I'm trying to set up a two-node squid proxy cluster. It would be a normal proxy (neither reverse, nor transparent).

I'm using LVS (kernel 2.6.32, ipvsadm v.1.2.1, tunneling) for load balancing, ldirectord (v. 1.0.3) for HA, squid (v.3.1.7) as a proxy server.

The cluster works OK for most sites, but experiences problems with (for instance) login to google accounts, login to serverfault.com via OpenID, etc. It seems that problems appear at sites with some kind of redirect, though on other sites 301-coded redirects work fine. When I work directly through each proxy node, everything is OK. I tried different types of job scheduling algorithms in LVS, but it didn't help. Leaving only one node in the cluster also doesn't solve the problem. Squid's access.log and cache.log are also "clean", no errors appear, just a normal acivity.

Did anybody met such problems? Does anybody have a working cluster of this type (balanced with IPVS)? Any ideas on troubleshooting?

Here are some parts of config files: ldirectord.cf:

# Virtual Server for HTTP_PROXY
        real= ipip 30
        real= ipip 40
        receive="Google Search"


http_port # "real" IP of the node
http_port # "Virtual" IP of the cluster on tunl0 interface
cache_mem 300 MB
cache_dir ufs /opt/squid/var/cache 500 16 256
cache_effective_user squid
cache_effective_group squid
visible_hostname AQUA-node
cachemgr_passwd SquidCM all
access_log /opt/squid/var/logs/access.log
logfile_rotate 5

# ICQ connect (experimental)
acl ICQ_ADDR dst
acl ICQ_PORT port 5190 443
acl ICQ_DOMAIN dstdomain .icq.com .aol.com .aim.com
always_direct   allow   ICQ_DOMAIN ICQ_PORT CONNECT
always_direct   allow   ICQ_ADDR   ICQ_PORT CONNECT

acl allnet_temp src
http_access allow allnet_temp

http_access deny all

If any other information needed, just let me know.

  • According to access.log, load balancer sends requests to the server, from which the session was started. It seems, that the problem is in Squid. But it doesn't appear, when load balancing not used (proxy node used directly). – HUB Oct 7 '10 at 16:00

Try to use lblc,lblcr or sh scheduler. lblcr is best for cache proxy. Problems due to round-robin connection balancing.

Does anybody have a working cluster of this type (balanced with IPVS)? Any ideas on troubleshooting?

I have two http-proxy cluster(10-12 proxy in cluster). Use LVS(lblcr,ipip tunneling,squid 2.7 transparent)

  • Thanks for the response. I've tried different types of schedulers before posting the question. At this moment, I use SH scheduler. According to access.log, all requests during gmail loading (for example) go to one server: 1286456647.121 147 TCP_MISS/302 1067 GET http://mail.google.com/mail/ - DIRECT/ text/html 1286456657.312 10182 TCP_MISS/200 133 CONNECT www.google.com:443 - DIRECT/ - URL field in the browser: google.com/accounts/ServiceLogin?service=mail&... etc Any other thoughts? P.S. I'l try squid 2.7 for sure. – HUB Oct 7 '10 at 13:07
  • bindbn, I've tried latest squid 2.7.9. Gmail loads, but chat doesn't work. serverfault OpenID login didn't work either. Will try to ask squid comunity through maillist. – HUB Oct 7 '10 at 16:04

Problem solved.

I've built vanila kernel 2.6.35-7 with pv-ops (were needed because load balancer is a paravirtual machine) and LVS began working as needed. May be, this was a regression in Xenlinux kernel, may be just an old version bug. Versions of other software components didn't change.

P.S. Thanks to bindbn for scheduler choice tips.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.