1

Running Squid with a acl random ip setup, Have 745 ip's in the pool and we are about 10 users that use it with tools that are running multiple threads, Check rankings on Google etc

Issue: We did start to experiance som issues with a ip number that did turn up alot more often then all others. Did performe a simple test where i did use a proxy plugin in chrome and just visited a "Whats my ip" website, Everytime i refresh the page i get a new ip but after 2 - 5 requests i would get the servers main ip, Not the fallback ip.

Think one of the main issues is that 1 connection locks 1 ip, How do i get them shared ? This is my config

http_port 3128 

visible_hostname mydomain.com 

acl SSL_ports port 443 
acl Safe_ports port 80          # http 
acl Safe_ports port 21          # ftp 
acl Safe_ports port 443         # https 
acl CONNECT method CONNECT 

auth_param basic program /lib/squid/basic_db_auth --user squid 
--password x420WVNgm2D226v --plaintext --persist 
auth_param basic children 5 
auth_param basic realm mydomain.com 
auth_param basic credentialsttl 1 minute 
auth_param basic casesensitive off 

acl db-auth proxy_auth REQUIRED 
http_access allow db-auth 
http_access allow localhost 
http_access deny all 

# Limit to 1 connection per user 
# OR NAT 
client_ip_max_connections 100 
authenticate_ttl 1 hour 
authenticate_ip_ttl 5 seconds 

acl ip_unico max_user_ip -s 1 
http_access deny ip_unico 

server_persistent_connections off 

acl RandomIP random 1/754 

#anonymizer paranoid 
request_header_access Allow allow all 
request_header_access Authorization allow all 
request_header_access WWW-Authenticate allow all 
request_header_access Proxy-Authorization allow all 
request_header_access Proxy-Authenticate allow all 
request_header_access Cache-Control allow all 
request_header_access Content-Encoding allow all 
request_header_access Content-Length allow all 
request_header_access Content-Type allow all 
request_header_access Date allow all 
request_header_access Expires allow all 
request_header_access Host allow all 
request_header_access If-Modified-Since allow all 
request_header_access Last-Modified allow all 
request_header_access Location allow all 
request_header_access Pragma allow all 
request_header_access Accept allow all 
request_header_access Accept-Charset allow all 
request_header_access Accept-Encoding allow all 
request_header_access Accept-Language allow all 
request_header_access Content-Language allow all 
request_header_access Mime-Version allow all 
request_header_access Retry-After allow all 
request_header_access Title allow all 
request_header_access Connection allow all 
request_header_access All deny all 

header_replace User-Agent Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.4 (KHTML,              like Gecko) Chrome/22.0.1229.79 Safari/537.4 AlexaToolbar/alxg-3.1 

# RandomIP Pool 
tcp_outgoing_address xx.xxx.68.10 RandomIP 
tcp_outgoing_address xx.xxx.68.11 RandomIP 
tcp_outgoing_address xx.xxx.68.12 RandomIP 
tcp_outgoing_address xx.xxx.68.13 RandomIP 
tcp_outgoing_address xx.xxx.68.14 RandomIP 
tcp_outgoing_address xx.xxx.68.15 RandomIP 
tcp_outgoing_address xx.xxx.68.16 RandomIP 
tcp_outgoing_address xx.xxx.68.17 RandomIP 
.... 745 tot

# Fallback IP 
tcp_outgoing_address xx.xxx.67.255 

Can anyone help me out here ?

  • Just leaving an update that i did not solve this. Did after som tweaking get it to work a bit better but when getting to many connections requests i would throw servers IP. The problem could be that Squid's ACL can't handle high quantity request incoming correct. The solution for us was to put a router with RR ( Round-robin ) processing as a cache peer. In that way all Squid config was still valid and the router did handle all rotation of ip's. Works great and can handle massive requests without any problem at all ! – Mathias Asberg Oct 23 '12 at 01:51
  • With the reverse RR i remember we did handle 2000 requests per second. Every request resulted in that a new IP was committed to the specific user request. Then i realise i built a DDOS monster and put my cloud proxy service to sleep :) – Mathias Asberg Sep 24 '14 at 22:05

0 Answers0