• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

Varnish help on setting up for multiple internal webservers

Scheduled Pinned Locked Moved pfSense Packages
66 Posts 10 Posters 29.1k Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • C
    canefield
    last edited by Mar 18, 2012, 2:47 PM

    @marcelloc:

    Each backend means a webserver

    inside each configuration, you must provide:

    • Backend name = WindowsServer

    • Ip Address = 192.168.1.4

    • Port = 80 <– Q

    • Probe URL = "/"(if your server has a valid page on "/")

    • Probe Interval = 5

    • Probe Timeout = 1

    • Probe window = 5

    • Probe Threshold = 3

    Q:
    Can I enter multiple listening ports e.g. port: "80, 443"? Or should I configure that host several times according to how many ports it is listening on?

    Thanks,
    Canefield

    1 Reply Last reply Reply Quote 0
    • M
      marcelloc
      last edited by Mar 18, 2012, 3:09 PM

      I think you need one port for each config as varnish is going to check backend health as well send traffic based on this port.

      Keep in mind That varnish implemets http balance/cache only. If you what to balance https as well, haproxy can do this.

      Pound and relayd can do client/firewall ssl comunication and then forward client request to varnish, but there is no gui options for this yet.

      Treinamentos de Elite: http://sys-squad.com

      Help a community developer! ;D

      1 Reply Last reply Reply Quote 0
      • L
        Landmine
        last edited by Mar 26, 2012, 6:05 PM

        Hate to jump on someone else's thread, but I've gone threw all the same motions, but still no results.

        web1.domain.com
        web2.domain.com

        All end up pointing to the pfSense login, so my question is simply this… What IP do you point the Rule to? the pfSense box that host Varnish?

        1 Reply Last reply Reply Quote 0
        • M
          marcelloc
          last edited by Mar 26, 2012, 6:16 PM

          Did you changed  pfsense gui port?
          This current varnish gui implementation listens deamon on all interfaces.

          Treinamentos de Elite: http://sys-squad.com

          Help a community developer! ;D

          1 Reply Last reply Reply Quote 0
          • L
            Landmine
            last edited by Mar 26, 2012, 8:01 PM

            I did now and it works!

            Guess next time I need to slow down and read all the helpful text.

            Thank you

            1 Reply Last reply Reply Quote 0
            • L
              Landmine
              last edited by Mar 26, 2012, 10:39 PM Mar 26, 2012, 10:03 PM

              Correction, it was working. I didnt change anything and I'm getting the 503 errors again  :(

              –---------- Update ------------

              I only get the 503 error on 1 of the 2 domains.

              ------------ Update ------------

              Removing the Backend mapping with the http:// on it seemed to fix the issue.

              ------------ Update ------------

              Down again after about 30 seconds.  >:(

              1 Reply Last reply Reply Quote 0
              • M
                marcelloc
                last edited by Mar 26, 2012, 11:12 PM

                That's probably a backend health url check problem.

                Add varnish widget to dashboard to see backend status.

                The 503 error means could not find any available backend.

                Also try to see backend configuration file on view configuration.

                Treinamentos de Elite: http://sys-squad.com

                Help a community developer! ;D

                1 Reply Last reply Reply Quote 0
                • L
                  Landmine
                  last edited by Mar 27, 2012, 2:00 AM

                  Here is my config

                  
                  # Varnish configuration file
                  # Automatically generated by the pfSense package system
                  
                  # This file is located in /var/etc/default.vcl
                  
                  sub vcl_error {
                  		if (obj.status == 503 && req.restarts < 1) {
                  			restart;
                  		}
                  
                  	set obj.http.Content-Type = "text/html; charset=utf-8";
                  	synthetic {"
                  "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
                  
                  <title>"} obj.status " " obj.response {"</title>
                  
                   **We are very sorry but an error occurred during this request.** 
                  
                  Please press refresh in your browser to try again.
                  
                  Varnish Error "} obj.status " " obj.response {"
                  
                  "} obj.response {"
                  
                  ### Guru Meditation:
                  
                  XID: "} req.xid {"
                  
                  "};
                  	return(deliver);
                  
                  }
                  
                  backend MinecraftBACKEND {
                  	# used in catch_all 
                  	.host = "10.0.0.50";
                  	.port = "80";
                  	.first_byte_timeout = 300s;
                  	.connect_timeout = 25s;
                  	.probe = {
                  		.url = "/index.php";
                  		.interval = 5s;
                  		.timeout = 3s;
                  		.window = 5;
                  		.threshold = 3;
                  	}
                  }
                  
                  sub vcl_recv {
                  
                  	#BASIC VCL RULES SETTING
                  	#Fix gzip compression
                  	if (req.http.Accept-Encoding) {
                  	if (req.url ~ "\.(gif|jpg|jpeg|bmp|png|ico|img|tga|wmf|gz|tgz|bz2|tbz|mp3|ogg)$") {
                  		unset req.http.Accept-Encoding;
                  		}
                  	else if (req.http.Accept-Encoding ~ "gzip") {
                  		set req.http.Accept-Encoding = "gzip";
                  		}
                  	else if (req.http.Accept-Encoding ~ "deflate") {
                  		set req.http.Accept-Encoding = "deflate";
                  		}
                  	else	{
                  		unset req.http.Accept-Encoding;
                  		}
                  	}
                  	#set client balance identity
                  	set client.identity = client.ip;
                  
                  	#set X-forward
                  	set req.http.X-Forwarded-For = client.ip;
                  
                  	if (req.http.host == "minecraft.domain.com") {
                  		set req.backend = MinecraftBACKEND;
                  	} 
                  
                  	#respect client wish to refresh the page
                  	if (req.http.Pragma ~ "no-cache")
                  		{
                  		return(pass);
                  		}
                  
                  	#BASIC VCL RULES ACTIONS
                  	#Disable post cache
                  	if (req.request == "POST") {
                  		return(pass);
                  		}
                  	#Enable static cache
                  	if (req.request=="GET" && req.url ~ "\.(css|js|txt|zip|rtf|flv|swf|html|htm)$") {
                  		return(pass);
                  		}
                  	if (req.request=="GET" && req.url ~ "\.(gif|jpg|jpeg|bmp|png|ico|img|tga|wmf|mp3|ogg)$") {
                  		return(pass);
                  		}
                  	#Disable session cache
                  	if (req.http.Cookie && req.http.Cookie ~ "(PHPSESSID|phpsessid)") {
                  		return(pass);
                  		}
                  	if (req.http.Cookie && req.http.Cookie ~ "(JSESSION|jsession)") {
                  		return(pass);
                  		}
                  	if (req.http.X-Requested-With == "XMLHttpRequest" || req.url ~ "nocache") {
                  		return(pass);
                  		}
                  	#Be rfc2616 compliant
                  	if (req.request ~ "^(GET|HEAD|PUT|POST|TRACE|OPTIONS|DELETE)$") {
                  		return(lookup);
                  		}
                  	else	{
                  		return(pipe);
                  		}
                  
                  	return(lookup);
                  }
                  
                  sub vcl_pipe {
                  
                  	# If we don't set the Connection: close header, any following
                  	# requests from the client will also be piped through and
                  	# left untouched by varnish. We don't want that.
                  	set req.http.connection = "close";
                  	# Note: no "pipe" action here - we'll fall back to the default
                  	# pipe method so that when any changes are made there, we
                  	# still inherit them.
                  
                  }
                  
                  sub vcl_fetch {
                  
                  	#Disable cache when backend is starting a session
                  	if (beresp.http.Set-Cookie && beresp.http.Set-Cookie ~ "(PHPSESSID|phpsessid)") {
                  		return(pass);
                  		}
                  	if (beresp.http.Set-Cookie && beresp.http.Set-Cookie ~ "(JSESSION|jsession)") {
                  		return(pass);
                  		}
                  	if (beresp.http.X-Requested-With == "XMLHttpRequest" || req.url ~ "nocache") {
                  		return(pass);
                  		}
                  
                  	# Varnish respects the wishes of the backend application.
                  	if (beresp.http.Pragma ~ "no-cache" || beresp.http.Cache-Control ~ "(no-cache|no-store|private)") {
                  	return(pass);
                  	}
                      ## If the request to the backend returns a code other than 200, restart the loop
                      ## If the number of restarts reaches the value of the parameter max_restarts,
                      ## the request will be error'ed.  max_restarts defaults to 4.  This prevents
                      ## an eternal loop in the event that, e.g., the object does not exist at all.
                      if (beresp.status != 200 && beresp.status != 403 && beresp.status != 404 && 
                      	beresp.status != 303 && beresp.status != 302 && beresp.status != 301 && beresp.status != 401 ) {
                  		restart;
                          }
                  
                  	return(deliver);
                  }
                  
                  sub vcl_deliver {
                  	##set resp.http.X-Served-By = server.hostname;
                    	if (obj.hits > 0) {
                      	set resp.http.X-Cache = "HIT";	
                      	set resp.http.X-Cache-Hits = obj.hits;
                    	} else {
                      	set resp.http.X-Cache = "MISS";	
                    	}
                  	return(deliver);
                  }
                  
                  
                  1 Reply Last reply Reply Quote 0
                  • M
                    marcelloc
                    last edited by Mar 27, 2012, 2:09 AM

                    can you try to access backend test url?

                    http://10.0.0.50/index.php

                    Also, what you get on dashboard varnish widget?

                    Treinamentos de Elite: http://sys-squad.com

                    Help a community developer! ;D

                    1 Reply Last reply Reply Quote 0
                    • L
                      Landmine
                      last edited by Mar 27, 2012, 2:11 AM

                      The URL works get when I'm at home and here is a pic of what the widget looks like.

                      Thank you for taking the time to help me.

                      1 Reply Last reply Reply Quote 0
                      • M
                        marcelloc
                        last edited by Mar 27, 2012, 2:20 AM

                        Varnish could not get this url from your web server.

                        Can you try an static html, a full http request or something else?

                        Treinamentos de Elite: http://sys-squad.com

                        Help a community developer! ;D

                        1 Reply Last reply Reply Quote 0
                        • L
                          Landmine
                          last edited by Mar 27, 2012, 2:32 AM

                          So far so good. Now if I wanted to add more servers to the list, I'd basically copy the settings and just change the Backend name, IP and Mapping?

                          1 Reply Last reply Reply Quote 0
                          • M
                            marcelloc
                            last edited by Mar 27, 2012, 4:07 AM

                            Yes.  :)

                            Just don't forget to check backend status on Dashboard.

                            Treinamentos de Elite: http://sys-squad.com

                            Help a community developer! ;D

                            1 Reply Last reply Reply Quote 0
                            • N
                              normtodd
                              last edited by Apr 13, 2012, 10:00 PM

                              im having a strange issue that im sure is something easy that im not doing - im pretty sure everthing is working vis a vis varnish, but i am not getting any data on the varnish widget except that the backend is up and running - everything else (cache hits, cache hits pass, cache missed, conn accepted, req. received, and uptime) are empty.  ive attached a picture of the widget from the dashboard to illustrate.

                              right now i only have one machine (an atmail mail server) behind pfsense/varnish and want to confirm that everything is working before i deploy more machines behind pfsense.

                              here is my varnish config -

                              # Varnish configuration file
                              # Automatically generated by the pfSense package system
                              
                              # This file is located in /var/etc/default.vcl
                              
                              sub vcl_error {
                              		if (obj.status == 503 && req.restarts < 1) {
                              			return(restart);
                              		}
                              
                              	set obj.http.Content-Type = "text/html; charset=utf-8";
                              	synthetic {"
                              "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
                              
                              <title>"} + obj.status + " " + obj.response + {"</title>
                              
                              # Error "} + obj.status + " " + obj.response + {"
                              
                              "} + obj.response + {"
                              
                              ### Guru Meditation:
                              
                              XID: "} + req.xid + {"
                              
                              * * *
                              
                              Varnish cache server
                              
                              138	"};
                              	return(deliver);
                              
                              }
                              
                              backend atmailBACKEND {
                              	# used in catch_all 
                              	.host = "192.168.20.5";
                              	.port = "80";
                              	.first_byte_timeout = 300s;
                              	.connect_timeout = 25s;
                              	.probe = {
                              		.url = "/";
                              		.interval = 5s;
                              		.timeout = 1s;
                              		.window = 5;
                              		.threshold = 3;
                              	}
                              }
                              
                              sub vcl_recv {
                              
                              	#BASIC VCL RULES SETTING
                              	#Fix gzip compression
                              	if (req.http.Accept-Encoding) {
                              	if (req.url ~ "\.(gif|jpg|jpeg|bmp|png|ico|img|tga|wmf|gz|tgz|bz2|tbz|mp3|ogg)$") {
                              		unset req.http.Accept-Encoding;
                              		}
                              	else if (req.http.Accept-Encoding ~ "gzip") {
                              		set req.http.Accept-Encoding = "gzip";
                              		}
                              	else if (req.http.Accept-Encoding ~ "deflate") {
                              		set req.http.Accept-Encoding = "deflate";
                              		}
                              	else	{
                              		unset req.http.Accept-Encoding;
                              		}
                              	}
                              	#set client balance identity
                              	set client.identity = client.ip;
                              
                              	#set X-forward
                              	set req.http.X-Forwarded-Varnish = client.ip;
                              
                              	if (req.http.host == "www.coldhardmath.com") {
                              		set req.backend = atmailBACKEND;
                              	} 
                              
                              	#respect client wish to refresh the page
                              	if (req.http.Pragma ~ "no-cache")
                              		{
                              		return(pass);
                              		}
                              
                              	#BASIC VCL RULES ACTIONS
                              	#Disable post cache
                              	if (req.request == "POST") {
                              		return(pass);
                              		}
                              	#Disable session cache
                              	if (req.http.Cookie && req.http.Cookie ~ "(PHPSESSID|phpsessid)") {
                              		return(pass);
                              		}
                              	if (req.http.Cookie && req.http.Cookie ~ "(JSESSION|jsession)") {
                              		return(pass);
                              		}
                              	if (req.http.X-Requested-With == "XMLHttpRequest" || req.url ~ "nocache") {
                              		return(pass);
                              		}
                              	#Enable static cache
                              	if (req.request=="GET" && req.url ~ "\.(css|js|txt|zip|pdf|rtf|flv|swf|html|htm)$") {
                              		unset req.http.cookie;
                              		return(lookup);
                              		}
                              	if (req.request=="GET" && req.url ~ "\.(gif|jpg|jpeg|bmp|png|ico|img|tga|wmf|mp3|ogg)$") {
                              		unset req.http.cookie;
                              		return(lookup);
                              		}
                              	#Be rfc2616 compliant
                              	if (req.request ~ "^(GET|HEAD|PUT|POST|TRACE|OPTIONS|DELETE)$") {
                              		return(lookup);
                              		}
                              	else	{
                              		return(pipe);
                              		}
                              
                              	return(lookup);
                              }
                              
                              sub vcl_pipe {
                              
                              	# If we don't set the Connection: close header, any following
                              	# requests from the client will also be piped through and
                              	# left untouched by varnish. We don't want that.
                              	set req.http.connection = "close";
                              	# Note: no "pipe" action here - we'll fall back to the default
                              	# pipe method so that when any changes are made there, we
                              	# still inherit them.
                              
                              }
                              sub vcl_hit {
                              	return (deliver);
                              }
                              
                              sub vcl_miss {
                              	return (fetch);
                              }
                              
                              sub vcl_fetch {
                              	set beresp.do_stream = true;
                              
                              	#Disable cache when backend is starting a session
                              	if (beresp.http.Set-Cookie && beresp.http.Set-Cookie ~ "(PHPSESSID|phpsessid)") {
                              		return(hit_for_pass);
                              		}
                              	if (beresp.http.Set-Cookie && beresp.http.Set-Cookie ~ "(JSESSION|jsession)") {
                              		return(hit_for_pass);
                              		}
                              	if (beresp.http.X-Requested-With == "XMLHttpRequest" || req.url ~ "nocache") {
                              		return(hit_for_pass);
                              		}
                              
                              	# Varnish respects the wishes of the backend application.
                              	if (beresp.http.Pragma ~ "no-cache" || beresp.http.Cache-Control ~ "(no-cache|no-store|private)") {
                              	return(hit_for_pass);
                              	}
                                  ## If the request to the backend returns a code other than 200, restart the loop
                                  ## If the number of restarts reaches the value of the parameter max_restarts,
                                  ## the request will be error'ed.  max_restarts defaults to 4.  This prevents
                                  ## an eternal loop in the event that, e.g., the object does not exist at all.
                                  if (beresp.status != 200 && beresp.status != 403 && beresp.status != 404 && 
                                  	beresp.status != 303 && beresp.status != 302 && beresp.status != 301 && beresp.status != 401 ) {
                              		return(restart);
                                      }
                              
                              	set beresp.grace = 60s;
                              		return(deliver);
                              }
                              
                              sub vcl_deliver {
                              	##set resp.http.X-Served-By = server.hostname;
                                	if (obj.hits > 0) {
                                  	set resp.http.X-Cache = "HIT";	
                                  	set resp.http.X-Cache-Hits = obj.hits;
                                	} else {
                                  	set resp.http.X-Cache = "MISS";	
                                	}
                              	return(deliver);
                              }
                              
                              sub vcl_init {
                              	return (ok);
                              }
                              
                              sub vcl_fini {
                              	return (ok);
                              }	
                              
                              

                              im sure there is something very simple that im missing and ive been staring at this so long im missing the forest staring at the trees.

                              anyone have any ideas?

                              all the best and thanks in advance
                              NT

                              ![Screen Shot 2012-04-13 at 2.53.37 PM.jpg](/public/imported_attachments/1/Screen Shot 2012-04-13 at 2.53.37 PM.jpg)
                              ![Screen Shot 2012-04-13 at 2.53.37 PM.jpg_thumb](/public/imported_attachments/1/Screen Shot 2012-04-13 at 2.53.37 PM.jpg_thumb)

                              1 Reply Last reply Reply Quote 0
                              • M
                                marcelloc
                                last edited by Apr 14, 2012, 1:17 AM

                                Are you sure you do not have any nat or pfsense gui on port 80?

                                Treinamentos de Elite: http://sys-squad.com

                                Help a community developer! ;D

                                1 Reply Last reply Reply Quote 0
                                • N
                                  normtodd
                                  last edited by Apr 14, 2012, 3:27 AM

                                  thanks marcelloc for responding and for all of your wonderful work on pfsense

                                  pfsense gui is on :81 and i removed the nat forwarding to port 80, just adding a rule on the wan opening port 80 (toward varnish)

                                  1 Reply Last reply Reply Quote 0
                                  • M
                                    marcelloc
                                    last edited by Apr 14, 2012, 3:33 AM

                                    @normtodd:

                                    just adding a rule on the wan opening port 80 (toward varnish)

                                    Without this rule, varnish will get no traffic.  :)

                                    Treinamentos de Elite: http://sys-squad.com

                                    Help a community developer! ;D

                                    1 Reply Last reply Reply Quote 0
                                    • N
                                      normtodd
                                      last edited by Apr 14, 2012, 3:39 AM

                                      i apologize - i think im getting mixed up ! :)

                                      per this thread, i removed the nat rule (which i previously had configured prior to installing varnish) for port 80

                                      in order to have port 80 open (in order for traffic to reach varnish), i added a firewall rule on the wan for port 80 to be open

                                      isnt this the correct config? :)

                                      all the best and thanks for all

                                      1 Reply Last reply Reply Quote 0
                                      • M
                                        marcelloc
                                        last edited by Apr 14, 2012, 3:52 AM

                                        Yes, the setup is this way.

                                        Are you sure it's working through varnish?

                                        Treinamentos de Elite: http://sys-squad.com

                                        Help a community developer! ;D

                                        1 Reply Last reply Reply Quote 0
                                        • N
                                          normtodd
                                          last edited by Apr 14, 2012, 4:04 AM

                                          i assume that varnish listens on port 80 and the wan firewall rule would allow access?

                                          how would i confirm that its working through varnish?

                                          1 Reply Last reply Reply Quote 0
                                          • First post
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                                            This community forum collects and processes your personal information.
                                            consent.not_received