Varnish help on setting up for multiple internal webservers

marcelloc

Just the way I posted above:

Each backend means a webserver

inside each configuration, you must provide:

Backend name = WindowsServer
Ip Address = 192.168.1.4
Port = 80
Probe URL = "/"(if your server has a valid page on "/")
Probe Interval = 5
Probe Timeout = 1
Probe window = 5
Probe Threshold = 3

on backend mapping, you could choose

map=host

match=equal

expression=www.mydomain.com (for first web server)

wetfish

Hi Marcellob,
Thanks for all your support.

Can I kindly ask if I still need to port forward port 80 in NAT options?

Are there any settings I need to configure in NAT or Rules to make it work?

Thanks

marcelloc

If you are listening varnish on wan port 80, then you have to

Disable any nat on wan port 80
Change pfsense gui port to other then 80
Create a rule on wan to Allow traffic to varnish port.

kegler

@marcelloc:

If you are listening varnish on wan port 80, then you have to

Disable any nat on wan port 80
Change pfsense gui port to other then 80
Create a rule on wan to Allow traffic to varnish port.

do i need to any other setup if my dns is handle by no-ip.com? i can't reach the internal ip server with the above setup

marcelloc

Add varnish widget to see backend status.

If you are getting 503 errors, means That you can reach varnish But not backends.

kegler

@marcelloc:

Add varnish widget to see backend status.

If you are getting 503 errors, means That you can reach varnish But not backends.

"Create a rule on wan to Allow traffic to varnish port."

you mean create a rule "any to any port80" ?

my widget shows this now
http://img254.imageshack.us/img254/3103/pfs1.jpg

marcelloc

The wan rule is to allow traffic to pfsense on public/wan ip on varnish listen port.

kegler

@marcelloc:

The wan rule is to allow traffic to pfsense on public/wan ip on varnish listen port.

yes..im listen to port 80

the screenshot above…is the widget functioning? i dont see any data at all... looks abit weird

marcelloc

I've published a fix to widget download during instalation, please reinstall package, add the varnish dashboard widget and see backend status.

kegler

@marcelloc:

I've published a fix to widget download during instalation, please reinstall package, add the varnish dashboard widget and see backend status.

do i need to do this again?

cd /usr/local/www/widgets/widgets/
fetch http://www.pfsense.com/packages/config/varnish64/varnish.widget.php

marcelloc

@kegler:

do i need to do this again?

cd /usr/local/www/widgets/widgets/
fetch http://www.pfsense.com/packages/config/varnish64/varnish.widget.php

Just if you do not want to reinstall package.

The fix I've published was just to fix this file path.

kegler

@marcelloc:

@kegler:

do i need to do this again?

cd /usr/local/www/widgets/widgets/
fetch http://www.pfsense.com/packages/config/varnish64/varnish.widget.php

Just if you do not want to reinstall package.

The fix I've published was just to fix this file path.

oh…i still see the same widget

ok let me recap, i disable all my NAT, i set any port80 to any port 80 on my rules and i set my backend servers on varnish. i still do not get thru, not even getting the error503. Just showing me the connection has time out after a 1-2min loading

marcelloc

maybe there is something missing on your varnish setup.

try to run it from console to see if there are any erros

/usr/local/etc/rc.d/varnish.sh start

kegler

@marcelloc:

maybe there is something missing on your varnish setup.

try to run it from console to see if there are any erros

/usr/local/etc/rc.d/varnish.sh start

omg… u r right.... i couldnt start.... varnish.sh command not found

but i do see varnish.sh when i ls

marcelloc

/usr/local/etc/rc.d/varnish.sh is generated when you enable varnish and save config.

Can you check your varnish settings tab?

kegler

Varnish configuration file

Automatically generated by the pfSense package system

This file is located in /var/etc/default.vcl

sub vcl_error {
if (obj.status == 503 && req.restarts < 2) {
restart;
}

set obj.http.Content-Type = "text/html; charset=utf-8";
synthetic {"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
FAIL TO LOAD VARNISH"};
return(deliver);

}

backend kegwebBACKEND {

used in catch_all

.host = "192.168.1.95";
.port = "80";
.first_byte_timeout = 360s;
.connect_timeout = 5s;
.probe = {
.url = ""/"";
.interval = 5s;
.timeout = 1s;
.window = 5;
.threshold = 3;
}
}

backend kegapp3BACKEND {

used in catch_all

.host = "192.168.1.100";
.port = "80";
.first_byte_timeout = 360s;
.connect_timeout = 60s;
.probe = {
.url = ""/"";
.interval = 5s;
.timeout = 1s;
.window = 5;
.threshold = 3;
}
}

backend goldallianzeBACKEND {

used in catch_all

.host = "192.168.1.100";
.port = "80";
.first_byte_timeout = 360s;
.connect_timeout = 60s;
.probe = {
.url = ""/"";
.interval = 5s;
.timeout = 1s;
.window = 5;
.threshold = 3;
}
}

#Enable Per user session cache.
sub vcl_hash {
set req.hash += req.http.cookie;
}

sub vcl_recv {

#BASIC VCL RULES SETTING
#Fix gzip compression
if (req.http.Accept-Encoding) {
if (req.url ~ ".(gif|jpg|jpeg|bmp|png|ico|img|tga|wmf|gz|tgz|bz2|tbz|mp3|ogg)$") {
unset req.http.Accept-Encoding;
}
else if (req.http.Accept-Encoding ~ "gzip") {
set req.http.Accept-Encoding = "gzip";
}
else if (req.http.Accept-Encoding ~ "deflate") {
set req.http.Accept-Encoding = "deflate";
}
else {
unset req.http.Accept-Encoding;
}
}
#set client balance identity
set client.identity = client.ip;

#set X-forward
set req.http.X-Forwarded-Varnish = client.ip;

if (req.http.host == "www.example.com") {
set req.backend = kegwebBACKEND;
}
else if (req.http.host == "kcrm1.example.com") {
set req.backend = kegapp3BACKEND;
}
else if (req.http.host == "kcrm2.example.com ") {
set req.backend = goldallianzeBACKEND;
}

#respect client wish to refresh the page
if (req.http.Pragma ~ "no-cache")
{
return(pass);
}

#BASIC VCL RULES ACTIONS
#Disable post cache
if (req.request == "POST") {
return(pass);
}
#Enable static cache
if (req.request=="GET" && req.url ~ ".(css|js|txt|zip|pdf|rtf|flv|swf|html|htm)$") {
return(lookup);
}
if (req.request=="GET" && req.url ~ ".(gif|jpg|jpeg|bmp|png|ico|img|tga|wmf|mp3|ogg)$") {
return(lookup);
}
#Be rfc2616 compliant
if (req.request ~ "^(GET|HEAD|PUT|POST|TRACE|OPTIONS|DELETE)$") {
return(lookup);
}
else {
return(pipe);
}

return(lookup);
}

sub vcl_pipe {

If we don't set the Connection: close header, any following

requests from the client will also be piped through and

left untouched by varnish. We don't want that.

set req.http.connection = "close";

Note: no "pipe" action here - we'll fall back to the default

pipe method so that when any changes are made there, we

still inherit them.

}

sub vcl_fetch {

#Disable cache when backend is starting a session
if (beresp.http.Set-Cookie && beresp.http.Set-Cookie ~ "(PHPSESSID|phpsessid)") {
return(pass);
}
if (beresp.http.Set-Cookie && beresp.http.Set-Cookie ~ "(JSESSION|jsession)") {
return(pass);
}

Varnish respects the wishes of the backend application.

if (beresp.http.Pragma ~ "no-cache" || beresp.http.Cache-Control ~ "(no-cache|no-store|private)") {
return(pass);
}
## If the request to the backend returns a code other than 200, restart the loop
## If the number of restarts reaches the value of the parameter max_restarts,
## the request will be error'ed. max_restarts defaults to 4. This prevents
## an eternal loop in the event that, e.g., the object does not exist at all.
if (beresp.status != 200 && beresp.status != 403 && beresp.status != 404 &&
beresp.status != 303 && beresp.status != 302 && beresp.status != 301 && beresp.status != 401 ) {
set beresp.saintmode = 60s;
restart;
}

set beresp.grace = 60s;
return(deliver);
}

sub vcl_deliver {
##set resp.http.X-Served-By = server.hostname;
if (obj.hits > 0) {
set resp.http.X-Cache = "HIT";
set resp.http.X-Cache-Hits = obj.hits;
} else {
set resp.http.X-Cache = "MISS";
}
return(deliver);
}

kegler

my pfsense management port i change to https

change domain name on conf only for security purpose

marcelloc

The conf looks fine. Are you still unable to start varnish?
What files do you have on /usr/local/etc/rc.d ?

kegler

@marcelloc:

The conf looks fine. Are you still unable to start varnish?
What files do you have on /usr/local/etc/rc.d ?

varnish.sh
varnishd
varnishlog
varnishncsa
clamd

marcelloc

The file is there and package is installed, it should work. ???

Just to check, see if varnish package is installed with pkg_info on console.

ps ax | grep varnish will show if there is any varnish process running.