I encountered the problem with configuration of two squid servers. I have the following scheme -
The main idea is to download all files from rackspace and amazon through parent squid and store all files in his cache.
On the main_squid server was configured PBR (iptables + ip route). All packets go through the same channels through which the requests were received
# ip ru sh
0: from all lookup local
1000: from all fwmark 0x3e8 lookup ISP1
2000: from all fwmark 0x7d0 lookup ISP2
3011: from all fwmark 0xbc3 lookup ISP3
32762: from xxx.xxx.xxx.62 lookup ISP1
32763: from yyy.yyy.yyy.239 lookup ISP2
32764: from zzz.zzz.zzz.10 lookup ISP3
32766: from all lookup main
32767: from all lookup default
main_squid squid.conf http_port 192.168.210.1:3128 transparent
cache_peer 192.168.220.2 sibling 3128 3130
dead_peer_timeout 5 seconds
acl AMAZON dstdom_regex -i (.*)s3\.amazonaws\.com
cache_peer_access 192.168.220.2 allow AMAZON
acl RACKSPACE dstdom_regex -i (.*)rackcdn\.com
cache_peer_access 192.168.220.2 allow RACKSPACE
url_rewrite_program /usr/bin/squidguard
url_rewrite_children 32
cache_dir null /tmp
cache_store_log none
cache deny all
acl local_net src 192.168.0.0/16
http_access allow local_net
parent_squid squid.conf
http_port 192.168.220.2:3128
acl main_squid src 192.168.220.1
http_access allow main_squid
http_access allow manager localhost
http_access allow manager main_squid
icp_access allow main_squid
cache_mem 30 GB
maximum_object_size_in_memory 128 MB
cache_dir aufs /squid 400000 16 256
minimum_object_size 16384 KB
maximum_object_size 1024 MB
cache_swap_low 93
cache_swap_high 98
acl PSD urlpath_regex -i \.psd$
cache allow PSD
acl ZIP urlpath_regex -i \.zip$
cache allow ZIP
acl OTHER url_regex -i ^http://*
cache deny OTHER
refresh_pattern \.psd$ 2592000 100 2592000 override-lastmod
override-expire ignore-reload ignore-no-cache
refresh_pattern \.zip$ 2592000 100 2592000 override-lastmod
override-expire ignore-reload ignore-no-cache
All work fine, until I uncomment on main_squid the following line
tcp_outgoing_address yyy.yyy.yyy.239
When I try to download any zip file from amazon I see the following message in cache.log
2013/04/22 01:00:41| TCP connection to 192.168.220.2/3128 failed
If I run tcpdump on yyy.yyy.yyy.239 I see that main_squid trying to connect to parent via external interface without success.
So my question. How may I configure main_squid that it could connect to the parent even with configured tcp_outgoing_address option?
P.S.
# squid -v
Squid Cache: Version 2.6.STABLE21
configure options: '--host=x86_64-unknown-linux-gnu'
'--build=x86_64-unknown-linux-gnu' '--program-prefix=' '--prefix=/usr'
'--exec-prefix=/usr' '--bindir=/usr/bin' '--sbindir=/usr/sbin'
'--sysconfdir=/etc' '--includedir=/usr/include' '--libdir=/usr/lib64'
'--libexecdir=/usr/libexec' '--sharedstatedir=/var/lib'
'--mandir=/usr/share/man' '--infodir=/usr/share/info'
'--exec_prefix=/usr' '--bindir=/usr/sbin'
'--libexecdir=/usr/lib64/squid' '--localstatedir=/var'
'--datadir=/usr/share' '--sysconfdir=/etc/squid' '--enable-arp-acl'
'--enable-epoll' '--enable-snmp' '--enable-removal-policies=heap,lru'
'--enable-storeio=aufs,coss,diskd,null,ufs' '--enable-ssl'
'--with-openssl=/usr/kerberos' '--enable-delay-pools'
'--enable-linux-netfilter' '--with-pthreads'
'--enable-ntlm-auth-helpers=SMB,fakeauth'
'--enable-external-acl-helpers=ip_user,ldap_group,unix_group,wbinfo_group'
'--enable-auth=basic,digest,ntlm,negotiate'
'--enable-negotiate-auth-helpers=squid_kerb_auth'
'--enable-digest-auth-helpers=password'
'--with-winbind-auth-challenge' '--enable-useragent-log'
'--enable-referer-log' '--disable-dependency-tracking'
'--enable-cachemgr-hostname=localhost' '--enable-underscores'
'--enable-basic-auth-helpers=LDAP,MSNT,NCSA,PAM,SMB,YP,getpwnam,multi-domain-NTLM,SASL'
'--enable-cache-digests' '--enable-ident-lookups'
'--enable-follow-x-forwarded-for' '--enable-wccpv2'
'--enable-fd-config' '--with-maxfd=16384'
'build_alias=x86_64-unknown-linux-gnu'
'host_alias=x86_64-unknown-linux-gnu' 'CFLAGS=-D_FORTIFY_SOURCE=2
-fPIE -Os -g -pipe -fsigned-char' 'LDFLAGS=-pie'
Any help would be highly appreciated
Take a look at squid's tcp_outgoing_address documentation
You can use an acl to limit the scope of
tcp_outgoing_address. Add the following to the main_squid configBut it's mostly unused feature which has lots of bugs (I've seen it crash squid in some cases). I'd recommend to use iptables to force the right interface/ip. Something like this should work
if someone is interested, below I have added working configuration files (main/parent squid)
main squid (192.168.220.1) configuration file
parent squid (192.168.220.2) configuration file