Varnish help on setting up for multiple internal webservers
-
I've also been trying to set this up with little luck. Could you show some more detail of how you have the backend's setup?
-
Just the way I posted above:
Each backend means a webserver
inside each configuration, you must provide:
-
Backend name = WindowsServer
-
Ip Address = 192.168.1.4
-
Port = 80
-
Probe URL = "/"(if your server has a valid page on "/")
-
Probe Interval = 5
-
Probe Timeout = 1
-
Probe window = 5
-
Probe Threshold = 3
on backend mapping, you could choose
-
map=host
-
match=equal
-
expression=www.mydomain.com (for first web server)
-
-
Hi Marcellob,
Thanks for all your support.Can I kindly ask if I still need to port forward port 80 in NAT options?
Are there any settings I need to configure in NAT or Rules to make it work?
Thanks
-
If you are listening varnish on wan port 80, then you have to
Disable any nat on wan port 80
Change pfsense gui port to other then 80
Create a rule on wan to Allow traffic to varnish port. -
If you are listening varnish on wan port 80, then you have to
Disable any nat on wan port 80
Change pfsense gui port to other then 80
Create a rule on wan to Allow traffic to varnish port.do i need to any other setup if my dns is handle by no-ip.com? i can't reach the internal ip server with the above setup
-
Add varnish widget to see backend status.
If you are getting 503 errors, means That you can reach varnish But not backends.
-
Add varnish widget to see backend status.
If you are getting 503 errors, means That you can reach varnish But not backends.
"Create a rule on wan to Allow traffic to varnish port."
you mean create a rule "any to any port80" ?
my widget shows this now
http://img254.imageshack.us/img254/3103/pfs1.jpg -
The wan rule is to allow traffic to pfsense on public/wan ip on varnish listen port.
-
The wan rule is to allow traffic to pfsense on public/wan ip on varnish listen port.
yes..im listen to port 80
the screenshot above…is the widget functioning? i dont see any data at all... looks abit weird
-
I've published a fix to widget download during instalation, please reinstall package, add the varnish dashboard widget and see backend status.
-
I've published a fix to widget download during instalation, please reinstall package, add the varnish dashboard widget and see backend status.
do i need to do this again?
cd /usr/local/www/widgets/widgets/
fetch http://www.pfsense.com/packages/config/varnish64/varnish.widget.php -
do i need to do this again?
cd /usr/local/www/widgets/widgets/
fetch http://www.pfsense.com/packages/config/varnish64/varnish.widget.phpJust if you do not want to reinstall package.
The fix I've published was just to fix this file path.
-
do i need to do this again?
cd /usr/local/www/widgets/widgets/
fetch http://www.pfsense.com/packages/config/varnish64/varnish.widget.phpJust if you do not want to reinstall package.
The fix I've published was just to fix this file path.
oh…i still see the same widget
ok let me recap, i disable all my NAT, i set any port80 to any port 80 on my rules and i set my backend servers on varnish. i still do not get thru, not even getting the error503. Just showing me the connection has time out after a 1-2min loading
-
maybe there is something missing on your varnish setup.
try to run it from console to see if there are any erros
/usr/local/etc/rc.d/varnish.sh start
-
maybe there is something missing on your varnish setup.
try to run it from console to see if there are any erros
/usr/local/etc/rc.d/varnish.sh start
omg… u r right.... i couldnt start.... varnish.sh command not found
but i do see varnish.sh when i ls
-
/usr/local/etc/rc.d/varnish.sh is generated when you enable varnish and save config.
Can you check your varnish settings tab?
-
Varnish configuration file
Automatically generated by the pfSense package system
This file is located in /var/etc/default.vcl
sub vcl_error {
if (obj.status == 503 && req.restarts < 2) {
restart;
}set obj.http.Content-Type = "text/html; charset=utf-8";
synthetic {"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
FAIL TO LOAD VARNISH"};
return(deliver);}
backend kegwebBACKEND {
used in catch_all
.host = "192.168.1.95";
.port = "80";
.first_byte_timeout = 360s;
.connect_timeout = 5s;
.probe = {
.url = ""/"";
.interval = 5s;
.timeout = 1s;
.window = 5;
.threshold = 3;
}
}backend kegapp3BACKEND {
used in catch_all
.host = "192.168.1.100";
.port = "80";
.first_byte_timeout = 360s;
.connect_timeout = 60s;
.probe = {
.url = ""/"";
.interval = 5s;
.timeout = 1s;
.window = 5;
.threshold = 3;
}
}backend goldallianzeBACKEND {
used in catch_all
.host = "192.168.1.100";
.port = "80";
.first_byte_timeout = 360s;
.connect_timeout = 60s;
.probe = {
.url = ""/"";
.interval = 5s;
.timeout = 1s;
.window = 5;
.threshold = 3;
}
}#Enable Per user session cache.
sub vcl_hash {
set req.hash += req.http.cookie;
}sub vcl_recv {
#BASIC VCL RULES SETTING
#Fix gzip compression
if (req.http.Accept-Encoding) {
if (req.url ~ ".(gif|jpg|jpeg|bmp|png|ico|img|tga|wmf|gz|tgz|bz2|tbz|mp3|ogg)$") {
unset req.http.Accept-Encoding;
}
else if (req.http.Accept-Encoding ~ "gzip") {
set req.http.Accept-Encoding = "gzip";
}
else if (req.http.Accept-Encoding ~ "deflate") {
set req.http.Accept-Encoding = "deflate";
}
else {
unset req.http.Accept-Encoding;
}
}
#set client balance identity
set client.identity = client.ip;#set X-forward
set req.http.X-Forwarded-Varnish = client.ip;if (req.http.host == "www.example.com") {
set req.backend = kegwebBACKEND;
}
else if (req.http.host == "kcrm1.example.com") {
set req.backend = kegapp3BACKEND;
}
else if (req.http.host == "kcrm2.example.com ") {
set req.backend = goldallianzeBACKEND;
}#respect client wish to refresh the page
if (req.http.Pragma ~ "no-cache")
{
return(pass);
}#BASIC VCL RULES ACTIONS
#Disable post cache
if (req.request == "POST") {
return(pass);
}
#Enable static cache
if (req.request=="GET" && req.url ~ ".(css|js|txt|zip|pdf|rtf|flv|swf|html|htm)$") {
return(lookup);
}
if (req.request=="GET" && req.url ~ ".(gif|jpg|jpeg|bmp|png|ico|img|tga|wmf|mp3|ogg)$") {
return(lookup);
}
#Be rfc2616 compliant
if (req.request ~ "^(GET|HEAD|PUT|POST|TRACE|OPTIONS|DELETE)$") {
return(lookup);
}
else {
return(pipe);
}return(lookup);
}sub vcl_pipe {
If we don't set the Connection: close header, any following
requests from the client will also be piped through and
left untouched by varnish. We don't want that.
set req.http.connection = "close";
Note: no "pipe" action here - we'll fall back to the default
pipe method so that when any changes are made there, we
still inherit them.
}
sub vcl_fetch {
#Disable cache when backend is starting a session
if (beresp.http.Set-Cookie && beresp.http.Set-Cookie ~ "(PHPSESSID|phpsessid)") {
return(pass);
}
if (beresp.http.Set-Cookie && beresp.http.Set-Cookie ~ "(JSESSION|jsession)") {
return(pass);
}Varnish respects the wishes of the backend application.
if (beresp.http.Pragma ~ "no-cache" || beresp.http.Cache-Control ~ "(no-cache|no-store|private)") {
return(pass);
}
## If the request to the backend returns a code other than 200, restart the loop
## If the number of restarts reaches the value of the parameter max_restarts,
## the request will be error'ed. max_restarts defaults to 4. This prevents
## an eternal loop in the event that, e.g., the object does not exist at all.
if (beresp.status != 200 && beresp.status != 403 && beresp.status != 404 &&
beresp.status != 303 && beresp.status != 302 && beresp.status != 301 && beresp.status != 401 ) {
set beresp.saintmode = 60s;
restart;
}set beresp.grace = 60s;
return(deliver);
}sub vcl_deliver {
##set resp.http.X-Served-By = server.hostname;
if (obj.hits > 0) {
set resp.http.X-Cache = "HIT";
set resp.http.X-Cache-Hits = obj.hits;
} else {
set resp.http.X-Cache = "MISS";
}
return(deliver);
} -
my pfsense management port i change to https
change domain name on conf only for security purpose
-
The conf looks fine. Are you still unable to start varnish?
What files do you have on /usr/local/etc/rc.d ? -
The conf looks fine. Are you still unable to start varnish?
What files do you have on /usr/local/etc/rc.d ?varnish.sh
varnishd
varnishlog
varnishncsa
clamd
