On 29/07/20 1:07 pm, Contato - KONNTROL wrote: > Hello Everyone, > Greetings. > > Background: > OS - FreeBSD 12.1 > SQUID ver 4.10 > OpenSSL 1.0.2u > > I am trying to use SQUID in front of E2Guardian (content filter) with the > following configuration at the SQUID side. > > ### > cache_peer 127.0.0.1 parent 8080 0 login=*:password > client_persistent_connections on > always_direct deny all > never_direct allow all > ### > > It works fine till the point SQUID exhausts all E2Guardian threads/workers, > no matter the amount you set. If 1000, SQUID is opening 1000 connections. If > 10.000, squid also opens 10.000 connections. > I tried the directive "client_persistent_connections on and off" with no > success. > Even using a single browser for testing purposes, for some reason SQUID > opens thousands of connections against the E2guardian. > I did a wireshark capture to "see" what is happening and it seems like a > lot of ACK/SYN with no payload. > > Any idea? Maybe I am using a wrong configuration. > You are. BUT, I think you have a forwarding loop happening so the correct config for limiting connections will not help. You should be able to test for loops by enabling the Via header. If your squid.conf contains "via off" remove that line. Assuming e2g is not removing that header Squid will reject loops with an error message. Check that the traffic leaving e2g is not going back into Squid. With the setup described e2g should be connecting directly to upstream/Internet servers - it should have no settings about Squid except those for processing the X-Forwarded-For header. If you are intercepting traffic to deliver it to Squid make sure the connections leaving e2g are not being caught by those firewall rules. If you are certain there is no loop the cache_peer max-conn=N is the way to limit the connections made to a peer. This will only help if the problem is high traffic flow. It will not help if there is a forwarding loop happening. > By the way, I am using SQUID in front of E2Guardian cause I use Kerberos > authentication (not supported by E2guardian) with FORWARDX option enable. > Sure. You may want to look at the features of e2g you are using and see whether Squid can do them instead. The idea there being to make deny decisions early as possible to minimize the total amount of processing work those transactions consume. You may find you can get rid of e2g entirely, which will improve overall performance and reduce management headaches from layers of proxy. Cheers Amos _______________________________________________ squid-users mailing list squid-users@xxxxxxxxxxxxxxxxxxxxx http://lists.squid-cache.org/listinfo/squid-users
