Squid Reverse proxy

[Renjith Nair]

hi all,

do any body know how to enable the reverse proxy feature for multiple web servers. In my setup there are 2 webmail servers. I had done it for a single webserver and its redirecting all the requests, but when i do it for multiple its giving me error.

can anybody help me

thanks in advance

[Vipulinux]

Hi
Check this out:
Configuring Squid as Reverse Proxy (http accelerator)

To set up Squid as an httpd accelerator, you simply configure the squid.conf file. Usually it is found in either /usr/local/squid/etc, when installed directly from source code, or /etc/squid when pre-installed on Red Hat Linux systems. The squid.conf file is used to set and configure all the different options for the Squid proxy server. As root open the squid.conf file in your favorite text editor. If the real web server runs on a separate machine than the Squid reverse proxy, edit the following options in the squid.conf file :

http_port 80 # Port of Squid proxy
httpd_accel_host 172.16.1.115 # IP address of web server
httpd_accel_port 80 # Port of web server
httpd_accel_single_host on # Forward uncached requests to single host
httpd_accel_with_proxy on #
httpd_accel_uses_host_header off

If the web server runs on the same machine where Squid is running, the web server daemon must be set to run on port 81 (or any other port than 80). With the Apache web server, it can done by assigning the line "Port 80" to "Port 81" in its httpd.conf file. The Squid.conf must also be modified to redirect missed requests to port 81 of the local machine :

http_port 80 # Port of Squid proxy
httpd_accel_host localhost # IP address of web server
httpd_accel_port 81 # Port of web server
httpd_accel_single_host on # Forward uncached requests to single host
httpd_accel_with_proxy on #
httpd_accel_uses_host_header off

We describe these options in greater detail.

http_port 80

The option http_port specifies the port number where Squid will listen for HTTP client requests. If this option is set to port 80, the client will have the illusion of being connected to the actual web server. This options should always be port 80.

httpd_accel_host 172.16.1.115 and httpd_accel_port 80

The options httpd_accel_host and httpd_accel_port specify the IP address and port number of the real HTTP Server, such as Apache. In our configuration, the real HTTP Web Server is on the IP address 172.16.1.115 and on port 80.

If we are using the reverse proxy for more than one web server, then we must use the word virtual as the httpd_accel_host. Uncached requests can only be forwarded to one port. There is no table that associates accelerated hosts and a destination port. When the web server is running on the same machine as Squid, set the web server to listen for connections on a different port (8000, for example), and set the httpd_accel_port option to the same value.

httpd_accel_single_host on

To run Squid with a single back end web server, set httpd_accel_single_host option to on. Squid will forward all uncached requests to this web server regardless of what any redirectors or Host headers says. If the Squid reverse proxy must support multiple back end web servers, set this option to off, and use a redirector (or host table or private DNS) to map the requests to the appropriate back end servers. Note that the mapping needs to be a 1-1 mapping between requested and backend (from redirector) domain names or caching will fail, as caching is performed using the URL returned from the redirector. See also rewrites_host_header.

httpd_accel_with_proxy on

If one wants to use Squid as both an httpd accelerator and as a proxy for local client machines, set the httpd_accel_with_proxy to on. By default, it is off. Note however that your proxy users may have trouble reaching the accelerated domains, unless their browsers are configured not to use the Squid proxy for those domains. The no_proxy option can be used to direct clients not to use the proxy for certain domains.

httpd_accel_uses_host_header off

Requests in HTTP version 1.1 include a Host header, specifying the host name (or IP address) of the URL. This option should remain off in reverse proxy mode. The only time this option must be set to on is when Squid is configured as a Transparent proxy.

It's important to note that acls (access control lists) are checked before this translation. You must combine this option with strict source-address checks, so you cannot use this option to accelerate multiple back end servers.



Configuring Squid as Reverse Proxy for Multiple Domains (http accelerator)

You can configure squid in an accelerator mode for multiple domains also. For example you can configure single squid machine for www.abc.com, www.xyz.com, www.lmn.com.

Squid configuration

httpd_accel_host virtual

httpd_accel_port 80 (the web server port)

httpd_accel_single_host off (It should be disabled when we are going to the reverse proxy for multiple servers)

httpd_accel_uses_host_header on

Note: When you compile Squid enable the Internal DNS option

To set the reverse proxy for the domain

www.abc.com 192.168.1.2
www.xyz.com 192.168.1.2
www.lmn.com 192.168.1.2

Let reverse_proxy server ip be 192.168.1.2

DNS entry in the reverse proxy server

You need to configure Intranet DNS and Internet DNS. You can configure split DNS if you want both the DNS in same machine. Instead of Intranet DNS you can have domain entries in /etc/hosts. You have to configure squid with --disable-internal-dns to use /etc/hosts file lookup.

Internal DNS entry

www.abc.com IN A 172.16.1.2
www.xyz.com IN A 172.16.1.3
www.lmn.com IN A 172.16.1.4

Note: If you have compiled with disable internal dns, then add the entry in the /etc/hosts like

172.16.1.2 www.abc.com
172.16.1.3 www.xyz.com
172.16.1.4 www.lmn.com

Internal DNS entry

www.abc.com 192.168.1.2
www.xyz.com 192.168.1.2
www.lmn.com 192.168.1.2


Cheers

[Senthil Prabu.S_1]

Hi,
check out this whitepaper about reverse proxy using squid.

http://www.visolve.com/beta/squid-vi/white-papers/ReverseProxy.htm

Really, it is a good guide from ViSolve.


HTH,
Prabu.S

[Renjith Nair]

I read that links earlier but iam having doubt still. Bcoz in my scenario there are two lotus notes servers in backend. So all the users coming to the rev. proxy should be authenticated. can we integrate the authentication in rev. proxy. how will the lotus notes redirect the client request back

thanks for the response

[Vipulinux]

Hi

Do u want squid to do the auth, or you want the req to go to lotus and auth is done ther...also what kind of auth scheme are u using???

Cheers

[Senthil Prabu.S_1]

Hi,
If you want squid to do it, there are four different authentication methods suported with squid. You can use anyone.

Refer this link for more details;
http://www.visolve.com/squid/squid30/externalsupport.html

HTH,
Prabu.S

[Ivan Ferreira]

I'm not sure if the reverse proxy will do what you want. You need a connection persistence, so when a client starts a session into one webmail server, the connection remains to the same webmail server during the session. If the connection is redirected to another server when doing another request, you will have an error.

Persistence is handled by Linux Virtual Server (LVS).

[Renjith Nair]

I have already done a reverse proxy with single server. Its working fine and authentication is doing by lotus notes. But i have two lotus notes server, and each one having different users, Then i added a redirection script also. I am attaching these files. pls find this and help me.

thanks for the replies

renjith nair