LTM like Web Proxy (Squid)

Posted By Fadhil Marus (TSID) on 11/08/2009 9:53 PM

 

 

Hi Arron,

 

 

it works!! there's SOL5299 for DNS resolution , and the HTTP proxy works like a charm, but still no HTTPS/CONNECT function, any ideas?

 

 

Thanks

 

Fadhil

 

 

 

so what was the irule that worked with plain http?

 

 

Hi Dom,

 

 

Fadhil was talking about the iRule posted above:

 

 

http://devcentral.f5.com/Default.aspx?tabid=53&forumid=31&postid=85518&view=topic85545

 

 

Aaron

Thanks Aaron but he reported errors with it, but regardless, found another way around the issue....thanks anyways.

Yep--which I fixed in the same post. Anyhow, it's not a fully functional rule and I am not sure it's plausible to implement full web proxy functionality in an iRule. So if you've found another solution that would probably be better.

 

 

Aaron

It would be so nice in future versions the iRule unlocked TCL command "http". The things I could do that ;-)

 

 

Bhattman

Works great! Had to do some modifications for the port detection, didn't work straight out of the box with v10.1.

 Check if host header has a port 
    if {$host contains ":"}{ 
 

I had to use [HTTP::host] instead of $host there to get it rolling.

Would I be able to make this to do HTTP --> HTTPS transition (with chosen SSL-profile) just by modifying this, or is that too complicated? I mean traffic sent to LTM in private network would be HTTP, and them LTM would send it to public network using HTTPS with chosen profile.

And actually, you could update the iRule for 10.1+ to use RESOLV::lookup instead of NAME::lookup. The RESOLV::lookup command should be more efficient than NAME::lookup:

 

 

 

http://devcentral.f5.com/wiki/default.aspx/iRules/resolv__lookup

 

 

The functional difference between the two is that RESOLV::lookup suspends and returns the result inline, whereas NAME::lookup continues and eventually causes NAME_RESOLVED to fire and then you need to call NAME::response to retrieve it.

 

 

 

Aaron

Thanks for the tips Aaron

 

 

If I recall correctly, the problem was that the value of $host didn't contain the port or the colon, so I used [HTTP::host] instead which fixed the issue.

 

 

I will try the RESOLV::lookup and SSL profile.

Hi Aaron,

 

 

Do the iRule you provided have URL redirect functionality and do we still need to define pool in the VS?

Hi Fadhil,

 

 

What's the configuration of your VS?

 

 

Thanks!