☰

squid：无法使用 tcp_outgoing_address 连接到对等方

tag-icon • tag-icon linux iptables squid
squid：无法使用 tcp_outgoing_address 连接到对等方

我遇到了配置两个 squid 服务器的问题。我有以下方案 -

在此处输入图片描述

主要思想是通过父级 squid 从 rackspace 和 amazon 下载所有文件并将所有文件存储在其缓存中。

在 main_squid 服务器上配置了 PBR（iptables + ip route）。所有数据包都通过与接收请求相同的通道

# ip ru sh
0:      from all lookup local
1000:   from all fwmark 0x3e8 lookup ISP1
2000:   from all fwmark 0x7d0 lookup ISP2
3011:   from all fwmark 0xbc3 lookup ISP3
32762:  from xxx.xxx.xxx.62 lookup ISP1
32763:  from yyy.yyy.yyy.239 lookup ISP2
32764:  from zzz.zzz.zzz.10 lookup ISP3
32766:  from all lookup main
32767:  from all lookup default

main_squid squid.conf http_port 192.168.210.1:3128 透明

cache_peer 192.168.220.2 sibling 3128 3130
dead_peer_timeout 5 seconds

acl AMAZON dstdom_regex -i (.*)s3\.amazonaws\.com
cache_peer_access 192.168.220.2 allow AMAZON

acl RACKSPACE dstdom_regex -i (.*)rackcdn\.com
cache_peer_access 192.168.220.2 allow RACKSPACE

url_rewrite_program /usr/bin/squidguard
url_rewrite_children 32

cache_dir null /tmp
cache_store_log none
cache deny all

acl local_net src 192.168.0.0/16
http_access allow local_net

parent_squid squid.conf

http_port 192.168.220.2:3128
acl main_squid src 192.168.220.1

http_access allow main_squid
http_access allow manager localhost
http_access allow manager main_squid

icp_access allow main_squid

cache_mem 30 GB
maximum_object_size_in_memory 128 MB
cache_dir aufs /squid 400000 16 256
minimum_object_size 16384 KB
maximum_object_size 1024 MB
cache_swap_low 93
cache_swap_high 98

acl PSD urlpath_regex -i \.psd$
cache allow PSD

acl ZIP urlpath_regex -i \.zip$
cache allow ZIP

acl OTHER url_regex -i ^http://*
cache deny OTHER

refresh_pattern \.psd$ 2592000 100 2592000 override-lastmod
override-expire ignore-reload ignore-no-cache
refresh_pattern \.zip$ 2592000 100 2592000 override-lastmod
override-expire ignore-reload ignore-no-cache

一切正常，直到我取消对 main_squid 以下行的注释

tcp_outgoing_address yyy.yyy.yyy.239

当我尝试从亚马逊下载任何 zip 文件时，我在 cache.log 中看到以下消息

2013/04/22 01:00:41| TCP connection to 192.168.220.2/3128 failed

如果我在 yyy.yyy.yyy.239 上运行 tcpdump，我会看到 main_squid 尝试通过外部接口连接到父级，但没有成功。

所以我的问题是，如何配置 main_squid，以便它能够连接到父级，即使配置了 tcp_outgoing_address 选项？

附言

# squid -v
Squid Cache: Version 2.6.STABLE21
configure options:  '--host=x86_64-unknown-linux-gnu'
'--build=x86_64-unknown-linux-gnu' '--program-prefix=' '--prefix=/usr'
'--exec-prefix=/usr' '--bindir=/usr/bin' '--sbindir=/usr/sbin'
'--sysconfdir=/etc' '--includedir=/usr/include' '--libdir=/usr/lib64'
'--libexecdir=/usr/libexec' '--sharedstatedir=/var/lib'
'--mandir=/usr/share/man' '--infodir=/usr/share/info'
'--exec_prefix=/usr' '--bindir=/usr/sbin'
'--libexecdir=/usr/lib64/squid' '--localstatedir=/var'
'--datadir=/usr/share' '--sysconfdir=/etc/squid' '--enable-arp-acl'
'--enable-epoll' '--enable-snmp' '--enable-removal-policies=heap,lru'
'--enable-storeio=aufs,coss,diskd,null,ufs' '--enable-ssl'
'--with-openssl=/usr/kerberos' '--enable-delay-pools'
'--enable-linux-netfilter' '--with-pthreads'
'--enable-ntlm-auth-helpers=SMB,fakeauth'
'--enable-external-acl-helpers=ip_user,ldap_group,unix_group,wbinfo_group'
'--enable-auth=basic,digest,ntlm,negotiate'
'--enable-negotiate-auth-helpers=squid_kerb_auth'
'--enable-digest-auth-helpers=password'
'--with-winbind-auth-challenge' '--enable-useragent-log'
'--enable-referer-log' '--disable-dependency-tracking'
'--enable-cachemgr-hostname=localhost' '--enable-underscores'
'--enable-basic-auth-helpers=LDAP,MSNT,NCSA,PAM,SMB,YP,getpwnam,multi-domain-NTLM,SASL'
'--enable-cache-digests' '--enable-ident-lookups'
'--enable-follow-x-forwarded-for' '--enable-wccpv2'
'--enable-fd-config' '--with-maxfd=16384'
'build_alias=x86_64-unknown-linux-gnu'
'host_alias=x86_64-unknown-linux-gnu' 'CFLAGS=-D_FORTIFY_SOURCE=2
-fPIE -Os -g -pipe -fsigned-char' 'LDFLAGS=-pie'

任何帮助都将不胜感激

答案1

看看鱿鱼tcp_outgoing_address 文档

您可以使用 acl 来限制 的范围tcp_outgoing_address。将以下内容添加到 main_squid 配置中

acl parent_squid dst 192.168.220.2/32
tcp_outgoing_address 192.168.220.1 parent_squid
tcp_outgoing_address yyy.yyy.yyy.239 !parent_squid

但它几乎是未使用的功能，有很多错误（我见过它在某些情况下使 squid 崩溃）。我建议使用 iptables 来强制正确的接口/ip。类似这样的方法应该可以工作

iptables -t nat -A PREROUTING -d 192.168.220.2/32 -j SNAT --to 192.168.220.1

答案2

如果有人感兴趣的话，下面我添加了工作配置文件（主/父 squid）

主 squid（192.168.220.1）配置文件

acl local_net src 192.168.0.0/16
acl parent_peer peername PARENT_PEER
acl parent_squid dst 192.168.220.2

acl FILE_TO_CACHE urlpath_regex \.(zip|iso|rar)$
acl STORAGE dstdomain storage.example.net

http_port 192.168.220.1:3128 intercept
icp_port 3130

cache_peer 192.168.220.2 parent 3128 3130 name=PARENT_PEER connect-timeout=7 proxy-only
cache_peer_access PARENT_PEER allow STORAGE FILE_TO_CACHE

# to connect to parent via internal interface
tcp_outgoing_address 192.168.220.1 parent_peer

# to properly get cache digest from parent
tcp_outgoing_address 192.168.220.1 parent_squid

# sent all other packets via ISP2
tcp_outgoing_address yyy.yyy.yyy.239 local_net

父 squid（192.168.220.2）配置文件

acl main_squid src 192.168.220.1
acl FILE_TO_CACHE urlpath_regex -i \.(zip|iso|rar)$

cache allow FILE_TO_CACHE
cache deny all

http_access allow main_squid
http_access allow localhost
http_access deny all

icp_port 3130
icp_access allow main_squid
icp_access deny all

http_port 192.168.220.2:3128

cache_mem 12 GB
maximum_object_size_in_memory 64 MB
minimum_object_size 16384 KB
maximum_object_size 1024 MB

cache_swap_low 93
cache_swap_high 98

refresh_pattern \.iso$ 129600 100 129600 override-lastmod override-expire ignore-reload
refresh_pattern \.zip$ 129600 100 129600 override-lastmod override-expire ignore-reload
refresh_pattern \.rar$ 129600 100 129600 override-lastmod override-expire ignore-reload

cache_effective_user squid
cache_effective_group squid

相关内容