[Work in progress] Squid failover AND load balancing for pfSense

  • Hello,

    I know this has been discussed MULTIPLE times in the forum here, but maybe there has been improvement since the last discussions.

    I'm seeking a way to achieve load balancing and fail over with squid proxy.
    I know that failover can be achieved with default gateway switching and loadbalancing can be achieved by using multiple tcp_outgoing_address statements, but there used to be a way to achieve both with floating rules back with pfSense <= 2.0.

    Has anyone ever managed to get squid load balanced with failover since pfSense >= 2.1 ?
    I've tried like any scenario (even played with virtual IPs that are aliases of WANs etc) but I can't get that damn thing to work properly.
    It's the last part that I'm missing for the ultimate opensource UTM.


  • Anyone ? No results with release 2.3 neither?

  • Hi Deajan,

    i agree with your own conclusions, also if i don't understand why you're saying that "I'm seeking a way to achieve load balancing and fail over with squid proxy"; as you said yourself failover can be achieved using default gateway switching, and load balancing using for example these directives:

    acl LAN1 src
    acl LAN2 src
    tcp_outgoing_address LAN1
    tcp_outgoing_address LAN2

    In my case they work togheter and correctly; the problem is that squid will use the gateway specified in the ACL even if it is marked as failed; apparently this is the only obstacle for getting work load balancing + failover.

    Then the impossibility to do this through firewall policy (or policy routing) is another matter, but for an opensource product is already so much…

    Have a nice day,


  • Hi,

    As I said, it's failover or load balancing. Both don't work toghether as there is no point on having a squid that still laod balances on a failed link.

    Btw, I've asked the pfSense team about this in a support ticket. They said it never worked, and never will.
    Squid should be on another machine before the pfSense.

    If anyone has a solution, I'm pretty sure we'd love to have it described here.


  • It would be enough a script that removes the "tcp_outgoing_address" directive from squid config file when the gateway goes down, even if it goes without saying that i would not recommend anybody a similar solution for production environments…

  • This is actually a great idea.
    The script should be triggered by the dpinger results, a bit like /etc/rc.gateway_alarm.
    As long as the acl lines and the interfaces have the same name, it would be possible to comment out acl lines from which the interface is down, and then reload squid service.

  • Hi all,

    i've added some lines directly to /etc/rc.gateway_alarm file. I state that i'm a network guy and not very able with programming/scripting, sometimes with bash i throw myself to problem solving and that's it, without looking at the apparences…

    My  /etc/rc.gateway_alarm:


    if [ -z "$GW" ]; then
            exit 1
    **if [ "$GW" == "$GW1" ]
                      perl -i -pe 's/tcp_outgoing_address WAN/#tcp_outgoing_address WAN/g' /usr/local/etc/squid/squid.conf
                      /usr/local/etc/rc.d/squid.sh restart

    elif [ "$GW" == "$GW2" ]
                      perl -i -pe 's/tcp_outgoing_address UBNT/#tcp_outgoing_address UBNT/g' /usr/local/etc/squid/squid.conf
                      /usr/local/etc/rc.d/squid.sh restart
    fi** /usr/local/sbin/pfSctl
            -c "service reload dyndns ${GW}"
            -c "service reload ipsecdns"
            -c "service reload openvpn ${GW}"
            -c "filter reload" >/dev/null 2>&1

    exit $?

    In bold the lines added.

    This having in my squid.conf the following ALCs:

    acl UBNT src
    tcp_outgoing_address UBNT
    acl WAN src
    tcp_outgoing_address WAN

    and in the variables "GW1" and "GW2" the name of your gateways.

    I've tested it and works perfecly; now i'd like to work on "fail back" (if the failed gateway returns online the line should be uncommented).
    For this i think need to work on "if [ -z "$GW" ]", but before wanna wait for your eventual advices/correction that (certainly!) could improve the code.

    Have a nice day,


  • Hello,

    I'm working on a script too, but external to /etc/rc.gateway_alarm for better updates.
    I will post it once I have it all tested out.

    Btw, you should replace "restart" with "reload" on your squid.

  • Until I can test everyhting, here's my script.
    It will comment / uncomment the corresponding tcp_outgoing_address lines in squid.conf


    /usr/local/bin/squid_acl_control.sh [action] [gateway]
    Action = enable / disable
    Gateway = gateway name as in routing


    /usr/local/bin/squid_acl_control.sh disable WAN2_GW
    /usr/local/bin/squid_acl_control.sh enable SOME_GATEWAY

    The script itself to put in /usr/local/bin/squid_acl_control.sh

    #!/usr/bin/env sh
    if [ -w /var/log ]; then
    	LOG_FILE="/var/log/$(basename $0).log"
    elif [ w /tmp ]; then
    	LOG_FILE="/tmp/$(basename $0).log"
    	LOG_FILE="./$(basename $0).log"
    log() {
    	local value="${1}"
    	echo -e "$(date) - $value" >> "$LOG_FILE"
    squid_reload() {
    	service $SQUID_SERVICE reload
    	if [ $? != 0 ]; then
    		log "Could not reload squid configuration."
    		log "Reloaded squid configurarion."
    disable_gateway() {
    	local gateway="${1}"
    	sed -i.'bak' "/^tcp_outgoing_address.*$gateway/ s?^?#?" $SQUID_CONF_FILE
    	log "Disabled gateway [$1]."
    enable_gateway() {
    	local gateway="${1}"
    	sed -i.'bak' "/#tcp_outgoing_address.*$gateway/ s?^#??" $SQUID_CONF_FILE
    	log "Enabled gateway [$1]."
    if [ "$1" != "enable" ] && [ "$1" != "disable" ] || [ "$2" == "" ]; then
    	log "Bogus values given [$1], [$2]."
    	exit 1
    if [ "$1" == "disable" ]; then
    	disable_gateway "$2"
    elif [ "$1" == "enable" ]; then
    	enable_gateway "$2"

    I still need to find the right trigger, or write a quick cron task that checks dpinger sockets, but pfSense team must already have such a mechanism to add / remove gateways from gateway groups.

  • Hi, any news? Neither from pfSense team?

    Your script works, but as you said it must be automatically triggered without user intervention…


  • No reply from the pfsense team yet.
    Still, there would be some other issues to address.

    I am investigating a hook in /etc/inc/gwlb.inc

    --- gwlb.inc	2016-05-16 23:22:25.000000000 +0200
    +++ alt_gwlb.inc	2016-06-01 18:53:48.173676000 +0200
    @@ -951,12 +951,14 @@
    +						mwexec("/usr/local/bin/squid_acl_control.sh disable $gwname");
     					} else {
     						/* Online add member */
     						if (!is_array($tiers[$tier])) {
     							$tiers[$tier] = array();
     						$tiers[$tier][] = $gwname;
    +						mwexec("/usr/local/bin/squid_acl_control.sh enable $gwname");
     				} else if (isset($gateways_arr[$gwname]['monitor_disable'])) {
     					$tiers[$tier][] = $gwname;

    I am still waiting for the pfSense team to tell me if there is a better way to implement this.
    Maybe even good enough to be merged in a next release.

  • I think you've definitively found a good trigger…by doing this would remain only the "limit" of having the the acl lines and the interfaces with the same name, but at this point, italian proverb, "is better than nothing"...very better ;)
    Congratulations, i will test your findings as soon as possible but i'm very hopeful about the success.

    Have a nice day,


  • dont want to necro post but any updates on this?

Log in to reply