Varnish help on setting up for multiple internal webservers

[wetfish]

Hi,
Just wondering if someone managed to use Varnish to redirect one public IP to various internal web servers according to hostname.

I have a very basic setup using pfSense 2.0.1 AMD64.

I installed varnish package but I am lost as I cannot find any information on how it's done.

I have one public IP and 3 internal web servers.

Basically I would like:

www.mydomain.com > 192.168.0.2 (Apache under Centos)
news.mydomain.com > 192.168.0.3 (IIS using Host headers)
devs.mydomain.com > 192.168.0.3 (IIS using Host headers)

Can someone please guide me on how this can be done?

Thanks in advance.

[marcelloc]

First be sure your pfsense gui is not listening on port 80 (system-> advanced)

Varnish config begins with backend configuration

Each backend means a webserver

inside each configuration, you must provide:

• Backend name

• Ip Address

• Port

• Probe URL

• Probe Interval (5)

• Probe Timeout (1)

• Probe window (5)

• Probe Threshold (3)

on backend mapping, you could choose

map=host
match=equal
expression=www.mydomain.com (for first web server)

save backend config

on settings

• Listen port=80

• Managment interface=127.0.0.1:85

• storage type=memory

• cache storage size=1024

on General VCL settings, check all options

all other options on settings could be in default value

[baron164]

I've also been trying to set this up with little luck. Could you show some more detail of how you have the backend's setup?

[marcelloc]

Just the way I posted above:

Each backend means a webserver

inside each configuration, you must provide:

• Backend name = WindowsServer

• Ip Address = 192.168.1.4

• Port = 80

• Probe URL = "/"(if your server has a valid page on "/")

• Probe Interval = 5

• Probe Timeout = 1

• Probe window = 5

• Probe Threshold = 3

on backend mapping, you could choose

• map=host

• match=equal

• expression=www.mydomain.com (for first web server)

[wetfish]

Hi Marcellob,
Thanks for all your support.

Can I kindly ask if I still need to port forward port 80 in NAT options?

Are there any settings I need to configure in NAT or Rules to make it work?

Thanks

[marcelloc]

If you are listening varnish on wan port 80, then you have to

Disable any nat on wan port 80
Change pfsense gui port to other then 80
Create a rule on wan to Allow traffic to varnish port.

[kegler]

@marcelloc:

If you are listening varnish on wan port 80, then you have to

Disable any nat on wan port 80
Change pfsense gui port to other then 80
Create a rule on wan to Allow traffic to varnish port.

do i need to any other setup if my dns is handle by no-ip.com? i can't reach the internal ip server with the above setup

[marcelloc]

Add varnish widget to see backend status.

If you are getting 503 errors, means That you can reach varnish But not backends.

[kegler]

@marcelloc:

Add varnish widget to see backend status.

If you are getting 503 errors, means That you can reach varnish But not backends.

"Create a rule on wan to Allow traffic to varnish port."

you mean create a rule "any to any port80" ?

my widget shows this now
http://img254.imageshack.us/img254/3103/pfs1.jpg

[marcelloc]

The wan rule is to allow traffic to pfsense on public/wan ip on varnish listen port.

[kegler]

@marcelloc:

The wan rule is to allow traffic to pfsense on public/wan ip on varnish listen port.

yes..im listen to port 80

the screenshot above…is the widget functioning? i dont see any data at all... looks abit weird

[marcelloc]

I've published a fix to widget download during instalation, please reinstall package, add the varnish dashboard widget and see backend status.

[kegler]

@marcelloc:

I've published a fix to widget download during instalation, please reinstall package, add the varnish dashboard widget and see backend status.

do i need to do this again?

cd /usr/local/www/widgets/widgets/
fetch http://www.pfsense.com/packages/config/varnish64/varnish.widget.php

[marcelloc]

@kegler:

do i need to do this again?

cd /usr/local/www/widgets/widgets/
fetch http://www.pfsense.com/packages/config/varnish64/varnish.widget.php

Just if you do not want to reinstall package.

The fix I've published was just to fix this file path.

[kegler]

@marcelloc:

@kegler:

do i need to do this again?

cd /usr/local/www/widgets/widgets/
fetch http://www.pfsense.com/packages/config/varnish64/varnish.widget.php

Just if you do not want to reinstall package.

The fix I've published was just to fix this file path.

oh…i still see the same widget

ok let me recap, i disable all my NAT, i set any port80 to any port 80 on my rules and i set my backend servers on varnish. i still do not get thru, not even getting the error503. Just showing me the connection has time out after a 1-2min loading

[marcelloc]

maybe there is something missing on your varnish setup.

try to run it from console to see if there are any erros

/usr/local/etc/rc.d/varnish.sh start

[kegler]

@marcelloc:

maybe there is something missing on your varnish setup.

try to run it from console to see if there are any erros

/usr/local/etc/rc.d/varnish.sh start

omg… u r right.... i couldnt start.... varnish.sh command not found

but i do see varnish.sh when i ls

[marcelloc]

/usr/local/etc/rc.d/varnish.sh is generated when you enable varnish and save config.

Can you check your varnish settings tab?

[kegler]

Varnish configuration file

Automatically generated by the pfSense package system

This file is located in /var/etc/default.vcl

sub vcl_error {
if (obj.status == 503 && req.restarts < 2) {
restart;
}

set obj.http.Content-Type = "text/html; charset=utf-8";
synthetic {"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
FAIL TO LOAD VARNISH"};
return(deliver);

}

backend kegwebBACKEND {

used in catch_all

.host = "192.168.1.95";
.port = "80";
.first_byte_timeout = 360s;
.connect_timeout = 5s;
.probe = {
.url = ""/"";
.interval = 5s;
.timeout = 1s;
.window = 5;
.threshold = 3;
}
}

backend kegapp3BACKEND {

used in catch_all

.host = "192.168.1.100";
.port = "80";
.first_byte_timeout = 360s;
.connect_timeout = 60s;
.probe = {
.url = ""/"";
.interval = 5s;
.timeout = 1s;
.window = 5;
.threshold = 3;
}
}

backend goldallianzeBACKEND {

used in catch_all

.host = "192.168.1.100";
.port = "80";
.first_byte_timeout = 360s;
.connect_timeout = 60s;
.probe = {
.url = ""/"";
.interval = 5s;
.timeout = 1s;
.window = 5;
.threshold = 3;
}
}

#Enable Per user session cache.
sub vcl_hash {
set req.hash += req.http.cookie;
}

sub vcl_recv {

#BASIC VCL RULES SETTING
#Fix gzip compression
if (req.http.Accept-Encoding) {
if (req.url ~ ".(gif|jpg|jpeg|bmp|png|ico|img|tga|wmf|gz|tgz|bz2|tbz|mp3|ogg)$") {
unset req.http.Accept-Encoding;
}
else if (req.http.Accept-Encoding ~ "gzip") {
set req.http.Accept-Encoding = "gzip";
}
else if (req.http.Accept-Encoding ~ "deflate") {
set req.http.Accept-Encoding = "deflate";
}
else {
unset req.http.Accept-Encoding;
}
}
#set client balance identity
set client.identity = client.ip;

#set X-forward
set req.http.X-Forwarded-Varnish = client.ip;

if (req.http.host == "www.example.com") {
set req.backend = kegwebBACKEND;
}
else if (req.http.host == "kcrm1.example.com") {
set req.backend = kegapp3BACKEND;
}
else if (req.http.host == "kcrm2.example.com ") {
set req.backend = goldallianzeBACKEND;
}

#respect client wish to refresh the page
if (req.http.Pragma ~ "no-cache")
{
return(pass);
}

#BASIC VCL RULES ACTIONS
#Disable post cache
if (req.request == "POST") {
return(pass);
}
#Enable static cache
if (req.request=="GET" && req.url ~ ".(css|js|txt|zip|pdf|rtf|flv|swf|html|htm)$") {
return(lookup);
}
if (req.request=="GET" && req.url ~ ".(gif|jpg|jpeg|bmp|png|ico|img|tga|wmf|mp3|ogg)$") {
return(lookup);
}
#Be rfc2616 compliant
if (req.request ~ "^(GET|HEAD|PUT|POST|TRACE|OPTIONS|DELETE)$") {
return(lookup);
}
else {
return(pipe);
}

return(lookup);
}

sub vcl_pipe {

If we don't set the Connection: close header, any following

requests from the client will also be piped through and

left untouched by varnish. We don't want that.

set req.http.connection = "close";

Note: no "pipe" action here - we'll fall back to the default

pipe method so that when any changes are made there, we

still inherit them.

}

sub vcl_fetch {

#Disable cache when backend is starting a session
if (beresp.http.Set-Cookie && beresp.http.Set-Cookie ~ "(PHPSESSID|phpsessid)") {
return(pass);
}
if (beresp.http.Set-Cookie && beresp.http.Set-Cookie ~ "(JSESSION|jsession)") {
return(pass);
}

Varnish respects the wishes of the backend application.

if (beresp.http.Pragma ~ "no-cache" || beresp.http.Cache-Control ~ "(no-cache|no-store|private)") {
return(pass);
}
    ## If the request to the backend returns a code other than 200, restart the loop
    ## If the number of restarts reaches the value of the parameter max_restarts,
    ## the request will be error'ed.  max_restarts defaults to 4.  This prevents
    ## an eternal loop in the event that, e.g., the object does not exist at all.
    if (beresp.status != 200 && beresp.status != 403 && beresp.status != 404 &&
    beresp.status != 303 && beresp.status != 302 && beresp.status != 301 && beresp.status != 401 ) {
set beresp.saintmode = 60s;
restart;
        }

set beresp.grace = 60s;
return(deliver);
}

sub vcl_deliver {
##set resp.http.X-Served-By = server.hostname;
  if (obj.hits > 0) {
    set resp.http.X-Cache = "HIT";
    set resp.http.X-Cache-Hits = obj.hits;
  } else {
    set resp.http.X-Cache = "MISS";
  }
return(deliver);
}

[kegler]

my pfsense management port i change to https

change domain name on conf only for security purpose