[SOLVED] Mwan3 and squid

Installing and Using OpenWrt Network and Wireless Configuration
1

I would like to use squid proxy on my openwrt mwan3 enabled router but there is a (generic) problem with mwan3 (maybe my fault), the traffic generated from the router itself is painfully slow when mwan3 is activated so any computer that has manual proxy enabled will have slow traffic, the transparent proxy is working well (when proxy is not specified in the browser but iptables is redirecting the traffic)

the squid is configured to use only wanb ip for outgoing
I've selected the local source interface either lan,wan or wanb, but it doesn't help
I've added for destination 80 and 443 only wanb, also it doesn't help (actually it helps a bit, http seems to work well, the most problems seems to be with https)

this is the mwan3 troubleshooting https://pastebin.com/QMrGvMPh

any hint would be appreciated, I would like to try mwan3 instead of working scenario with shorewall

2

using the default (main routing table for 80 and 443) seems to solve the problem, and I can use squid for balancing if this is needed

3

Try the following:

  1. Use "lan" on mwan3 for router generated traffic.
  2. Create mwan3 rule with source IP as your LAN IP to send traffic through desired interface.

Post your findings.

4

the default for the Policy assigned is the only usable way, without anything at the router generated traffic

5

it seems that I encountered a bug in mwan3 rules but is strange that it works

6

I think the design decision to use local_source was a fault! I have a lot of problems with ipsec and openvpn.
On my system i set the local_source to none now. That means on router initiated traffic mwan3 is not involved. Traffic from lan is using the mwan3 rule set anyway. The only Problem we have with this configuration we have no failover and no loadbalancinfg for router initiated traffic the first default route is used.

The solution would be to set a lower routing metric in the default table for the interface which is active and should be used for router initiated outgoing traffic. This means we have a failover. Loadbalancing is not possible because we have no mangle table for router initiated traffic before routing decision.

Please test

7

thank you, I'll try !
the strange thing is that tcp_outgoing_address from squid is not working as it should with mwan3, but with shorewall and multiple providers, seems to work ok. I don't need to set manually the proxy anymore and is working somehow with port redirection, but for future it would be nice if we could have this, i'll try to see if I can export the rules shorewall is generating

8

@feckert this pr seems to work a bit better, but squid will fail on some sites

9

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.