SQUID and Load Balancing doesn't work!!!! I tried for a week but nothing :'(

rojocesar

Is it not possible to make the gateway-group default? I don't have Multi-WAN, so its only a thought… Maybe wrong.

Well Squid only work with the local IP 127.0.0.1 then Squid works with default gateway, it doesn't work with gateway-group, you can see in the picture below an example, if I take OPT1 like defaul gateway then Squid works with OPT1 interface, if you take WAN like default gateway then Squid work with Wan interface.

eri--

The only problem i see in your config is that you might want to try
from:

to:

afterwards i need access to the system.

rojocesar

All work fine, SQUID + LOAD BALANCING, but apparently, SQUID only works with default gateway, if you remove WAN or turn off ADSL telefonica, you will not have internet but will continue to operate Squid

PLEASE SEE THE PICTURE BELOW.

SQUID + LOAD BALANCING DOESN'T WORK

not_working.JPG_thumb

eri--

Do you by any chance have sticky-connections active?!

rojocesar

:-[ I don't have sticky-connection you can see below in the picture, now I prove again the squid and load balancing and nothing

sticky.JPG_thumb

rafael.cardoso

anyone have this working?

Slam

@rojocesar:

All work fine, SQUID + LOAD BALANCING, but apparently, SQUID only works with default gateway, if you remove WAN or turn off ADSL telefonica, you will not have internet but will continue to operate Squid

PLEASE SEE THE PICTURE BELOW.

SQUID + LOAD BALANCING DOESN'T WORK

I know this is an old post but I'm seeing the same symptoms as the OP, squid works fine with load balancing but if the default gateway modem is turned off/unplugged, clients are unable to browse the internet.

Slam

eri--

How you are creating rules?

Slam

Hi Ermal

Action: PASS / Quick: TICKED / Interface: NONE / Direction: OUT / Protocol: TCP / Source: 127.0.0.1 / Dst: ANY / Dst Port Range: 80 / GW: Multiwan

I think that rule is correct, appologies if I have it wrong!

Thanks

Slam

EDIT

I have squid bound to LAN/CP1/CP2, all 3 interfaces have gateway also set to Multiwan in their respective rules, I dont know if thats relevant.

eri--

You need direction out and source any.
You can even try with direction out and source WAN ip to try to tighten it.

Slam

@ermal:

You need direction out and source any.
You can even try with direction out and source WAN ip to try to tighten it.

I've tried the above suggestions without any luck.

On my testbed, I have 2 wans, currently wan2 is set as default gw, the interface is hooked up to a hub so that the interface shows as up as active, although the hub is not connected to anything. (I needed its modem for a production box)

wan1 is connected to a modem and not set for default gw.

I have tried almost everything, from unticking "Block private/bogon networks" to setting static IP and DNS on my client machine.

I hope the following can helps you track down the problem, if you need anymore information Ill be happy to help.

Routing tables

Internet:
Destination Gateway Flags Refs Use Netif Expire
default 78.xx.xx.xx UGS 2 70 fxp1 <–-wan2 gw set as default
10.0.0.0/24 link#10 U 0 0 re1_vl
10.0.0.1 link#10 UHS 0 0 lo0
10.0.1.0/24 link#11 U 0 0 re1_vl
10.0.1.1 link#11 UHS 0 0 lo0
10.0.2.0/24 link#12 U 0 0 re1_vl
10.0.2.1 link#12 UHS 0 0 lo0
10.0.20.0/24 link#13 U 0 0 re1_vl
10.0.20.1 link#13 UHS 0 0 lo0
78.xx.xx.xx/20 link#2 U 2 463 fxp1 <–-wan2 gw
78.xx.xx.xx link#2 UHS 0 0 lo0 <–-wan2 IP
94.xx.xx.xx/20 link#1 U 2 1051 fxp0 <–-wan1 gw
94.xx.xx.xx link#1 UHS 0 0 lo0 <–-wan1 IP
127.0.0.1 link#6 UH 0 19 lo0
127.0.0.2 127.0.0.1 UHS 0 0 lo0
192.168.5.0/24 link#3 U 1 25807 re0
192.168.5.1 link#3 UHS 0 0 lo0
192.168.50.0/24 link#9 U 0 0 re1_vl
192.168.50.1 link#9 UHS 0 0 lo0
208.67.220.220 94.xx.xx.xx UGHS 1 25 fxp0 <–-94.xx.xx.xx wan1 gw
208.67.222.222 78.xx.xx.xx UGHS 0 29 fxp1 <–-78.xx.xx.xx wan2 gw

config.xml rule

<rule><id><type>pass</type>
<tag><tagged><direction>out</direction>
<quick>yes</quick>
<floating>yes</floating>
<max><max-src-nodes><max-src-conn><max-src-states><statetimeout><statetype>keep state</statetype>
<os><nosync><protocol>tcp</protocol>
<source>
<any><destination><any><port>80</port></any></destination>
<descr>Load Balance Squid</descr>
<gateway>multiwan</gateway></any></nosync></os></statetimeout></max-src-states></max-src-conn></max-src-nodes></max></tagged></tag></id></rule>

pfctl -sr
NOTE: 94.xx.xx.xx is wan1 gw

pass out quick route-to (fxp0 94.xx.xx.xx) inet proto tcp from any to any port = http flags S/SA keep state label "USER_RULE: Load Balance Squid"

pfctl -sa Filter rules:
NOTE: 94.xx.xx.xx is wan1 gw

pass out quick route-to (fxp0 94.xx.xx.xx) inet proto tcp from any to any port = http flags S/SA keep state label "USER_RULE: Load Balance Squid"

Counters:

USER_RULE: Load Balance Squid 6 96 5040 0 0 96 5040

pfctl -s rules -vv
NOTE: 94.xx.xx.xx is wan1 gw

@119 pass out quick route-to (fxp0 94.xx.xx.xx) inet proto tcp from any to any port = http flags S/SA keep state label "USER_RULE: Load Balance Squid"
[ Evaluations: 0 Packets: 0 Bytes: 0 States: 0 ]
[ Inserted: uid 0 pid 28028 ]

rules.debug

pass out quick $multiwan proto tcp from any to any port 80 keep state label "USER_RULE: Load Balance Squid"

I dont know how much of the above is relevant, but I thought I'd post anyway ;D

Thanks in advance

Slam

eri--

Are you using Manual Outbound NAT?
pfctl -vvsr is the output i want to see actually.

Do you have issues on traffic with this rule?
Please show me even a pfctl -vvsn

While there can you try enable manual outbound NAT and add a rule with source any and external your wan1(94…../20) gw?
See if it works.

Slam

Ive included output for the those commands

pfctl -vvsr - command1.txt
pfctl -vvsn - command2.txt

I dont use outbound nat and dont even know how to use it, I got stuck when I tried to follow your comments, I've sent you a pm with details if you like access to the box yourself.

Thanks

Slam

eri--

Check out now it should be ok from what i see!?

If you want to tighten you can change the any in the outbound nat rules at the end to the respective interfaces subnet.

Slam

Ive just gave it another go, my browser just sits there trying to access the internet without any luck

is it ok to leave those other rules in outbound nat? will they interfere with the rules I have for the interfaces? shall i reboot and try?

Thanks

Slam

eri--

Just try out with static port ticked on those rules.

Slam

rebooted and still nothing

I tried connecting to redmine.pfsense.org with no luck and noticed this in https://pfsense/diag_dump_states.php

tcp 127.0.0.1:80 <- 69.64.6.27:80 <- 192.168.5.150:51417 ESTABLISHED:ESTABLISHED

Maybe Im just stupid, but isnt the flow meant to be like this?

tcp 69.64.6.27:80 <- 127.0.0.1:80 <- 192.168.5.150:51417 ESTABLISHED:ESTABLISHED

I appreciate the help you have given me, if it doesnt work with my setup then I guess nothing can be done about it, the box is still open if you want to poke around.

Thanks a lot

Slam

eri--

It wont work for https because its https and afaik squid package does not redirect https.

Slam

Sorry, I completely overlooked that, Ill test again later with a different setup.

Thanks

Slam

MrHorizontal

What's the outcome of this?

Is it working as it's an important reference to get other stuff within pfSense (looking at you, DNS) doing the load balancing mambo.