Squid – Selective reverse proxy and forward proxy

forwardingreverse-proxysquid

I'd like to setup a squid instance to do selective reverse proxy for a configured list of URLs while acting as a normal forward proxy for everything else.

We are building new infrastructure, parallel live as it were, and I want to have a proxy that people can use that will force selective traffic into the new platform while acting as a forward proxy for anything else. This makes it very easy for people/systems to test the portions of the new platform we want without having to change too much, just use a proxy address.

Is such a setup possible ?

Best Answer

The following seems to work for me, anything for www.myurl.com gets sent to the new servers and everything else is proxied as normal.

# Setup a cache peer as an origin server 
# Duplicate this line for each site you want to reverse for and give it a new name
cache_peer <new platform ip or fqdn> parent 80 0 no-query originserver proxy-only name=upstream1

# Set the domain the cache_peer should handle
cache_peer_domain upstream1 www.myurl.com

# Duplicate following three lines
# Add as many acl lines as necessary for all domains handled
acl our_sites  dstdomain www.myurl.com
cache_peer_access upstream1_sites allow our_sites
cache_peer_access upstream1_sites deny all

Related Solutions

Varnish versus other reverse proxies

Well, I'm running Varnish on my webservers, primarily for performance reasons, although its load balancing featues are handy as well.

My use case is caching in front of Django-based websites, and it does wonders for page loading performance. I'm able to serve most pages directly from cache and handle a flood of visitors with little trouble.

The reason I chose Varnish was mainly performance/scalability. The main points:

Varnish let's the kernel manage virtual memory, where Squid tries to keep separate disk and memory caches, can lead to the kernel and Squid squabbling a bit about what's to be paged out to disk.
Varnish uses VCL, it's own domain specific configuration language, which compiles down to machine code via C. That is a very real performance benefit if you have a more than a little bit of logic in your configuration – conditional header stripping etc.

In my experience, Varnish performs a bit better than Squid in most cases, and a lot better on traffic spikes. On the other hand, configuring Varnish correctly is going to take some mailing-list-trawling, since there aren't as many ready-to-go-for-your-specific-use-case-documentation flowing around the net as there are for Squid – mainly due to Varnish being a fairly young project in comparison.

Squid traffic tunneled through VPN

I do something similar. I do it using two pieces:

$ cat bin/openproxy
#!/bin/bash
ssh -C -o ServerAliveInterval=150 -L 3128:proxy:3128 gateway.company.com

Then in Firefox, I use FoxyProxy to use localhost:3128 as a proxy for machines in *.company.com.

This works for pretty much everything that I need.

Is this what you're trying to do?

Best Answer

Related Solutions

Varnish versus other reverse proxies

Squid traffic tunneled through VPN

Related Topic