Building clusterized proxy farms using LVS

Introduction

Sometimes, you just need to build a proxy farm with the following needs:

• you need high-availability, because of your SLA.
• you need load balancing, because you're serving numerous Kusers.
• you need caching with Squid.
• you need extra-services over Squid (URL filtering with DansGuardian/SquidGuard, Antivirus softwares, ...)
• you need scalability because you want to be able to grow.

In these cas, you've got plenty of answers to proceed. LVS is one of them (probably the best suited anyway).

But as you're doing extra-services over Squid, the base LVS ldirectord tests won't be sufficient.

This page explains how to make some more advanced tests to be sure some extra-services will be checked too, and the corresponding realserver service will be dropped down if one of the extra service (or Squid itself) is not available.

It present a proposed patch to ldirectord to do so.

Architecture

The system architecture of web cache cluster using LVS is illustrated in the following figure.

• it uses LVS with Ultramonkey 3 settings for a Streamline High Availability and Load Balancing setting.
• it's based on the usage for Squid + DansGuardian (but could feet for any Squid + *).

Configuration Example

To set up this configuration with LVS, just proceed to installation and configuration as indicated on the Ultramonkey documentations.

Then :

• set up your Squid server, listening on port 3128 (example) and using DansGuardian on port 8000
• set up your DansGuardian server, listening to port 8000
• set up DansGuardian to reject (filter) the "http://proxy.testing.net/" URL (adding this domain/url to the blacklists. Be sure the "URL Filtering" will be returned by the proxy in case of filtering this URL.
• patch /usr/sbin/ldirectord with the FIXME patch
• configure your /etc/ha.d/ldirectord.cf with the following tests (example IP addresses):

# /etc/ha.d/ldirectord.cf
# Virtual Server for Proxy Service and Filtering Service
virtual=192.168.0.100:3128
        real=192.168.0.10:3128 gate
        real=192.168.0.11:3128 gate
        real=192.168.0.12:3128 gate
        real=192.168.0.12:3128 gate
        service=proxy_http
        request="http://proxy.testing.net"
        receive="URL Filtering"
        protocol=tcp
        scheduler=wlc
        protocol=tcp
        checktype=negotiate

Conclusion

If you were using http test, you could only be able to check Squid is running. In case of DansGuardian issue, it could be a bad thing. This way, if the filtering engine is down/not responding, the whole Squid realserver will be dropped down for LVS.

Of course, you must still monitor all process to be warned anything is going wrong. But you will have time to resolve as your users won't notice anything :) Thank's a lot to LVS again!