SQUID and Load Balancing doesn't work!!!! I tried for a week but nothing :'(
-
Load Balancing in PFsense work OK ;) ;).. I work with load balancing in pfsense 1.2.3 and 2.0 Alpha but in my work we need Squid and Load Balancing, and at moment work with 2 pcs but I want to work in one machine or one PC.
I am so exhausted, I tried and I tried again and again for a week work SQUID and LOAD BALANCING but nothing :'( :'( :'(, only work with one WAN not with 2 WAN. I am not newbie I work with Pfsense for 2 years. It is amazing firewall, but I need your help now :-.. I do not know that I am wrong or maybe really doesn't work.. PLEASE anybody tell me if PFSENSE 2.0 work Squid and Loab Balancing.. and send me a example (if possible send money) because people and everyone says that pfsense works well but nobody shows an example or someone has been working Squid and LOAD Balancing at the same time for a long time.thanks a lot of from Peru… ;)
PD: I used different version of Pfsense 2.0, here send a picture from my configuration and file with rules.debug
#System aliases loopback = "{ lo0 }" WAN = "{ vr0 }" LAN = "{ xl0 }" OPT1 = "{ xl1 }" # User Aliases set loginterface vr0 set loginterface xl0 set loginterface xl1 set optimization normal set limit states 47000 set skip on pfsync0 scrub in on $WAN all fragment reassemble scrub in on $LAN all fragment reassemble scrub in on $OPT1 all fragment reassemble nat-anchor "natearly/*" nat-anchor "natrules/*" # Outbound NAT rules # Subnets to NAT tonatsubnets = "{ 192.168.55.0/24 }" no nat on $WAN to port tftp nat on $WAN from $tonatsubnets port 500 to any port 500 -> 192.168.1.111/32 port 500 nat on $WAN from $tonatsubnets port 4500 to any port 4500 -> 192.168.1.111/32 port 4500 nat on $WAN from $tonatsubnets port 5060 to any port 5060 -> 192.168.1.111/32 port 5060 nat on $WAN from $tonatsubnets to any -> 192.168.1.111/32 port 1024:65535 no nat on $OPT1 to port tftp nat on $OPT1 from $tonatsubnets port 500 to any port 500 -> 192.168.20.31/32 port 500 nat on $OPT1 from $tonatsubnets port 4500 to any port 4500 -> 192.168.20.31/32 port 4500 nat on $OPT1 from $tonatsubnets port 5060 to any port 5060 -> 192.168.20.31/32 port 5060 nat on $OPT1 from $tonatsubnets to any -> 192.168.20.31/32 port 1024:65535 #SSH Lockout Table table <sshlockout>persist # Load balancing anchor rdr-anchor "relayd/*" # TFTP proxy rdr-anchor "tftp-proxy/*" # Setup Squid proxy redirect rdr on xl0 proto tcp from any to !(xl0) port 80 -> 127.0.0.1 port 80 # UPnPd rdr anchor rdr-anchor "miniupnpd" anchor "relayd/*" anchor "firewallrules" #--------------------------------------------------------------------------- # default deny rules #--------------------------------------------------------------------------- block in log all label "Default deny rule" block out log all label "Default deny rule" # We use the mighty pf, we cannot be fooled. block quick proto { tcp, udp } from any port = 0 to any block quick proto { tcp, udp } from any to any port = 0 # Block all IPv6 block in quick inet6 all block out quick inet6 all # snort2c table <snort2c>persist block quick from <snort2c>to any label "Block snort2c hosts" block quick from any to <snort2c>label "Block snort2c hosts" # package manager early specific hook anchor "packageearly" # carp anchor "carp" # SSH lockout block in log quick proto tcp from <sshlockout>to any port 22 label "sshlockout" table <virusprot>block in quick from <virusprot>to any label "virusprot overload table" antispoof for vr0 antispoof for xl0 # allow access to DHCP server on LAN anchor "dhcpserverLAN" pass in on $LAN proto udp from any port = 68 to 255.255.255.255 port = 67 label "allow access to DHCP server" pass in on $LAN proto udp from any port = 68 to 192.168.55.1 port = 67 label "allow access to DHCP server" pass out on $LAN proto udp from 192.168.55.1 port = 67 to any port = 68 label "allow access to DHCP server" antispoof for xl1 anchor "spoofing" # loopback anchor "loopback" pass in on $loopback all label "pass loopback" pass out on $loopback all label "pass loopback" anchor "firewallout" # let out anything from the firewall host itself and decrypted IPsec traffic pass out all keep state allow-opts label "let out anything from firewall host itself" # make sure the user cannot lock himself out of the webConfigurator or SSH anchor "anti-lockout" pass in quick on xl0 from any to (xl0) keep state label "anti-lockout rule" # NAT Reflection rules # User-defined rules follow pass out quick on { vr0 } proto tcp from any to <vpns>keep state label "NEGATE_ROUTE: Negate policy route for vpn(s)" pass out quick on { vr0 } route-to { ( vr0 192.168.1.1 ) , ( xl1 192.168.20.1 ) } round-robin proto tcp from any to any port = 80 keep state label "USER_RULE" pass in quick on $LAN from 192.168.55.0/24 to <vpns>keep state label "NEGATE_ROUTE: Negate policy route for vpn(s)" pass in quick on $LAN route-to { ( vr0 192.168.1.1 ) , ( xl1 192.168.20.1 ) } round-robin from 192.168.55.0/24 to any keep state label "USER_RULE: Default allow LAN to any rule" # VPN Rules # package manager late specific hook anchor "packagelate" # Setup squid pass rules for proxy pass in quick on xl0 proto tcp from any to !(xl0) port 80 flags S/SA keep state pass in quick on xl0 proto tcp from any to !(xl0) port 3128 flags S/SA keep state anchor "limitingesr" # uPnPd anchor "miniupnpd"</vpns></vpns></virusprot></virusprot></sshlockout></snort2c></snort2c></snort2c></sshlockout> ```  -
Add a rule under Floating rules as:
pass out quick route-to { ( vr0 192.168.1.1 ) , ( xl1 192.168.20.1 ) } round-robin from 127.0.0.1/24 to any keep state label "USER_RULE:Squid balance" -
like for example this:
# User-defined rules follow pass out quick on { vr0 } proto tcp from any to <vpns> keep state label "NEGATE_ROUTE: Negate policy route for vpn(s)" pass out quick on { vr0 } route-to { ( vr0 192.168.1.1 ) , ( xl1 192.168.20.1 ) } round-robin proto tcp from any to any port = 80 keep state label "USER_RULE" pass out quick route-to { ( vr0 192.168.1.1 ) , ( xl1 192.168.20.1 ) } round-robin from 127.0.0.1/24 to any keep state label "USER_RULE:Squid balance" pass in quick on $LAN from 192.168.55.0/24 to <vpns> keep state label "NEGATE_ROUTE: Negate policy route for vpn(s)" pass in quick on $LAN route-to { ( vr0 192.168.1.1 ) , ( xl1 192.168.20.1 ) } round-robin from 192.168.55.0/24 to any keep state label "USER_RULE: Default allow LAN to any rule"</vpns></vpns>I will try again and I will tell you if all is ok
-
I have tried adding a rule in floating tab, but I didn't have success, I have tried almost everything including Ermal's help with no success. When the connection comes from the BALANCE GATEWAY.. the load balance apparently works with Squid but WAN1 is the only one working, WAN2 doesn't work, I guess I need a exact rule in floating rule, but how I say I have tried a lots of rules in floating tab
like for example
Floating Rules:
pass out quick route-to { ( vr0 192.168.1.1 ) , ( xl1 192.168.20.1 ) } round-robin from 127.0.0.1/24 to any keep state label "USER_RULE"but nothing i tried also this rule:
Floating Rules:
pass out quick on { vr0 } route-to { ( vr0 192.168.1.1 ) , ( xl1 192.168.20.1 ) } round-robin proto tcp from any to any port = 80 keep state label "USER_RULE"I'm sure there are many people who have the same problem and it would be helpful to know the correct configuration. Squid and Load Balancing works in one machine would be excellent
-
Hi!
The problem is that Squid2 doesn't understand Load Balancing feature:
http://doc.pfsense.org/index.php/HOWTO_troubleshoot_loadbalancing_issues#Squid_doesn.27t_seem_to_be_using_both_connections
So you MUST use squid3 (available in the Packages section).NOTE: Squid3 doesn't work properly in TRANSPARENT MODE, so you can't filter http traffic with SquidGuard without manually force the browser to use proxy in every lan client! >:(
-
I have tried adding a rule in floating tab, but I didn't have success, I have tried almost everything including Ermal's help with no success. When the connection comes from the BALANCE GATEWAY.. the load balance apparently works with Squid but WAN1 is the only one working, WAN2 doesn't work, I guess I need a exact rule in floating rule, but how I say I have tried a lots of rules in floating tab
like for example
Floating Rules:
pass out quick route-to { ( vr0 192.168.1.1 ) , ( xl1 192.168.20.1 ) } round-robin from 127.0.0.1/24 to any keep state label "USER_RULE"but nothing i tried also this rule:
Floating Rules:
pass out quick on { vr0 } route-to { ( vr0 192.168.1.1 ) , ( xl1 192.168.20.1 ) } round-robin proto tcp from any to any port = 80 keep state label "USER_RULE"I'm sure there are many people who have the same problem and it would be helpful to know the correct configuration. Squid and Load Balancing works in one machine would be excellent
Do not select an interface at the floating tab rule creation.
-
Well bad news :'( :'( :'(.. I woke up one morning realizing that I had everything set up but nothing I prove everything with all possibles rules in floating and nothing,
rules like for exampleFloating Rules
pass out quick route-to { ( vr0 192.168.1.1 ) , ( xl1 192.168.20.1 ) } round-robin from 127.0.0.1/24 to any keep state label "USER_RULE"nothing ???.. other rules, the rules below doesn't work >:(:
User-defined rules follow
pass out quick route-to { ( vr0 192.168.1.1 ) , ( xl1 192.168.20.1 ) } round-robin proto tcp from 127.0.0.1 to any port = 80 keep state label "USER_RULE"
pass in quick on $LAN route-to { ( vr0 192.168.1.1 ) , ( xl1 192.168.20.1 ) } round-robin from 192.168.55.0/24 to any keep state label "USER_RULE: Default allow LAN to any rule"let me tell you that i prove thousands of rules but nothing :-, I will prove again this weekend but I almost sure that IS NOT POSSIBLE USE SQUID AND LOAD BALANCING IN PFSENSE 2.0 :-[.
My friend Ermal tell me that this is possible :o, but I wonder if there is person that work with SQUID and BALANCE ( I think that none)..
Ermal if you send me one configuration that I can use in my network :-[ I will send a beautiful gift from Peru.. jajaj well your help is appreciable
I beg you send me a setup that really works.. my whole country will thank you ;) -
CONCLUSION:
SQUID and LOAD BALANCING doesn't work together.. why??? well is a little hard to explain, you can see more details in picture below, Squid only work with DEFAULT GATEWAY not with LOAD BALANCE GATEWAY, Squid choose one gateway, and this gateway is "DEFAULT GATEWAY"
See the pictures please
PS: All configuration is OK including the floating, Load Balancing works fine and Squid also.. but when Squid and Balance works, Squid only works with one Gateway or one WAN INTERFACE.. it can be WAN or OPT1.. I thought that Squid was working with Virtual Interface created by Load Balancing i.e that two WANs provide cache
-
Is it not possible to make the gateway-group default? I don't have Multi-WAN, so its only a thought… Maybe wrong.
-
Can you send your config.xml this is not going to take you/me anywhere like this.
-
Here I send config.xml I hope all is OK.. if you have other thinks please only tell me..
<pfsense><version>6.0</version> <lastchange></lastchange> <theme>pfsense_ng</theme> <sysctl><desc>Set the ephemeral port range to be lower.</desc> <tunable>net.inet.ip.portrange.first</tunable> <value>1024</value> <desc>Drop packets to closed TCP ports without returning a RST</desc> <tunable>net.inet.tcp.blackhole</tunable> <value>2</value> <desc>Do not send ICMP port unreachable messages for closed UDP ports</desc> <tunable>net.inet.udp.blackhole</tunable> <value>1</value> <desc>Randomize the ID field in IP packets (default is 0: sequential IP IDs)</desc> <tunable>net.inet.ip.random_id</tunable> <value>1</value> <desc>Drop SYN-FIN packets (breaks RFC1379, but nobody uses it anyway)</desc> <tunable>net.inet.tcp.drop_synfin</tunable> <value>1</value> <desc>Enable sending IPv4 redirects</desc> <tunable>net.inet.ip.redirect</tunable> <value>1</value> <desc>Enable sending IPv6 redirects</desc> <tunable>net.inet6.ip6.redirect</tunable> <value>1</value> <desc>Generate SYN cookies for outbound SYN-ACK packets</desc> <tunable>net.inet.tcp.syncookies</tunable> <value>1</value> <desc>Maximum incoming/outgoing TCP datagram size (receive)</desc> <tunable>net.inet.tcp.recvspace</tunable> <value>65228</value> <desc>Maximum incoming/outgoing TCP datagram size (send)</desc> <tunable>net.inet.tcp.sendspace</tunable> <value>65228</value> <desc>IP Fastforwarding</desc> <tunable>net.inet.ip.fastforwarding</tunable> <value>1</value> <desc>Do not delay ACK to try and piggyback it onto a data packet</desc> <tunable>net.inet.tcp.delayed_ack</tunable> <value>0</value> <desc>Maximum outgoing UDP datagram size</desc> <tunable>net.inet.udp.maxdgram</tunable> <value>57344</value> <desc>Handling of non-IP packets which are not passed to pfil (see if_bridge(4))</desc> <tunable>net.link.bridge.pfil_onlyip</tunable> <value>0</value> <desc>Set to 0 to disable filtering on the incoming and outgoing member interfaces.</desc> <tunable>net.link.bridge.pfil_member</tunable> <value>1</value> <desc>Set to 1 to enable filtering on the bridge interface</desc> <tunable>net.link.bridge.pfil_bridge</tunable> <value>0</value> <desc>Allow unprivileged access to tap(4) device nodes</desc> <tunable>net.link.tap.user_open</tunable> <value>1</value> <desc>Verbosity of the rndtest driver (0: do not display results on console)</desc> <tunable>kern.rndtest.verbose</tunable> <value>0</value> <desc>Randomize PID's (see src/sys/kern/kern_fork.c: sysctl_kern_randompid())</desc> <tunable>kern.randompid</tunable> <value>347</value> <desc>Maximum size of the IP input queue</desc> <tunable>net.inet.ip.intr_queue_maxlen</tunable> <value>1000</value> <desc>Disable CTRL+ALT+Delete reboot from keyboard.</desc> <tunable>hw.syscons.kbd_reboot</tunable> <value>0</value> <desc>Enable TCP Inflight mode</desc> <tunable>net.inet.tcp.inflight.enable</tunable> <value>1</value> <desc>Enable TCP extended debugging</desc> <tunable>net.inet.tcp.log_debug</tunable> <value>0</value> <desc>Set ICMP Limits</desc> <tunable>net.inet.icmp.icmplim</tunable> <value>750</value> <desc>TCP Offload Engine</desc> <tunable>net.inet.tcp.tso</tunable> <value>0</value> <desc>TCP Offload Engine - BCE</desc> <tunable>hw.bce.tso_enable</tunable> <value>0</value></sysctl> <system><optimization>normal</optimization> <hostname>pfsense</hostname> <domain>local</domain> <group><name>all</name> <description>All Users</description> <scope>system</scope> <gid>1998</gid> <member>0</member></group> <group><name>admins</name> <description>System Administrators</description> <scope>system</scope> <gid>1999</gid> <member>0</member> <priv>page-all</priv></group> <user><name>admin</name> <fullname>System Administrator</fullname> <scope>system</scope> <groupname>admins</groupname> <password>$1$dSJImFph$GvZ7.1UbuWu.Yb8etC0re.</password> <uid>0</uid> <priv>user-shell-access</priv></user> <nextuid>2000</nextuid> <nextgid>2000</nextgid> <timezone>Etc/UTC</timezone> <time-update-interval></time-update-interval> <timeservers>0.pfsense.pool.ntp.org</timeservers> <webgui><protocol>http</protocol></webgui> <disablenatreflection>yes</disablenatreflection> <dns1gwint>wan</dns1gwint> <dns2gwint>none</dns2gwint> <dns3gwint>none</dns3gwint> <dns4gwint>none</dns4gwint> <dnsserver>200.48.225.130</dnsserver> <dnsserver>200.31.108.106</dnsserver> <dnsallowoverride></dnsallowoverride></system> <interfaces><lan><if>xl0</if> <ipaddr>192.168.55.1</ipaddr> <subnet>24</subnet> <media></media> <mediaopt></mediaopt> <bandwidth>100</bandwidth> <bandwidthtype>Mb</bandwidthtype> <descr>LAN</descr></lan> <opt1><descr>OPT1</descr> <if>xl1</if> <enable><ipaddr>192.168.20.34</ipaddr> <subnet>24</subnet> <gateway>americatel</gateway> <spoofmac></spoofmac></enable></opt1> <wan><if>vr0</if> <mtu><media></media> <mediaopt></mediaopt> <bandwidth>100</bandwidth> <bandwidthtype>Mb</bandwidthtype> <descr>WAN</descr> <enable><ipaddr>192.168.1.251</ipaddr> <subnet>24</subnet> <gateway>telefonica</gateway> <spoofmac></spoofmac></enable></mtu></wan></interfaces> <staticroutes></staticroutes> <pppoe><username></username> <password></password></pppoe> <pptp><username></username> <password></password> <local></local></pptp> <dhcpd><lan><enable><range><from>192.168.55.100</from> <to>192.168.55.200</to></range></enable></lan></dhcpd> <pptpd><localip></localip></pptpd> <dnsmasq><enable></enable></dnsmasq> <snmpd><syslocation></syslocation> <syscontact></syscontact> <rocommunity>public</rocommunity></snmpd> <diag><ipv6nat><ipaddr></ipaddr></ipv6nat></diag> <nat><ipsecpassthru><enable></enable></ipsecpassthru></nat> <filter><rule><id><type>pass</type> <tag><tagged><direction>out</direction> <quick>yes</quick> <floating>yes</floating> <max-src-nodes><max-src-states><statetimeout><statetype>keep state</statetype> <source> <address>127.0.0.1/24</address> <destination><any></any></destination> <descr><gateway>balanceo</gateway></descr></statetimeout></max-src-states></max-src-nodes></tagged></tag></id></rule> <rule><id><type>pass</type> <interface>lan</interface> <max-src-nodes><max-src-states><statetimeout><statetype>keep state</statetype> <source> <network>lan</network> <destination><any></any></destination> <descr>Default allow LAN to any rule</descr> <gateway>balanceo</gateway></statetimeout></max-src-states></max-src-nodes></id></rule></filter> <shaper></shaper> <ipsec><preferredoldsa></preferredoldsa></ipsec> <aliases></aliases> <proxyarp></proxyarp> <cron><minute>0</minute> <hour>*</hour> <mday>*</mday> <month>*</month> <wday>*</wday> <who>root</who> <command></command>/usr/bin/nice -n20 newsyslog <minute>1,31</minute> <hour>0-5</hour> <mday>*</mday> <month>*</month> <wday>*</wday> <who>root</who> <command></command>/usr/bin/nice -n20 adjkerntz -a <minute>1</minute> <hour>3</hour> <mday>1</mday> <month>*</month> <wday>*</wday> <who>root</who> <command></command>/usr/bin/nice -n20 /etc/rc.update_bogons.sh <minute>*/60</minute> <hour>*</hour> <mday>*</mday> <month>*</month> <wday>*</wday> <who>root</who> <command></command>/usr/bin/nice -n20 /usr/local/sbin/expiretable -v -t 3600 sshlockout <minute>1</minute> <hour>1</hour> <mday>*</mday> <month>*</month> <wday>*</wday> <who>root</who> <command></command>/usr/bin/nice -n20 /etc/rc.dyndns.update <minute>*/60</minute> <hour>*</hour> <mday>*</mday> <month>*</month> <wday>*</wday> <who>root</who> <command></command>/usr/bin/nice -n20 /usr/local/sbin/expiretable -v -t 3600 virusprot <minute>*/5</minute> <hour>*</hour> <mday>*</mday> <month>*</month> <wday>*</wday> <who>root</who> <command></command>/usr/bin/nice -n20 /usr/local/bin/checkreload.sh <minute>*/5</minute> <hour>*</hour> <mday>*</mday> <month>*</month> <wday>*</wday> <who>root</who> <command></command>/usr/bin/nice -n20 /etc/ping_hosts.sh</cron> <rrd><enable></enable></rrd> <revision><time>1254853809</time></revision> <gateways><gateway_item><interface>wan</interface> <name>telefonica</name> <gateway>192.168.1.1</gateway> <descr><monitor>200.48.225.130</monitor> <defaultgw></defaultgw></descr></gateway_item> <gateway_item><interface>opt1</interface> <name>americatel</name> <gateway>192.168.20.1</gateway> <descr><monitor>200.48.225.146</monitor></descr></gateway_item> <gateway_group><name>balanceo</name> telefonica|1 americatel|1 <trigger>down</trigger></gateway_group></gateways> <installedpackages><package><name>squid</name> <descr>High performance web proxy cache.</descr> <website>http://www.squid-cache.org/</website> <category>Network</category> <version>2.6.21_10</version> <status>Stable</status> <required_version>1.2.1</required_version> <maintainer>fernando@netfilter.com.br seth.mos@xs4all.nl mfuchs77@googlemail.com</maintainer> <depends_on_package_base_url>http://files.pfsense.org/packages/7/All/</depends_on_package_base_url> <depends_on_package>squid-2.6.21.tbz</depends_on_package> <depends_on_package>squid_radius_auth-1.10.tbz</depends_on_package> <depends_on_package>openldap-client-2.4.10.tbz</depends_on_package> <config_file>http://www.pfsense.org/packages/config/squid/squid.xml</config_file> <configurationfile>squid.xml</configurationfile> <noembedded>true</noembedded> <filter_rule_function>squid_generate_rules</filter_rule_function></package> <menu> <name>Proxy server</name> <tooltiptext>Modify the proxy server's settings</tooltiptext> Services <url>/pkg_edit.php?xml=squid.xml&id=0</url> </menu> <tab><text>General settings</text> <url>/pkg_edit.php?xml=squid.xml&id=0</url> <active></active></tab> <service><name>squid</name> <rcfile>squid.sh</rcfile> <executable>squid</executable> <description>Proxy server Service</description></service> <squid><config><active_interface>lan</active_interface> <allow_interface>on</allow_interface> <transparent_proxy>on</transparent_proxy> <private_subnet_proxy_off><defined_ip_proxy_off><log_enabled><log_dir>/var/squid/log</log_dir> <log_rotate><proxy_port>3128</proxy_port> <icp_port><visible_hostname>localhost</visible_hostname> <admin_email>admin@localhost</admin_email> <error_language>English</error_language> <disable_xforward><disable_via><uri_whitespace>strip</uri_whitespace> <dns_nameservers><disable_squidversion></disable_squidversion></dns_nameservers></disable_via></disable_xforward></icp_port></log_rotate></log_enabled></defined_ip_proxy_off></private_subnet_proxy_off></config></squid></installedpackages></pfsense>Best regards
-
Is it not possible to make the gateway-group default? I don't have Multi-WAN, so its only a thought… Maybe wrong.
Well Squid only work with the local IP 127.0.0.1 then Squid works with default gateway, it doesn't work with gateway-group, you can see in the picture below an example, if I take OPT1 like defaul gateway then Squid works with OPT1 interface, if you take WAN like default gateway then Squid work with Wan interface.
-
The only problem i see in your config is that you might want to try
from:<address>127.0.0.1/24</address>
to:
<address>127.0.0.1/8</address>
afterwards i need access to the system.
-
All work fine, SQUID + LOAD BALANCING, but apparently, SQUID only works with default gateway, if you remove WAN or turn off ADSL telefonica, you will not have internet but will continue to operate Squid
PLEASE SEE THE PICTURE BELOW.
SQUID + LOAD BALANCING DOESN'T WORK
-
Do you by any chance have sticky-connections active?!
-
:-[ I don't have sticky-connection you can see below in the picture, now I prove again the squid and load balancing and nothing
-
anyone have this working?
-
All work fine, SQUID + LOAD BALANCING, but apparently, SQUID only works with default gateway, if you remove WAN or turn off ADSL telefonica, you will not have internet but will continue to operate Squid
PLEASE SEE THE PICTURE BELOW.
SQUID + LOAD BALANCING DOESN'T WORK
I know this is an old post but I'm seeing the same symptoms as the OP, squid works fine with load balancing but if the default gateway modem is turned off/unplugged, clients are unable to browse the internet.
Slam
-
How you are creating rules?
-
Hi Ermal
Action: PASS / Quick: TICKED / Interface: NONE / Direction: OUT / Protocol: TCP / Source: 127.0.0.1 / Dst: ANY / Dst Port Range: 80 / GW: Multiwan
I think that rule is correct, appologies if I have it wrong!
Thanks
Slam
EDIT
I have squid bound to LAN/CP1/CP2, all 3 interfaces have gateway also set to Multiwan in their respective rules, I dont know if thats relevant.