Varnish help on setting up for multiple internal webservers

[wetfish]

Hi Marcellob,
Thanks for all your support.

Can I kindly ask if I still need to port forward port 80 in NAT options?

Are there any settings I need to configure in NAT or Rules to make it work?

Thanks

[marcelloc]

If you are listening varnish on wan port 80, then you have to

Disable any nat on wan port 80
Change pfsense gui port to other then 80
Create a rule on wan to Allow traffic to varnish port.

[kegler]

@marcelloc:

If you are listening varnish on wan port 80, then you have to

Disable any nat on wan port 80
Change pfsense gui port to other then 80
Create a rule on wan to Allow traffic to varnish port.

do i need to any other setup if my dns is handle by no-ip.com? i can't reach the internal ip server with the above setup

[marcelloc]

Add varnish widget to see backend status.

If you are getting 503 errors, means That you can reach varnish But not backends.

[kegler]

@marcelloc:

Add varnish widget to see backend status.

If you are getting 503 errors, means That you can reach varnish But not backends.

"Create a rule on wan to Allow traffic to varnish port."

you mean create a rule "any to any port80" ?

my widget shows this now
http://img254.imageshack.us/img254/3103/pfs1.jpg

[marcelloc]

The wan rule is to allow traffic to pfsense on public/wan ip on varnish listen port.

[kegler]

@marcelloc:

The wan rule is to allow traffic to pfsense on public/wan ip on varnish listen port.

yes..im listen to port 80

the screenshot above…is the widget functioning? i dont see any data at all... looks abit weird

[marcelloc]

I've published a fix to widget download during instalation, please reinstall package, add the varnish dashboard widget and see backend status.

[kegler]

@marcelloc:

I've published a fix to widget download during instalation, please reinstall package, add the varnish dashboard widget and see backend status.

do i need to do this again?

cd /usr/local/www/widgets/widgets/
fetch http://www.pfsense.com/packages/config/varnish64/varnish.widget.php

[marcelloc]

@kegler:

do i need to do this again?

cd /usr/local/www/widgets/widgets/
fetch http://www.pfsense.com/packages/config/varnish64/varnish.widget.php

Just if you do not want to reinstall package.

The fix I've published was just to fix this file path.

[kegler]

@marcelloc:

@kegler:

do i need to do this again?

cd /usr/local/www/widgets/widgets/
fetch http://www.pfsense.com/packages/config/varnish64/varnish.widget.php

Just if you do not want to reinstall package.

The fix I've published was just to fix this file path.

oh…i still see the same widget

ok let me recap, i disable all my NAT, i set any port80 to any port 80 on my rules and i set my backend servers on varnish. i still do not get thru, not even getting the error503. Just showing me the connection has time out after a 1-2min loading

[marcelloc]

maybe there is something missing on your varnish setup.

try to run it from console to see if there are any erros

/usr/local/etc/rc.d/varnish.sh start

[kegler]

@marcelloc:

maybe there is something missing on your varnish setup.

try to run it from console to see if there are any erros

/usr/local/etc/rc.d/varnish.sh start

omg… u r right.... i couldnt start.... varnish.sh command not found

but i do see varnish.sh when i ls

[marcelloc]

/usr/local/etc/rc.d/varnish.sh is generated when you enable varnish and save config.

Can you check your varnish settings tab?

[kegler]

Varnish configuration file

Automatically generated by the pfSense package system

This file is located in /var/etc/default.vcl

sub vcl_error {
if (obj.status == 503 && req.restarts < 2) {
restart;
}

set obj.http.Content-Type = "text/html; charset=utf-8";
synthetic {"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
FAIL TO LOAD VARNISH"};
return(deliver);

}

backend kegwebBACKEND {

used in catch_all

.host = "192.168.1.95";
.port = "80";
.first_byte_timeout = 360s;
.connect_timeout = 5s;
.probe = {
.url = ""/"";
.interval = 5s;
.timeout = 1s;
.window = 5;
.threshold = 3;
}
}

backend kegapp3BACKEND {

used in catch_all

.host = "192.168.1.100";
.port = "80";
.first_byte_timeout = 360s;
.connect_timeout = 60s;
.probe = {
.url = ""/"";
.interval = 5s;
.timeout = 1s;
.window = 5;
.threshold = 3;
}
}

backend goldallianzeBACKEND {

used in catch_all

.host = "192.168.1.100";
.port = "80";
.first_byte_timeout = 360s;
.connect_timeout = 60s;
.probe = {
.url = ""/"";
.interval = 5s;
.timeout = 1s;
.window = 5;
.threshold = 3;
}
}

#Enable Per user session cache.
sub vcl_hash {
set req.hash += req.http.cookie;
}

sub vcl_recv {

#BASIC VCL RULES SETTING
#Fix gzip compression
if (req.http.Accept-Encoding) {
if (req.url ~ ".(gif|jpg|jpeg|bmp|png|ico|img|tga|wmf|gz|tgz|bz2|tbz|mp3|ogg)$") {
unset req.http.Accept-Encoding;
}
else if (req.http.Accept-Encoding ~ "gzip") {
set req.http.Accept-Encoding = "gzip";
}
else if (req.http.Accept-Encoding ~ "deflate") {
set req.http.Accept-Encoding = "deflate";
}
else {
unset req.http.Accept-Encoding;
}
}
#set client balance identity
set client.identity = client.ip;

#set X-forward
set req.http.X-Forwarded-Varnish = client.ip;

if (req.http.host == "www.example.com") {
set req.backend = kegwebBACKEND;
}
else if (req.http.host == "kcrm1.example.com") {
set req.backend = kegapp3BACKEND;
}
else if (req.http.host == "kcrm2.example.com ") {
set req.backend = goldallianzeBACKEND;
}

#respect client wish to refresh the page
if (req.http.Pragma ~ "no-cache")
{
return(pass);
}

#BASIC VCL RULES ACTIONS
#Disable post cache
if (req.request == "POST") {
return(pass);
}
#Enable static cache
if (req.request=="GET" && req.url ~ ".(css|js|txt|zip|pdf|rtf|flv|swf|html|htm)$") {
return(lookup);
}
if (req.request=="GET" && req.url ~ ".(gif|jpg|jpeg|bmp|png|ico|img|tga|wmf|mp3|ogg)$") {
return(lookup);
}
#Be rfc2616 compliant
if (req.request ~ "^(GET|HEAD|PUT|POST|TRACE|OPTIONS|DELETE)$") {
return(lookup);
}
else {
return(pipe);
}

return(lookup);
}

sub vcl_pipe {

If we don't set the Connection: close header, any following

requests from the client will also be piped through and

left untouched by varnish. We don't want that.

set req.http.connection = "close";

Note: no "pipe" action here - we'll fall back to the default

pipe method so that when any changes are made there, we

still inherit them.

}

sub vcl_fetch {

#Disable cache when backend is starting a session
if (beresp.http.Set-Cookie && beresp.http.Set-Cookie ~ "(PHPSESSID|phpsessid)") {
return(pass);
}
if (beresp.http.Set-Cookie && beresp.http.Set-Cookie ~ "(JSESSION|jsession)") {
return(pass);
}

Varnish respects the wishes of the backend application.

if (beresp.http.Pragma ~ "no-cache" || beresp.http.Cache-Control ~ "(no-cache|no-store|private)") {
return(pass);
}
    ## If the request to the backend returns a code other than 200, restart the loop
    ## If the number of restarts reaches the value of the parameter max_restarts,
    ## the request will be error'ed.  max_restarts defaults to 4.  This prevents
    ## an eternal loop in the event that, e.g., the object does not exist at all.
    if (beresp.status != 200 && beresp.status != 403 && beresp.status != 404 &&
    beresp.status != 303 && beresp.status != 302 && beresp.status != 301 && beresp.status != 401 ) {
set beresp.saintmode = 60s;
restart;
        }

set beresp.grace = 60s;
return(deliver);
}

sub vcl_deliver {
##set resp.http.X-Served-By = server.hostname;
  if (obj.hits > 0) {
    set resp.http.X-Cache = "HIT";
    set resp.http.X-Cache-Hits = obj.hits;
  } else {
    set resp.http.X-Cache = "MISS";
  }
return(deliver);
}

[kegler]

my pfsense management port i change to https

change domain name on conf only for security purpose

[marcelloc]

The conf looks fine. Are you still unable to start varnish?
What files do you have on /usr/local/etc/rc.d ?

[kegler]

@marcelloc:

The conf looks fine. Are you still unable to start varnish?
What files do you have on /usr/local/etc/rc.d ?

varnish.sh
varnishd
varnishlog
varnishncsa
clamd

[marcelloc]

The file is there and package is installed, it should work.  ???

Just to check, see if varnish package is installed with pkg_info on console.

ps ax | grep varnish will show if there is any varnish process running.

[kegler]

@marcelloc:

The file is there and package is installed, it should work.  ???

Just to check, see if varnish package is installed with pkg_info on console.

ps ax | grep varnish will show if there is any varnish process running.

18796  0  S+    0:00.00 grep varnish

looks like not running?