Mailing List Archive: pirahna+tranparent proxy

pirahna+tranparent proxy

Mar 3, 2001, 9:20 AM

Post #1 of 3 (429 views)

Hi everybody:

This is my first post to the list.
I've sent a mail to Keith Barrett <kbarrett@redhat.com> who's responsible for
the RedHat Piranha Project and he suggested me to post in this list.

We have been trying to set up a LVS of transproxy but have no success.
We are using RH6.2 with all updates from RedHat Piranha FTP site.

Further testing show us a way to make the things work.

We were testing with a LVS which was giving service 3128.
In the same host we setup an ipchains rule which redirected 80 to 81 port,
and a tproxy which redirect 81 to a Virtual IP on port 3128.
This model never worked, for some reason de indirection or the use of the
tproxy on the same host as the LVS doesn't work alltogether.

---------- ------------
80 | LVS | 3128 | RS | DOESN'T WORK
------->| VIP:3128 |------->| squid:3128 |

| ipchains | | |
| tproxy | | |

---------- ------------

If we configure a 3rd machine in front of the lvs which make the tproxy, it
WORKS FINE!!. But this adds a new problem 'cause we should make failover of
this machine too.

---------- ---------- ------------
80 | | 3128 | LVS | 3128 | RS |
------->| ipchains |------->| VIP:3128 |------->| squid:3128 | OK !!!

| tproxy | | | | |

---------- ---------- ------------

Please let me know if there is a way to setup the first configuration, this
solution should be better than the second because it imply that it would be
necessary to use two more pcs to make failover of the transproxy+ipchains
service.

TIA

--
________________________________________________

Ariel Pereira

SolX - Sistemas Abiertos y Conectividad con tecnologia LINUX

Re: pirahna+tranparent proxy [ In reply to ]

mack.joseph at epa

Mar 5, 2001, 6:57 AM

Post #2 of 3 (424 views)

Permalink

Ariel Pereira wrote:

> We have been trying to set up a LVS of transproxy but have no success.

there is some information on transparent proxy in the HOWTO section starting

http://www.linuxvirtualserver.org/Joseph.Mack/HOWTO/LVS-HOWTO_1.0-12.html#ss12.2

I think your transparent proxy is probably the type used in webcaches which
is transparent web proxy (they are both called transparent proxy unfortunately).

and some info on setting up LVS squids by Andreas Koenig in

http://www.linuxvirtualserver.org/Joseph.Mack/HOWTO/LVS-HOWTO_1.0-15.html

> Further testing show us a way to make the things work.
>
> We were testing with a LVS which was giving service 3128.
> In the same host we setup an ipchains rule which redirected 80 to 81 port,
> and a tproxy which redirect 81 to a Virtual IP on port 3128.
> This model never worked, for some reason de indirection or the use of the
> tproxy on the same host as the LVS doesn't work alltogether.
>
> ---------- ------------
> 80 | LVS | 3128 | RS | DOESN'T WORK
> ------->| VIP:3128 |------->| squid:3128 |
>
> | ipchains | | |
> | tproxy | | |
>
> ---------- ------------

the problem is that you are accepting packets on port 80 at the director and
the real-server is expecting packets on port 3218.

Here are some solutions and it depends a little on whether there is one IP
involved
(ie you're caching local webserver(s)) or many (you're caching the internet).

1. Ask people to make requests for that IP on 3128
2. Configure the squid to be transparent, ie to accept requests on port 80
3. use VS-NAT on the director and rewrite the ports (haven't tested this and
the rewritting will slow access, probably the opposite of what you want
in production, since the purpose of the squid is to speed access).

Joe

--
Joseph Mack PhD, Senior Systems Engineer, Lockheed Martin
contractor to the National Environmental Supercomputer Center,
mailto:mack.joseph@epa.gov ph# 919-541-0007, RTP, NC, USA

Re: pirahna+tranparent proxy [ In reply to ]

solx at internet

Mar 5, 2001, 3:23 PM

Post #3 of 3 (427 views)

Permalink

On Monday 05 March 2001 10:57, Joseph Mack wrote:

> http://www.linuxvirtualserver.org/Joseph.Mack/HOWTO/LVS-HOWTO_1.0-12.html#s
>s12.2
> http://www.linuxvirtualserver.org/Joseph.Mack/HOWTO/LVS-HOWTO_1.0-15.html
Thank you for the pointers, i'll check this out.

> the problem is that you are accepting packets on port 80 at the director
> and the real-server is expecting packets on port 3218.
> Here are some solutions and it depends a little on whether there is one IP
> involved
> (ie you're caching local webserver(s)) or many (you're caching the
> internet).
Yes, we are caching the inet.

> 1. Ask people to make requests for that IP on 3128
This is out of question, the clients are assigned automatically their ip, the
dns ip, and the default gateway. The gateway will be a LVS who will point
to a squid farm.

> 2. Configure the squid to be transparent, ie to accept requests on port 80
Just tested ... but will test this again, just in case i've missed something.

> 3. use VS-NAT on the director and rewrite the ports (haven't tested this
> and the rewritting will slow access, probably the opposite of what you want
> in production, since the purpose of the squid is to speed access).
Exactly, that's why we're trying to setup this, we're looking for fast inet
access.

Thank you for your comments and your time.

--
Saludos

Ariel Pereira
---------------------------------------------
SolX - Sistemas Abiertos y Conectividad con tecnología LiNUX