<div dir="ltr">Hi Amos,<div><br></div><div>Sure, please add it.</div><div>Always nice to contribute a little bit :)</div><div><br></div><div>Cheers,</div><div>Bruce</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Thu, Aug 27, 2020 at 8:30 PM Amos Jeffries <<a href="mailto:squid3@treenet.co.nz">squid3@treenet.co.nz</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Nice writeup. Do you mind if I add this to the Squid wiki as an example<br>
for high-performance proxying?<br>
<br>
<br>
Amos<br>
<br>
<br>
<br>
On 27/08/20 4:35 pm, Bruce Rosenberg wrote:<br>
> Hi Eliezer,<br>
> <br>
> We are running a couple of Squid proxies (the real servers) in front of<br>
> a pair of LVS servers with keepalived and it works flawlessly.<br>
> The 2 x Squid proxies are active / active and the LVS servers are active<br>
> / passive.<br>
> If a Squid proxy dies the remaining proxy takes all the traffic.<br>
> If the active LVS server dies, keepalived running on the backup LVS (via<br>
> VRRP) moves the VIP to itself and it takes all the traffic, so the only<br>
> difference between the two is one has a higher priority so it gets the<br>
> VIP first.<br>
> I have included some sanitised snippets from a keepalived.conf file that<br>
> should help you.<br>
> You could easily scale this out if you need more than 2 Squid proxies.<br>
> <br>
> The config I provided is for LVS/DR (Direct Route) mode.<br>
> This method rewrites the MAC address of forwarded packets to that of one<br>
> of the real servers and is the most scalable way to run LVS.<br>
> It does require the LVS and real servers be on the same L2 network.<br>
> If that is not possible then consider LVS/TUN mode or LVS/NAT mode.<br>
> <br>
> As LVS/DR rewrites the MAC address, it requires each real server to have<br>
> the VIP address plumbed on an interface and also requires the real<br>
> servers to ignore ARP requests for the VIP address as the only device<br>
> that should respond to ARP requests for the VIP is the active LVS server.<br>
> We do this by configuring the VIP on the loopback interface on each real<br>
> but there are other methods as well such as dropping the ARP responses<br>
> using arptables, iptables or firewalld.<br>
> I think back in the kernel 2.4 and 2.6 days people used the noarp kernel<br>
> module which could be configured to ignore ARP requests for a particular<br>
> IP address but you don't really need this anymore.<br>
> <br>
> More info on the loopback arp blocking method -<br>
> <a href="https://www.loadbalancer.org/blog/layer-4-direct-routing-lvs-dr-and-layer-4-tun-lvs-tun-in-aws/" rel="noreferrer" target="_blank">https://www.loadbalancer.org/blog/layer-4-direct-routing-lvs-dr-and-layer-4-tun-lvs-tun-in-aws/</a><br>
> More info on firewall type arp blocking methods<br>
> - <a href="https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/load_balancer_administration/s1-lvs-direct-vsa" rel="noreferrer" target="_blank">https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/load_balancer_administration/s1-lvs-direct-vsa</a><br>
> More info about LVS/DR - <a href="http://kb.linuxvirtualserver.org/wiki/LVS/DR" rel="noreferrer" target="_blank">http://kb.linuxvirtualserver.org/wiki/LVS/DR</a><br>
> <br>
> If you are using a RPM based distro then to set up the LVS servers you<br>
> only need the ipvsadm and keepalived packages.<br>
> Install squid on the reals and configure the VIP on each and disable ARP.<br>
> Then build the keepalived.conf on both LVS servers and restart keepalived.<br>
> <br>
> The priority configuration stanza in the vrrp_instance section<br>
> determines the primary VRRP node (LVS server) for that virtual router<br>
> instance.<br>
> The secondary LVS server needs a lower priority compared to the primary.<br>
> You can configure one as the MASTER and the other as the BACKUP but our<br>
> guys make them both BACKUP and let the priority sort the election of the<br>
> primary out.<br>
> I think this might be to solve a problem of bringing up a BACKUP without<br>
> a MASTER but I can't confirm that.<br>
> <br>
> <br>
> Good luck.<br>
> <br>
> <br>
> $ cat /etc/keepalived/keepalived.conf<br>
> <br>
> global_defs {<br>
> <br>
> notification_email {<br>
> # <a href="mailto:rootmail@example.com" target="_blank">rootmail@example.com</a> <mailto:<a href="mailto:rootmail@example.com" target="_blank">rootmail@example.com</a>><br>
> }<br>
> notification_email_from <a href="mailto:keepalive-daemon@lvs01.example.com" target="_blank">keepalive-daemon@lvs01.example.com</a><br>
> <mailto:<a href="mailto:keepalive-daemon@lvs01.example.com" target="_blank">keepalive-daemon@lvs01.example.com</a>><br>
> smtp_server 10.1.2.3 # <a href="http://mail.example.com" rel="noreferrer" target="_blank">mail.example.com</a> <<a href="http://mail.example.com" rel="noreferrer" target="_blank">http://mail.example.com</a>><br>
> smtp_connect_timeout 30<br>
> lvs_id <a href="http://lvs01.example.com" rel="noreferrer" target="_blank">lvs01.example.com</a> <<a href="http://lvs01.example.com" rel="noreferrer" target="_blank">http://lvs01.example.com</a>> # Name to<br>
> mention in email.<br>
> }<br>
> <br>
> vrrp_instance LVS_example {<br>
> <br>
> state BACKUP<br>
> priority 150<br>
> interface eth0<br>
> lvs_sync_daemon_interface eth0<br>
> virtual_router_id 5<br>
> preempt_delay 20<br>
> <br>
> virtual_ipaddress_excluded {<br>
> <br>
> 10.10.10.10 # Squid proxy<br>
> }<br>
> <br>
> notify_master "some command to log or send an alert"<br>
> notify_backup "some command to log or send an alert"<br>
> notify_fault "some command to log or send an alert"<br>
> }<br>
> <br>
> <br>
> # SQUID Proxy<br>
> virtual_server 10.10.10.10 3128 {<br>
> <br>
> delay_loop 5<br>
> lb_algo wrr<br>
> lb_kind DR<br>
> protocol TCP<br>
> <br>
> real_server 10.10.10.11 3128 { # <a href="http://proxy01.example.com" rel="noreferrer" target="_blank">proxy01.example.com</a><br>
> <<a href="http://proxy01.example.com" rel="noreferrer" target="_blank">http://proxy01.example.com</a>><br>
> weight 1<br>
> inhibit_on_failure 1<br>
> TCP_CHECK {<br>
> connect_port 3128<br>
> connect_timeout 5<br>
> }<br>
> }<br>
> <br>
> real_server 10.10.10.12 3128 { # <a href="http://proxy02.example.com" rel="noreferrer" target="_blank">proxy02.example.com</a><br>
> <<a href="http://proxy02.example.com" rel="noreferrer" target="_blank">http://proxy02.example.com</a>><br>
> weight 1<br>
> inhibit_on_failure 1<br>
> TCP_CHECK {<br>
> connect_port 3128<br>
> connect_timeout 5<br>
> }<br>
> }<br>
> }<br>
> <br>
> <br>
> On Thu, Aug 27, 2020 at 8:24 AM Eliezer Croitor <<a href="mailto:ngtech1ltd@gmail.com" target="_blank">ngtech1ltd@gmail.com</a><br>
> <mailto:<a href="mailto:ngtech1ltd@gmail.com" target="_blank">ngtech1ltd@gmail.com</a>>> wrote:<br>
> <br>
> Hey All,____<br>
> <br>
> __ __<br>
> <br>
> I am reading about LB and tried to find an up-to-date example or<br>
> tutorial specific to squid with no luck.____<br>
> <br>
> I have seen:<br>
> <a href="http://kb.linuxvirtualserver.org/wiki/Building_Web_Cache_Cluster_using_LVS____" rel="noreferrer" target="_blank">http://kb.linuxvirtualserver.org/wiki/Building_Web_Cache_Cluster_using_LVS____</a><br>
> <br>
> __ __<br>
> <br>
> Which makes sense and also is similar or kind of identical to WCCP<br>
> with gre.____<br>
> <br>
> __ __<br>
> <br>
> Anyone knows about a working Squid setup with IPVS/LVS?____<br>
> <br>
> __ __<br>
> <br>
> Thanks,____<br>
> <br>
> Eliezer____<br>
> <br>
> __ __<br>
> <br>
> ----____<br>
> <br>
> Eliezer Croitoru____<br>
> <br>
> Tech Support____<br>
> <br>
> Mobile: +972-5-28704261____<br>
> <br>
> Email: <a href="mailto:ngtech1ltd@gmail.com" target="_blank">ngtech1ltd@gmail.com</a> <mailto:<a href="mailto:ngtech1ltd@gmail.com" target="_blank">ngtech1ltd@gmail.com</a>>____<br>
> <br>
> __ __<br>
> <br>
> _______________________________________________<br>
> squid-users mailing list<br>
> <a href="mailto:squid-users@lists.squid-cache.org" target="_blank">squid-users@lists.squid-cache.org</a><br>
> <mailto:<a href="mailto:squid-users@lists.squid-cache.org" target="_blank">squid-users@lists.squid-cache.org</a>><br>
> <a href="http://lists.squid-cache.org/listinfo/squid-users" rel="noreferrer" target="_blank">http://lists.squid-cache.org/listinfo/squid-users</a><br>
> <br>
> <br>
> _______________________________________________<br>
> squid-users mailing list<br>
> <a href="mailto:squid-users@lists.squid-cache.org" target="_blank">squid-users@lists.squid-cache.org</a><br>
> <a href="http://lists.squid-cache.org/listinfo/squid-users" rel="noreferrer" target="_blank">http://lists.squid-cache.org/listinfo/squid-users</a><br>
> <br>
_______________________________________________<br>
squid-users mailing list<br>
<a href="mailto:squid-users@lists.squid-cache.org" target="_blank">squid-users@lists.squid-cache.org</a><br>
<a href="http://lists.squid-cache.org/listinfo/squid-users" rel="noreferrer" target="_blank">http://lists.squid-cache.org/listinfo/squid-users</a><br>
</blockquote></div>