum_object_size 1024 MB

cache_swap_low 93
cache_swap_high 98

refresh_pattern \.iso$ 129600 100 129600 override-lastmod override-expire ignore-reload
refresh_pattern \.zip$ 129600 100 129600 override-lastmod override-expire ignore-reload
refresh_pattern \.rar$ 129600 100 129600 override-lastmod override-expire ignore-reload

cache_effective_user squid
cache_effective_group squid
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.