3

We have two Squid proxy servers for High availability. We want to use Amazon ELB in front of these Squid proxy servers.
When we use Load Balancer Protocol as TCP and port 8080, Instance Protocol TCP and port 3128 -- After exporting squid proxy using ELB name on the test instances, we are able to connect to internet.

But

When we use Load Balancer Protocol as HTTP and port 80, Instance Protocol HTTP and port 3128 -- After exporting squid proxy using ELB name on the test instances, we are not able to connect to internet.

Squid proxy configuration is the original configuration file that we get with the package. We have only added the virtual hostname.

Is it possible to use HTTP instead of TCP?

Improve this question
3
  • Wait. You found a configuration that is working, but you want to change it?
    – EEAA
    May 17, 2016 at 12:03
  • We want to change the protocol from TCP to HTTP in the ELB listeners.
    – Neetika
    May 19, 2016 at 5:30
  • I understand. Why?
    – EEAA
    May 19, 2016 at 12:09

2 Answers 2

Reset to default
3

I suspect they want to get at the X-Forwarded-For original IP of the requestor for the logs. I know I am.

ELBs don't forward these headers when using TCP in the ELB, but if you set to HTTP/3128 then it does. But now squid doesn't work.

$ curl -v -x http://MYELB.us-east-1.elb.amazonaws.com:3128 -L http://httpbin.org/ip
* Hostname was NOT found in DNS cache
*   Trying 10.0.153.134...
* Connected to MYELB.us-east-1.elb.amazonaws.com (10.0.153.134) port 3128 (#0)
> GET http://httpbin.org/ip HTTP/1.1
> User-Agent: curl/7.35.0
> Host: httpbin.org
> Accept: */*
> Proxy-Connection: Keep-Alive
>
< HTTP/1.1 400 Bad Request
< Content-Language: en
< Content-Type: text/html;charset=utf-8
< Date: Mon, 06 Jun 2016 17:25:17 GMT
< Mime-Version: 1.0
* Server squid/3.5.12 is not blacklisted
< Server: squid/3.5.12
< Vary: Accept-Language
< Via: 1.1 ip-10-0-139-174 (squid/3.5.12)
< X-Cache: MISS from ip-10-0-139-174
< X-Cache-Lookup: NONE from ip-10-0-139-174:3128
< X-Squid-Error: ERR_INVALID_URL 0
< Content-Length: 3540
< Connection: keep-alive

If you look at the TCPDUMP from the squid box you see this:

GET /ip HTTP/1.1
host: httpbin.org:3128
Accept: */*
Proxy-Connection: Keep-Alive
User-Agent: curl/7.35.0
X-Forwarded-For: 172.17.0.5
X-Forwarded-Port: 3128
X-Forwarded-Proto: http
Connection: keep-alive

Which squid barfs on because it isn't a real URL (the server got stripped out of the GET):

HTTP/1.1 400 Bad Request
Server: squid/3.5.12
Mime-Version: 1.0
Date: Mon, 06 Jun 2016 17:28:07 GMT
Content-Type: text/html;charset=utf-8
Content-Length: 3540
X-Squid-Error: ERR_INVALID_URL 0
Vary: Accept-Language
Content-Language: en
X-Cache: MISS from ip-10-0-139-174
X-Cache-Lookup: NONE from ip-10-0-139-174:3128
Via: 1.1 ip-10-0-139-174 (squid/3.5.12)
Connection: close

Any ideas on how to get the ELB to pass the server name? Also not clear why the host header has port 3128 on it.

Improve this answer
3

I suppose you want to change your ELB to use HTTP, since you want to log the client IP address.

You have 2 options to achieve this -
1. Use your ELB with TCP (and NOT HTTP), and configure it to forward the client IP using the proxy protocol. read more about it here
2. upgrade squid to version 3.5 (or above), and use the built in proxy protocol. here is a link to the relevant section in the release notes

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .