Who's here using squid with multiwan?

tripplex

who's here using squid with multiwan?
Please reply and let me know how yours it configured.
The amount of wan you have etc.

rfzh1996

I have 3 WAN

NAME MB/S Sharing

ISP1 -> 50 1:1
ISP2 -> 30 2:1
ISP3 -> 30 2:1

You need create ACL, and use tcp_outgoing, you set this setting in Services -> Squid -> General -> Custom ACLS (Before Auth) as example

http_port 3128
acl lab1 src 192.168.10.0/24
acl lab2 src 192.168.11.0/24
acl lab3 src 192.168.12.0/24

tcp_outgoing_address IPISP1 lab1
tcp_outgoing_address IPISP2 lab2
tcp_outgoing_address IPISP3 lab3

And when the source is an ip of lab1 use ISP1

SaschaITM

AFAIK, that did work in older pfSense versions, but doesn't work in recent builds. From what I understand, the reason is something like "all requests originating from pfSense itself will use the Default Gateway", which is true for Squid running on the pfSense machine. I actually used the "tcp_outgoing_adress" solution at a site I'm managing, and noticed by chance some time after a pfSense update that the 2nd WAN wasn't being utilized anymore. I ran a few test afterwards, and couldn't get Squid traffic to balance anymore. My current solution is to use an additional Squid proxy server on a different machine, which is of course inconvenient, and a waste of resources (but works fine).

More information can be found in this forum post.

doktornotor

Just to restate the (mostly) obvious:

Load balancing

cannot be fixed in Squid because it's not possible to match the packets due to pf(4) bug

Failover

HA will never failover gracefully, because it's just not possible at all: https://forum.pfsense.org/index.php?topic=46067.msg256634#msg256634
If you want Squid to just switch the GWs, that doesn't work either because there was no code to let Squid know that the GW went down/up. If someone wants to play with the gateway state plugin on 2.4 snapshots (required) and produce some patch, feel welcome. Implementation example: 1 + 2.

tripplex

wow this is a burning issue. It seems no one have it configured to work on the same box.

tripplex

is vmware esxi is used then install two instance of pfsense, will it work that way? I would use one instance for load balancing multi wan and the other instance for squid?

kpk

Think so myself. Is there a way in IPv4 without doubleNAT (clients<->proxy-> "WAN IP" <-> "failover groups" ->ext IP)?
I really really would like to stick with pfsense, but there must be a working solution for proxy + multiwan.

@doktornotor:

Just to restate the (mostly) obvious:

Load balancing

cannot be fixed in Squid because it's not possible to match the packets due to pf(4) bug

Failover

HA will never failover gracefully, because it's just not possible at all: https://forum.pfsense.org/index.php?topic=46067.msg256634#msg256634

If you want Squid to just switch the GWs, that doesn't work either because there was no code to let Squid know that the GW went down/up. If someone wants to play with the gateway state plugin on 2.4 snapshots (required) and produce some patch, feel welcome. Implementation example: 1 + 2.

thanks for the post, as it simplifies the bug hunting big time. Do you know if there is any news about this 2 years(!) old bug?

doktornotor

There's nothing new really. LB broken, HA is not doable by design and noone submitted any plugin code for the GW switching case for Squid.

SaschaITM

To reiterate: the simple solution is to use an additional Squid proxy instance on a seperate machine, and setup that instance as a parent proxy for the pfSense Squid instance. I've implemente it like that because I wanted the Squid on pfSense to act as a transparent proxy. For multi-WAN, just use policy based routing (gateway groups). This leaves DNS as the only potential issue when the default gateway goes down I think, and that can probably be solved by using an additional Unbound instance on a seperate machine. I didn't test that yet, though, because my default gateway is pretty stable.