SQUID and Load Balancing doesn't work!!!! I tried for a week but nothing :'(

eri--

Are you using Manual Outbound NAT?
pfctl -vvsr is the output i want to see actually.

Do you have issues on traffic with this rule?
Please show me even a pfctl -vvsn

While there can you try enable manual outbound NAT and add a rule with source any and external your wan1(94…../20) gw?
See if it works.

Slam

Ive included output for the those commands

pfctl -vvsr - command1.txt
pfctl -vvsn - command2.txt

I dont use outbound nat and dont even know how to use it, I got stuck when I tried to follow your comments, I've sent you a pm with details if you like access to the box yourself.

Thanks

Slam

eri--

Check out now it should be ok from what i see!?

If you want to tighten you can change the any in the outbound nat rules at the end to the respective interfaces subnet.

Slam

Ive just gave it another go, my browser just sits there trying to access the internet without any luck

is it ok to leave those other rules in outbound nat? will they interfere with the rules I have for the interfaces? shall i reboot and try?

Thanks

Slam

eri--

Just try out with static port ticked on those rules.

Slam

rebooted and still nothing

I tried connecting to redmine.pfsense.org with no luck and noticed this in https://pfsense/diag_dump_states.php

tcp 127.0.0.1:80 <- 69.64.6.27:80 <- 192.168.5.150:51417 ESTABLISHED:ESTABLISHED

Maybe Im just stupid, but isnt the flow meant to be like this?

tcp 69.64.6.27:80 <- 127.0.0.1:80 <- 192.168.5.150:51417 ESTABLISHED:ESTABLISHED

I appreciate the help you have given me, if it doesnt work with my setup then I guess nothing can be done about it, the box is still open if you want to poke around.

Thanks a lot

Slam

eri--

It wont work for https because its https and afaik squid package does not redirect https.

Slam

Sorry, I completely overlooked that, Ill test again later with a different setup.

Thanks

Slam

MrHorizontal

What's the outcome of this?

Is it working as it's an important reference to get other stuff within pfSense (looking at you, DNS) doing the load balancing mambo.

Slam

For me, squid and load balancing works from what I can tell, but I didnt test in depth, however if the default wan interface goes down, then clients lose all internet connectivity, this was tested with squid set as transparent.

It could be something to do with my setup, but Ill test more properly at another time.

max_ens

maybe you shoulf be try use tcp_ougoing_adress with the beta no need load balance and no loose conection the users just the webs you put in tcp outgoing rules

eri--

tcp_outgoing_address want detect the state of the link

heitor.lessa

Slam,

Can you fix this issue? I had the same problem today and I can´t fix anyway.

leap

Is there any solution for this issue'?
I am also having this problem when the default gateway is down. all the clients could not able to access to internet.

Thanks in advance

leap

I am also having the same issue when one of my WANs went down. the clients could not able to access the internet.
Is there any solution for this issue?

Thanks

itsmorefun

I have found the problem:

The network:

ISP1|-192.168.0.1–--192.168.0.2-| |
|pfSense|-192.168.3.1----192.168.3.2-|Computer
ISP2|-192.168.1.1----192.168.1.2-| |

Squid package is installed on pfSense.

On system gateway groups i setup a gateway "ALLISP" with Tier1 Tier1 for ISP1 & ISP2

I create a floating rule like this:
Interface: (None selected)
Direction: Out
Protocol: TCP
Source: ISP1 adresse (=192.168.0.2)
Destination Port: HTTP
Gateway: ISP2 (for the test, normally it's ALLISP)

The client use the pfsense proxy.

I launch Google and... that don't work... page don't load

the packet is well redirected on ISP2 interface:

I run tcpdump on ISP2 interface and see this:
tcp port 80 from 192.168.0.2 to www.google.fr

The problem is here, the source must be rewrite, the ISP2 Modem can't relay a packet with a 192.168.0 source... that must be 192.168.1...

What can we do?

OyyoDams

Hi,

I think your issue is related to mine: http://forum.pfsense.org/index.php/topic,28410.0.html

I begin to think there is something to do without outbound nat, but I don't know what. I'm still searching.

eri--

For those of you who still want to try this.
I added a fix which should be presented on latest snapshot to help with this.

max_ens

i think its better you try tcp_outgoing_address, cause one line for normal http ant other for downloads and youtube never lose the connection cuz the internet no get all bandwith and only the line with the downloads and videos get slow, in other way you try also put 2 computers with pfsense one lb and other with squid

eri--

Does it work with dynamic addresses tcp_outgoing_address?