Squid reverse proxy – load balance to two web servers with connection persistence

httpreverse-proxysquid

I want to setup a Squid reverse proxy that splits HTTP traffic to two web servers for load balancing, and have it use persistence (so if a user gets to webserver1 with a first request their second request goes to webserver1 also.)

Other reverse proxy solutions I've worked with have done this by injecting a session cookie into the HTTP stream; how can I do this using squid?

Best Answer

Say your servers are at 10.0.0.51 and 10.0.0.52. You'll want something like this:

cache_peer 10.0.0.51 parent 80 0 no-query originserver sourcehash
cache_peer 10.0.0.52 parent 80 0 no-query originserver sourcehash

It'll do a hash of the client's IP address and direct a given client to the same upstream server with each request (as long as the upstream servers stay up) based on that.

Related Solutions

Iptables – Transparent Proxy with Squid / iptables

If I understand you correctly, what you want to do isn't going to be handled simply by configuring iptables. The REDIR target can only be used to target processes running on the local system. I believe attempting to use a DNAT target to forward the to the remote squid box would remove some of the information the remote squid box needs to properly handle the request

If you allow me to guess a bit. I think you are trying to leave the default gateway as 192.168.1.1 on your host and then send your port 80 traffic across the vpn right?

The remote squid needs some configuration so that it can actually act as a transparent proxy. If you can setup the correct iptables redirection on the squid host, and the remote host is in the network path, then it is possible to do use some advanced routing to forward all port 80 requests across the vpn.

P.S. If I am understanding your needs correctly add a comment, I can update my answer with more details about how to setup routing.

Ssl – Squid reverse proxy with optional SSL

UPDATE (actually tried this from my squid...):

acl is_ssl port 443
https_port 443 cert=<yourcert> key=<yourkey> accel name=site_ssl defaultsite=<y\
our_external_site>
cache_peer <your_internal_ssl> parent 443 0 no-query originserver ssl sslflags=\
DONT_VERIFY_PEER name=site_ssl
cache_peer_access site_ssl allow is_ssl
cache_peer_access site_ssl deny !is_ssl

acl nonssl port 80
http_port 80 accel defaultsite=<your_external_site>  name=site_nonssl
cache_peer <your_internal_nonssl> parent 80 0 no-query name=site_nonssl origins\
erver
cache_peer_access site_nonssl allow nonssl
cache_peer_access site_nonssl deny !is_nonssl

ORIGINAL ANSWER BELOW HERE:

you want something like

cache_peer 10.0.0.11 parent 443 0 no-query originserver ssl sslflags=DONT_VERIFY_PEER name=site_ssl
acl sites_server_3 dstdomain site_ssl
cache_peer_access site_ssl allow ssl_servers
http_access allow ssl_servers

Best Answer

Related Solutions

Iptables – Transparent Proxy with Squid / iptables

Ssl – Squid reverse proxy with optional SSL

Related Topic