Varnish help on setting up for multiple internal webservers

kegler

Add varnish widget to see backend status.

If you are getting 503 errors, means That you can reach varnish But not backends.

"Create a rule on wan to Allow traffic to varnish port."

you mean create a rule "any to any port80" ?

my widget shows this now
http://img254.imageshack.us/img254/3103/pfs1.jpg

marcelloc

The wan rule is to allow traffic to pfsense on public/wan ip on varnish listen port.

kegler

@marcelloc:

The wan rule is to allow traffic to pfsense on public/wan ip on varnish listen port.

yes..im listen to port 80

the screenshot above…is the widget functioning? i dont see any data at all... looks abit weird

marcelloc

I've published a fix to widget download during instalation, please reinstall package, add the varnish dashboard widget and see backend status.

kegler

@marcelloc:

I've published a fix to widget download during instalation, please reinstall package, add the varnish dashboard widget and see backend status.

do i need to do this again?

cd /usr/local/www/widgets/widgets/
fetch http://www.pfsense.com/packages/config/varnish64/varnish.widget.php

marcelloc

@kegler:

do i need to do this again?

cd /usr/local/www/widgets/widgets/
fetch http://www.pfsense.com/packages/config/varnish64/varnish.widget.php

Just if you do not want to reinstall package.

The fix I've published was just to fix this file path.

kegler

@marcelloc:

@kegler:

do i need to do this again?

cd /usr/local/www/widgets/widgets/
fetch http://www.pfsense.com/packages/config/varnish64/varnish.widget.php

Just if you do not want to reinstall package.

The fix I've published was just to fix this file path.

oh…i still see the same widget

ok let me recap, i disable all my NAT, i set any port80 to any port 80 on my rules and i set my backend servers on varnish. i still do not get thru, not even getting the error503. Just showing me the connection has time out after a 1-2min loading

marcelloc

maybe there is something missing on your varnish setup.

try to run it from console to see if there are any erros

/usr/local/etc/rc.d/varnish.sh start

kegler

@marcelloc:

maybe there is something missing on your varnish setup.

try to run it from console to see if there are any erros

/usr/local/etc/rc.d/varnish.sh start

omg… u r right.... i couldnt start.... varnish.sh command not found

but i do see varnish.sh when i ls

marcelloc

/usr/local/etc/rc.d/varnish.sh is generated when you enable varnish and save config.

Can you check your varnish settings tab?

kegler

Varnish configuration file

Automatically generated by the pfSense package system

This file is located in /var/etc/default.vcl

sub vcl_error {
if (obj.status == 503 && req.restarts < 2) {
restart;
}

set obj.http.Content-Type = "text/html; charset=utf-8";
synthetic {"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
FAIL TO LOAD VARNISH"};
return(deliver);

}

backend kegwebBACKEND {

used in catch_all

.host = "192.168.1.95";
.port = "80";
.first_byte_timeout = 360s;
.connect_timeout = 5s;
.probe = {
.url = ""/"";
.interval = 5s;
.timeout = 1s;
.window = 5;
.threshold = 3;
}
}

backend kegapp3BACKEND {

used in catch_all

.host = "192.168.1.100";
.port = "80";
.first_byte_timeout = 360s;
.connect_timeout = 60s;
.probe = {
.url = ""/"";
.interval = 5s;
.timeout = 1s;
.window = 5;
.threshold = 3;
}
}

backend goldallianzeBACKEND {

used in catch_all

.host = "192.168.1.100";
.port = "80";
.first_byte_timeout = 360s;
.connect_timeout = 60s;
.probe = {
.url = ""/"";
.interval = 5s;
.timeout = 1s;
.window = 5;
.threshold = 3;
}
}

#Enable Per user session cache.
sub vcl_hash {
set req.hash += req.http.cookie;
}

sub vcl_recv {

#BASIC VCL RULES SETTING
#Fix gzip compression
if (req.http.Accept-Encoding) {
if (req.url ~ ".(gif|jpg|jpeg|bmp|png|ico|img|tga|wmf|gz|tgz|bz2|tbz|mp3|ogg)$") {
unset req.http.Accept-Encoding;
}
else if (req.http.Accept-Encoding ~ "gzip") {
set req.http.Accept-Encoding = "gzip";
}
else if (req.http.Accept-Encoding ~ "deflate") {
set req.http.Accept-Encoding = "deflate";
}
else {
unset req.http.Accept-Encoding;
}
}
#set client balance identity
set client.identity = client.ip;

#set X-forward
set req.http.X-Forwarded-Varnish = client.ip;

if (req.http.host == "www.example.com") {
set req.backend = kegwebBACKEND;
}
else if (req.http.host == "kcrm1.example.com") {
set req.backend = kegapp3BACKEND;
}
else if (req.http.host == "kcrm2.example.com ") {
set req.backend = goldallianzeBACKEND;
}

#respect client wish to refresh the page
if (req.http.Pragma ~ "no-cache")
{
return(pass);
}

#BASIC VCL RULES ACTIONS
#Disable post cache
if (req.request == "POST") {
return(pass);
}
#Enable static cache
if (req.request=="GET" && req.url ~ ".(css|js|txt|zip|pdf|rtf|flv|swf|html|htm)$") {
return(lookup);
}
if (req.request=="GET" && req.url ~ ".(gif|jpg|jpeg|bmp|png|ico|img|tga|wmf|mp3|ogg)$") {
return(lookup);
}
#Be rfc2616 compliant
if (req.request ~ "^(GET|HEAD|PUT|POST|TRACE|OPTIONS|DELETE)$") {
return(lookup);
}
else {
return(pipe);
}

return(lookup);
}

sub vcl_pipe {

If we don't set the Connection: close header, any following

requests from the client will also be piped through and

left untouched by varnish. We don't want that.

set req.http.connection = "close";

Note: no "pipe" action here - we'll fall back to the default

pipe method so that when any changes are made there, we

still inherit them.

}

sub vcl_fetch {

#Disable cache when backend is starting a session
if (beresp.http.Set-Cookie && beresp.http.Set-Cookie ~ "(PHPSESSID|phpsessid)") {
return(pass);
}
if (beresp.http.Set-Cookie && beresp.http.Set-Cookie ~ "(JSESSION|jsession)") {
return(pass);
}

Varnish respects the wishes of the backend application.

if (beresp.http.Pragma ~ "no-cache" || beresp.http.Cache-Control ~ "(no-cache|no-store|private)") {
return(pass);
}
## If the request to the backend returns a code other than 200, restart the loop
## If the number of restarts reaches the value of the parameter max_restarts,
## the request will be error'ed. max_restarts defaults to 4. This prevents
## an eternal loop in the event that, e.g., the object does not exist at all.
if (beresp.status != 200 && beresp.status != 403 && beresp.status != 404 &&
beresp.status != 303 && beresp.status != 302 && beresp.status != 301 && beresp.status != 401 ) {
set beresp.saintmode = 60s;
restart;
}

set beresp.grace = 60s;
return(deliver);
}

sub vcl_deliver {
##set resp.http.X-Served-By = server.hostname;
if (obj.hits > 0) {
set resp.http.X-Cache = "HIT";
set resp.http.X-Cache-Hits = obj.hits;
} else {
set resp.http.X-Cache = "MISS";
}
return(deliver);
}

kegler

my pfsense management port i change to https

change domain name on conf only for security purpose

marcelloc

The conf looks fine. Are you still unable to start varnish?
What files do you have on /usr/local/etc/rc.d ?

kegler

@marcelloc:

The conf looks fine. Are you still unable to start varnish?
What files do you have on /usr/local/etc/rc.d ?

varnish.sh
varnishd
varnishlog
varnishncsa
clamd

marcelloc

The file is there and package is installed, it should work. ???

Just to check, see if varnish package is installed with pkg_info on console.

ps ax | grep varnish will show if there is any varnish process running.

kegler

@marcelloc:

The file is there and package is installed, it should work. ???

Just to check, see if varnish package is installed with pkg_info on console.

ps ax | grep varnish will show if there is any varnish process running.

18796 0 S+ 0:00.00 grep varnish

looks like not running?

marcelloc

What about pkg_info cmd?

What does returns /usr/local/etc/rc.d/varnish.sh start

kegler

@marcelloc:

What about pkg_info cmd?

What does returns /usr/local/etc/rc.d/varnish.sh start

sorry what is the cmd to check the above ?

kegler

[2.0-RELEASE][admin@kegpfs.kegnet.com]/usr/local/etc/rc.d(6): varnish.sh start
varnish.sh: Command not found.

seems something not installed ?

marcelloc

Do not chdir to rc.d, Run varnish.sh with full path