Multi-WAN, Multi-LAN, loadbalancing and content filtering?

isonski · Sep 23, 2009, 7:40 AM

hi guys,

just a quick question…

i've managed to setup multi-WAN and multi-LAN, and im really happy abt it... now comes Phase2 of the project: i have to restrict internet access on LAN2 using squid and squidguard... when i enable transparent squid on LAN2, loadbalancing/failover is a NO GO. but when i disable transparent squid on LAN2, loadbalancing/failover works, but content filtering DOES NOT.

is there any way i can get the two features (loadbalancing/failover and content filtering) to work together?

thanks in advance... any suggestions and feedbacks are greatly appreciated....

alli

Tolitz · Oct 2, 2009, 8:44 AM

Hi,
I also have the same problem…. with squid (transparent proxy) the failover does not work when the WAN is down, no more internet access.

And all the rules for specific LAN IP addresses are not followed with squid.

Any suggestions?

Thanks.

isonski · Oct 6, 2009, 6:51 AM

hi,

i did a lot of reading and research on the pfsense forum, documents and wikis, even offsite… loadbalancing/failover DOES NOT play well with squid content filtering... i guess that answered my own question hehehe... i just have to re-design my setup to get it to work together...

thanx...

alli

Klug · Oct 8, 2009, 10:08 AM

Same issue for a customer.
Squid as transparent proxy seems to be able to deal with WAN interface only (no OPT1, no OPT2, etc).

I've read that pfSense 2.0 (or the "trafic shaping special edition" or stg like that) should be able to do so.

For our customer, it means we'll soon swap the two WAN links in order to get the one that should be used for http as WAN and the other one as OPT1.

rudraansh · Oct 12, 2009, 6:29 PM

Squid Guard , Squid doesnt work fine when used in a MultiWan Setup.
I have faced the same issue and Now I am using a very old harddware of mine which run behind pfsense and i have installed smoothwall in it which does the rest of the content filtering. and when you say that your customer is facaing the problem you can always use smoothwall in an additional machine saying that if there is a hardware failover on the pfsense side. you just need to plug the cabl in smoothwall and you will save a lot of downtime.