I am trying to set up a transparent, intercepting squid instance, along
side my existing explicit instance, and would like some input around
what i have buggered up so far.
i am running HAProxy in front of two squid instances, with the XFF
header added by HAProxy. My squid configs are all set to follow the XFF
for the real source and logging is setup around digesting XFF for the
source.
i took my config and added:
http_port 192.168.88.1:3129 intercept
on the router/firewall/load balancer device that is running HAProxy, i
added a NAT rule as described here:
http://www.fwbuilder.org/4.0/docs/users_guide5/redirection_rules.shtml
in my cache.log i get:
2015/11/18 20:45:13 kid1| NF getsockopt(SO_ORIGINAL_DST) failed on
local=192.168.88.1:3129 remote=192.168.88.254:37102 FD 20 flags=33: (92)
Protocol not available
2015/11/18 20:49:05 kid1| NF getsockopt(SO_ORIGINAL_DST) failed on
local=192.168.88.1:3129 remote=192.168.88.254:37381 FD 20 flags=33: (92)
Protocol not available
this tells me that i am getting to the squid instances via the load
balancer, but i am running into the "NAT must occur on the squid box"
rule, i think.
i want to intercept http traffic, and load balance the traffic to my
squid instances. this link:
http://wiki.squid-cache.org/ConfigExamples/Intercept/IptablesPolicyRoute
seems to be a step in the right direction, but i am at a loss on how to
apply the logic to my environment. my proxies are on a separate vlan,
behind a load balancer, not in a DMZ. i am missing something and not
sure exactly what it is. any input on where i need to go?
thanks,
brendan
_______________________________________________
squid-users mailing list
squid-users@xxxxxxxxxxxxxxxxxxxxx
http://lists.squid-cache.org/listinfo/squid-users
