SQUID and Load Balancing doesn't work!!!! I tried for a week but nothing :'(

Slam

Sorry, I completely overlooked that, Ill test again later with a different setup.

Thanks

Slam

MrHorizontal

What's the outcome of this?

Is it working as it's an important reference to get other stuff within pfSense (looking at you, DNS) doing the load balancing mambo.

Slam

For me, squid and load balancing works from what I can tell, but I didnt test in depth, however if the default wan interface goes down, then clients lose all internet connectivity, this was tested with squid set as transparent.

It could be something to do with my setup, but Ill test more properly at another time.

max_ens

maybe you shoulf be try use tcp_ougoing_adress with the beta no need load balance and no loose conection the users just the webs you put in tcp outgoing rules

eri--

tcp_outgoing_address want detect the state of the link

heitor.lessa

Slam,

Can you fix this issue? I had the same problem today and I can´t fix anyway.

leap

Is there any solution for this issue'?
I am also having this problem when the default gateway is down. all the clients could not able to access to internet.

Thanks in advance

leap

I am also having the same issue when one of my WANs went down. the clients could not able to access the internet.
Is there any solution for this issue?

Thanks

itsmorefun

I have found the problem:

The network:

ISP1|-192.168.0.1–--192.168.0.2-| |
|pfSense|-192.168.3.1----192.168.3.2-|Computer
ISP2|-192.168.1.1----192.168.1.2-| |

Squid package is installed on pfSense.

On system gateway groups i setup a gateway "ALLISP" with Tier1 Tier1 for ISP1 & ISP2

I create a floating rule like this:
Interface: (None selected)
Direction: Out
Protocol: TCP
Source: ISP1 adresse (=192.168.0.2)
Destination Port: HTTP
Gateway: ISP2 (for the test, normally it's ALLISP)

The client use the pfsense proxy.

I launch Google and... that don't work... page don't load

the packet is well redirected on ISP2 interface:

I run tcpdump on ISP2 interface and see this:
tcp port 80 from 192.168.0.2 to www.google.fr

The problem is here, the source must be rewrite, the ISP2 Modem can't relay a packet with a 192.168.0 source... that must be 192.168.1...

What can we do?

OyyoDams

Hi,

I think your issue is related to mine: http://forum.pfsense.org/index.php/topic,28410.0.html

I begin to think there is something to do without outbound nat, but I don't know what. I'm still searching.

eri--

For those of you who still want to try this.
I added a fix which should be presented on latest snapshot to help with this.

max_ens

i think its better you try tcp_outgoing_address, cause one line for normal http ant other for downloads and youtube never lose the connection cuz the internet no get all bandwith and only the line with the downloads and videos get slow, in other way you try also put 2 computers with pfsense one lb and other with squid

eri--

Does it work with dynamic addresses tcp_outgoing_address?

OyyoDams

@ermal:

For those of you who still want to try this.
I added a fix which should be presented on latest snapshot to help with this.

Yeah thank you very much erman !

I just tried with the latest snapshot and it works.

My floating rules work. Of course I had to add outbound NAT rules, so now a very good thing you could add is aliases in outbound rules ! :)

n1ko

How about writing a howto about how to get it working? Have you tested failover?

OyyoDams

@n1ko:

How about writing a howto about how to get it working? Have you tested failover?

I'll try to write a howto later, but I haven't tested failover. In fact, my WAN interface goes directly to my ISP, and my OPT1 is an openvpn connexion to an alternative ISP.
Default gateway is WAN, but when the VPN connexion is established, the default gateway becomes OPT1.
So my goal was to route some addresses to WAN instead of OPT1 from the pfsense itself, because I use squid as transparent proxy, so http traffic is generated by pfsense, and so standard firewall rules (from LAN) can't be applied.

In my case here is how I got it to work:

add a floating rule with specific address as destination, and WAN gateway to force traffic on this gateway instead of OPT1
add a virtual IP alias on WAN interface, in WAN network range
add an outbound NAT rule, interface OPT1, source any, destination "the same specific address", NAT address "the virtual IP"

This last point is important, because if you only set the floating rule, traffic is sent from WAN interface, but with OPT1 address as source.

My english is not very good, so here is an example.
Imagine you want to reach http://my-i-p.com/ from WAN instead of VPN (OPT1) interface:
my-i-p.com ip address is 74.86.20.234

See step1 picture for floating rule
My WAN ip address is 192.168.0.1, let's add a virtual IP (for example 192.168.0.30) on this interface: see step2 picture
See step3 for NAT rule

Hope that helps you :)

step1.jpg_thumb

step2.jpg_thumb

step3.jpg_thumb

vito

Does anyone have this working with Squid and HAVP?
thanks

nassman

Please i need the arrange steps, how to setup squid with load balance

heper

@nassman:

Please i need the arrange steps, how to setup squid with load balance

i'm having the same problem …. once i figure it out with ermal's help i'll write a simple how-to.

for now all i can accomplish is failover with custom scripting.
with the latest snapshot its possible to use the tcp_outgoing_adress directive in squids config in combination with a floating rule to get it working. changing the outgoing adress from WAN1 ip to WAN2 ip when either of them goes offline should be possible with fairly easy scripting.

i haven't been able to get any loadbalancing to work tho ... but its very well possible i just don't have enough braincells

nassman

I try apply the above setting, but i fail, the load balance and squid not work.
why not there any standard documents?