Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    SQUID and Load Balancing doesn't work!!!! I tried for a week but nothing :'(

    Scheduled Pinned Locked Moved 2.0-RC Snapshot Feedback and Problems - RETIRED
    54 Posts 17 Posters 25.2k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • R
      rojocesar
      last edited by

      All work fine, SQUID + LOAD BALANCING, but apparently, SQUID only works with default gateway, if you remove WAN or turn off ADSL telefonica, you will not have internet but will continue to operate Squid

      PLEASE SEE THE PICTURE BELOW.

      SQUID + LOAD BALANCING DOESN'T WORK

      not_working.JPG
      not_working.JPG_thumb

      1 Reply Last reply Reply Quote 0
      • E
        eri--
        last edited by

        Do you by any chance have sticky-connections active?!

        1 Reply Last reply Reply Quote 0
        • R
          rojocesar
          last edited by

          :-[ I don't have sticky-connection you can see below in the picture, now I prove again the squid and load balancing and nothing

          sticky.JPG
          sticky.JPG_thumb

          1 Reply Last reply Reply Quote 0
          • R
            rafael.cardoso
            last edited by

            anyone have this working?

            Respect is Everything!

            1 Reply Last reply Reply Quote 0
            • S
              Slam
              last edited by

              @rojocesar:

              All work fine, SQUID + LOAD BALANCING, but apparently, SQUID only works with default gateway, if you remove WAN or turn off ADSL telefonica, you will not have internet but will continue to operate Squid

              PLEASE SEE THE PICTURE BELOW.

              SQUID + LOAD BALANCING DOESN'T WORK

              I know this is an old post but I'm seeing the same symptoms as the OP, squid works fine with load balancing but if the default gateway modem is turned off/unplugged, clients are unable to browse the internet.

              Slam

              1 Reply Last reply Reply Quote 0
              • E
                eri--
                last edited by

                How you are creating rules?

                1 Reply Last reply Reply Quote 0
                • S
                  Slam
                  last edited by

                  Hi Ermal

                  Action: PASS / Quick: TICKED / Interface: NONE / Direction: OUT / Protocol: TCP / Source: 127.0.0.1 / Dst: ANY / Dst Port Range: 80 / GW: Multiwan

                  I think that rule is correct, appologies if I have it wrong!

                  Thanks

                  Slam

                  EDIT

                  I have squid bound to LAN/CP1/CP2, all 3 interfaces have gateway also set to Multiwan in their respective rules, I dont know if thats relevant.

                  1 Reply Last reply Reply Quote 0
                  • E
                    eri--
                    last edited by

                    You need direction out and source any.
                    You can even try with direction out and source WAN ip to try to tighten it.

                    1 Reply Last reply Reply Quote 0
                    • S
                      Slam
                      last edited by

                      @ermal:

                      You need direction out and source any.
                      You can even try with direction out and source WAN ip to try to tighten it.

                      I've tried the above suggestions without any luck.

                      On my testbed, I have 2 wans, currently wan2 is set as default gw, the interface is hooked up to a hub so that the interface shows as up as active, although the hub is not connected to anything. (I needed its modem for a production box)

                      wan1 is connected to a modem and not set for default gw.

                      I have tried almost everything, from unticking "Block private/bogon networks" to setting static IP and DNS on my client machine.

                      I hope the following can helps you track down the problem, if you need anymore information Ill be happy to help.

                      Routing tables

                      Internet:
                      Destination        Gateway            Flags    Refs      Use  Netif Expire
                      default            78.xx.xx.xx         UGS         2       70   fxp1 <–-wan2 gw set as default
                      10.0.0.0/24        link#10            U           0        0 re1_vl
                      10.0.0.1           link#10            UHS         0        0    lo0
                      10.0.1.0/24        link#11            U           0        0 re1_vl
                      10.0.1.1           link#11            UHS         0        0    lo0
                      10.0.2.0/24        link#12            U           0        0 re1_vl
                      10.0.2.1           link#12            UHS         0        0    lo0
                      10.0.20.0/24       link#13            U           0        0 re1_vl
                      10.0.20.1          link#13            UHS         0        0    lo0
                      78.xx.xx.xx/20      link#2             U           2      463   fxp1 <–-wan2 gw
                      78.xx.xx.xx        link#2             UHS         0        0    lo0 <–-wan2 IP
                      94.xx.xx.xx/20     link#1             U           2     1051   fxp0 <–-wan1 gw
                      94.xx.xx.xx      link#1             UHS         0        0    lo0 <–-wan1 IP
                      127.0.0.1          link#6             UH          0       19    lo0
                      127.0.0.2          127.0.0.1          UHS         0        0    lo0
                      192.168.5.0/24     link#3             U           1    25807    re0
                      192.168.5.1        link#3             UHS         0        0    lo0
                      192.168.50.0/24    link#9             U           0        0 re1_vl
                      192.168.50.1       link#9             UHS         0        0    lo0
                      208.67.220.220     94.xx.xx.xx        UGHS        1       25   fxp0 <–-94.xx.xx.xx wan1 gw
                      208.67.222.222     78.xx.xx.xx         UGHS        0       29   fxp1 <–-78.xx.xx.xx wan2 gw

                      config.xml rule

                      <rule><id><type>pass</type>
                                  <tag><tagged><direction>out</direction>
                                 <quick>yes</quick>
                                 <floating>yes</floating>
                                  <max><max-src-nodes><max-src-conn><max-src-states><statetimeout><statetype>keep state</statetype>
                                  <os><nosync><protocol>tcp</protocol>
                                 <source>
                                      <any><destination><any><port>80</port></any></destination>
                                 <descr>Load Balance Squid</descr>
                                 <gateway>multiwan</gateway></any></nosync></os></statetimeout></max-src-states></max-src-conn></max-src-nodes></max></tagged></tag></id></rule>

                      pfctl -sr
                      NOTE: 94.xx.xx.xx is wan1 gw

                      pass out quick route-to (fxp0 94.xx.xx.xx) inet proto tcp from any to any port = http flags S/SA keep state label "USER_RULE: Load Balance Squid"

                      pfctl -sa Filter rules:
                      NOTE: 94.xx.xx.xx is wan1 gw

                      pass out quick route-to (fxp0 94.xx.xx.xx) inet proto tcp from any to any port = http flags S/SA keep state label "USER_RULE: Load Balance Squid"

                      Counters:

                      USER_RULE: Load Balance Squid 6 96 5040 0 0 96 5040

                      pfctl -s rules -vv
                      NOTE: 94.xx.xx.xx is wan1 gw

                      @119 pass out quick route-to (fxp0 94.xx.xx.xx) inet proto tcp from any to any port = http flags S/SA keep state label "USER_RULE: Load Balance Squid"
                       [ Evaluations: 0         Packets: 0         Bytes: 0           States: 0     ]
                       [ Inserted: uid 0 pid 28028 ]

                      rules.debug

                      pass  out  quick  $multiwan  proto tcp  from any to any port 80  keep state  label "USER_RULE: Load Balance Squid"

                      I dont know how much of the above is relevant, but I thought I'd post anyway  ;D

                      Thanks in advance

                      Slam

                      1 Reply Last reply Reply Quote 0
                      • E
                        eri--
                        last edited by

                        Are you using Manual Outbound NAT?
                        pfctl -vvsr is the output i want to see actually.

                        Do you have issues on traffic with this rule?
                        Please show me even a pfctl -vvsn

                        While there can you try enable manual outbound NAT and add a rule with source any and external your wan1(94…../20) gw?
                        See if it works.

                        1 Reply Last reply Reply Quote 0
                        • S
                          Slam
                          last edited by

                          Ive included output for the those commands

                          pfctl -vvsr - command1.txt
                          pfctl -vvsn - command2.txt

                          I dont use outbound nat and dont even know how to use it, I got stuck when I tried to follow your comments, I've sent you a pm with details if you like access to the box yourself.

                          Thanks

                          Slam

                          1 Reply Last reply Reply Quote 0
                          • E
                            eri--
                            last edited by

                            Check out now it should be ok from what i see!?

                            If you want to tighten you can change the any in the outbound nat rules at the end to the respective interfaces subnet.

                            1 Reply Last reply Reply Quote 0
                            • S
                              Slam
                              last edited by

                              Ive just gave it another go, my browser just sits there trying to access the internet without any luck

                              is it ok to leave those other rules in outbound nat? will they interfere with the rules I have for the interfaces? shall i reboot and try?

                              Thanks

                              Slam

                              1 Reply Last reply Reply Quote 0
                              • E
                                eri--
                                last edited by

                                Just try out with static port ticked on those rules.

                                1 Reply Last reply Reply Quote 0
                                • S
                                  Slam
                                  last edited by

                                  rebooted and still nothing

                                  I tried connecting to redmine.pfsense.org with no luck and noticed this in https://pfsense/diag_dump_states.php

                                  tcp   127.0.0.1:80 <- 69.64.6.27:80 <- 192.168.5.150:51417   ESTABLISHED:ESTABLISHED

                                  Maybe Im just stupid, but isnt the flow meant to be like this?

                                  tcp   69.64.6.27:80 <- 127.0.0.1:80 <- 192.168.5.150:51417   ESTABLISHED:ESTABLISHED

                                  I appreciate the help you have given me, if it doesnt work with my setup then I guess nothing can be done about it, the box is still open if you want to poke around.

                                  Thanks a lot

                                  Slam

                                  1 Reply Last reply Reply Quote 0
                                  • E
                                    eri--
                                    last edited by

                                    It wont work for https because its https and afaik squid package does not redirect https.

                                    1 Reply Last reply Reply Quote 0
                                    • S
                                      Slam
                                      last edited by

                                      Sorry, I completely overlooked that, Ill test again later with a different setup.

                                      Thanks

                                      Slam

                                      1 Reply Last reply Reply Quote 0
                                      • M
                                        MrHorizontal
                                        last edited by

                                        What's the outcome of this?

                                        Is it working as it's an important reference to get other stuff within pfSense (looking at you, DNS) doing the load balancing mambo.

                                        1 Reply Last reply Reply Quote 0
                                        • S
                                          Slam
                                          last edited by

                                          For me, squid and load balancing works from what I can tell, but I didnt test in depth, however if the default wan interface goes down, then clients lose all internet connectivity, this was tested with squid set as transparent.

                                          It could be something to do with my setup, but Ill test more properly at another time.

                                          1 Reply Last reply Reply Quote 0
                                          • M
                                            max_ens
                                            last edited by

                                            maybe you shoulf be try use tcp_ougoing_adress with the beta no need load balance and no loose conection the users just the webs you put in tcp outgoing rules

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.