1

I'm having difficulties configuring Squid 3.3 to do both "load-balancing" over multiple WAN links (using random ACLs + tcp_outgoing_address options) and to also have a "reverse proxy".

It works just fine when I configure the one (load balancing) or the other (reverse proxy), but when both are configured, the reverse proxy no longer works correctly.

Packet captures show the reverse proxy traffic that would normally be send out on the LAN interface, is now being output on the WAN interface instead (and therefore doesn't reach the internal hosts on the LAN). Clearly something about the "tcp_outgoing_address" setting is also being applied to the reverse proxy traffic too, instead of just the forward proxy traffic.

Below is what I use for the load balancing config:

acl fiftyPercent random 0.5
tcp_outgoing_address <<WAN1-IP-HERE>> fiftyPercent
tcp_outgoing_address <<WAN2-IP-HERE>>

Refer - http://wiki.squid-cache.org/Features/AclRandom

I know too little of Squid and my searches of countless posts have yielded nothing (yet). Does anyone know how I can apply the load-balancing to only apply to forward proxy traffic, and still have the reverse proxy traffic work as if it isn't set?

1

Create an ACL for the reverse-proxy traffic and set tcp_outgoing_address <<LAN-IP-HERE>> for it.

  • Thanks for the suggestion. Could you be more specific? I.e. what do I need to look for in the .conf file and where (before/after) what should I place "tcp_ougroing_address <>" ? Also, did you mean literally "<>" ? – Jaans Jan 14 '15 at 6:40
  • Did you literally mean "<>" in <<WAN1-IP-HERE>> ? – drookie Jan 14 '15 at 7:36
  • I was as specific as your description was. All you need is to tell squid to stop applying tcp_outgoing_address rule to the proxied traffic. Because right now you are telling him that these rules should be applied. – drookie Jan 14 '15 at 7:37
  • Given that there was nothing in between your "<>" from your original answer, resulted in ambiguity and hence my query. I see you've since edit your answer and replaced it with "<<LAN-IP-HERE>>" which now makes sense. Thanks for that. As for the specificity of my description, if you need me to be more specific about something please just ask. Sarcasm doesn't help anyone - that's why I'm here in the first place. As I stated, I don't know enough about it. Your comment to get Squid to not apply that tcp_outgoing_address option makes sense. I just don't know how or where in the config to do that. – Jaans Jan 14 '15 at 8:02
  • @kasperd edited my answer, LAN-IP-HERE was originally in it. you probably saw the answer while it was edited. – drookie Jan 14 '15 at 8:47
1

I figured out how to fix my issue.

Whilst drookie's suggestion to create and ACL for the reverse proxy and apply the tcp_outgoing_address tag to it almost seemed obvious, I had no clue where to begin, let alone how the ACLs are defined / processed.

First I had to figure out how the Squid.conf is interpreted (ie. top-to-bottom for first-matched ACLs) and what some of the various "tags" mean. I found the following link quite useful to get some basics under the belt: http://www.deckle.co.uk/squid-users-guide/squid-configuration-basics.html

After grokking the Squid.conf we had, I figured out that the existing reverse-proxy configuration already had ACLs defined (it needed to for the cache_peer_access tags).

I then figured out how these are interpreted by Squid (i.e. the order, precedence, overrides, etc.).

All I needed to do was to add the following (each line is for each reverse-proxy ACL already defined. 192.168.0.254 is the IP of my LAN side interface):

tcp_outgoing_address 192.168.0.254 OWA_URI_pfs
tcp_outgoing_address 192.168.0.254 rvm_Extranet
tcp_outgoing_address 192.168.0.254 rvm_Prototype
tcp_outgoing_address 192.168.0.254 rvm_WebService
tcp_outgoing_address 192.168.0.254 rvm_License

This could then be followed by:

acl fiftyPercent random 0.5
tcp_outgoing_address <<WAN1-IP-HERE>> fiftyPercent
tcp_outgoing_address <<WAN2-IP-HERE>>

The result is that the reverse-proxy traffic goes out the specified LAN side IP, and then the remainder of all other traffic is load-balanced out via the random ACL.

Hope that helps anyone else who might run into a similar issue.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.