multipath proxy chaining (failover)

am 02.02.2010 10:26:19 von Romain De Rasse

Hi,

I use the ProxyRemote Directive from the mod_proxy module.

I try to do multipath proxy chaining.

I mean :
ProxyRemote * http://192.168.1.1:999
ProxyRemote * http://192.168.1.254:999

The desired effect is that Apache firstly tries the proxy "192.168.1.1" and forward the request to this proxy if he is available.
If this proxy is down, then I'd like Apache to try the second proxy (192.168.1.254), so the path to the web server would be different (failover in case of a dead proxy).

At this time I didn't succeed ;if the first proxy is down then the connection fails.

Does someone have already succeeded in doing such a thing ?

regards,

Romain

------------------------------------------------------------ ---------
The official User-To-User support forum of the Apache HTTP Server Project.
See for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org

RE: multipath proxy chaining (failover)

am 02.02.2010 10:56:37 von Emmanuel Bailleul

Re: RE: multipath proxy chaining (failover)

am 02.02.2010 17:08:43 von Romain De Rasse

Emmanuel,

thank you for your answer.

I read some docs, made some tests and I don't think I will succeed using Pr=
oxyPass and the balancer.

To be more specific, here is the original architecture, which is OK :
Web clients have a proxy configured in their browser : IP1 port 999.
The first Apache proxy (with IP address IP1) listens on port 999 and has a =
ProxyRemote configuration ("ProxyRemote * http://IP2:999"),
The second Apache proxy in the chain (with IP address IP2) is the las proxy=
in the chain, so he performs the DNS request on behalf of the client and r=
eaches the web server.

I don't use any Reverse Proxy fonctionnality, and I try to provide failover=
for the second Apache proxy in the chain with IP address IP2.

I tried this configuration for the first proxy in the chain (IP1) :
"ProxyRemote * http://FQDN:999"
resolving "FQDN" with 2 IP addresses, always in the same order (IP2 then th=
e IP of the new proxy used for failover).
Unfortunately this is too slow if the first address become unreachable.

It seems that Apache is not designed to do what I try to do. I keep searchi=
ng.

Regards,

Romain

==================== =====3D=
===============3D
Date du message : fÃ©vr. 02 2010, 10:57 AM
De : "Emmanuel Bailleul"
A : "users@httpd.apache.org"
Copie :=20
Sujet : RE: [users@httpd] multipath proxy chaining (failover)
=20
> -----Message d'origine-----
> DeÂ : Romain De Rasse [mailto:romain.derasse@atosorigin.com]
> EnvoyÃ©Â : mardi 2 fÃ©vrier 2010 10:26
> ÃÂ : users@httpd.apache.org
> ObjetÂ : [users@httpd] multipath proxy chaining (failover)
>=20
> Hi,
>=20
> I use the ProxyRemote Directive from the mod_proxy module.
>=20
> I try to do multipath proxy chaining.
>=20
> I mean :
> ProxyRemote * http://192.168.1.1:999
> ProxyRemote * http://192.168.1.254:999
>=20
> The desired effect is that Apache firstly tries the proxy "192.168.1.1"
> and forward the request to this proxy if he is available.
> If this proxy is down, then I'd like Apache to try the second proxy
> (192.168.1.254), so the path to the web server would be different
> (failover in case of a dead proxy).
>=20
> At this time I didn't succeed ;if the first proxy is down then the
> connection fails.
>=20
> Does someone have already succeeded in doing such a thing ?
>=20
> regards,
>=20
> Romain
>=20
>=20
=20
Hi,
=20
The 'ProxyRemote' directive does not seem to handle failover on its own, a=
s per http://httpd.apache.org/docs/2.2/mod/mod_proxy.html#proxyrem ote.=20
Depending on the config of your Apache server (in particular if you use it=
for other purposes -ie reverse proxy), you could maybe use a "balancer set=
up" with two members, the latter being configured as 'hot-standby' (?). See=
http://httpd.apache.org/docs/2.2/mod/mod_proxy.html#proxypas s in the same =
doc for an sample config.
If your goal is only to perform failover of proxy servers, you may also us=
e other "failover" techniques and/or softwares, for ex. : LVS, haproxy, ...=
=20
=20
Regards.
=20
Emmanuel
=20

Romain De Rasse=20
Atos Origin InfogÃ©rance=20
Workplace et Communications Services
Tour Horizon=20
64 rue du 8 Mai 1945=20
92025 Nanterre Cedex

------------------------------------------------------------ ---------
The official User-To-User support forum of the Apache HTTP Server Project.
See for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org

RE: RE: multipath proxy chaining (failover)

am 02.02.2010 19:13:12 von Emmanuel Bailleul

PiAtLS0tLU1lc3NhZ2UgZCdvcmlnaW5lLS0tLS0NCj4gRGXCoDogUm9tYWlu IERlIFJhc3NlIFtt
YWlsdG86cm9tYWluLmRlcmFzc2VAYXRvc29yaWdpbi5jb21dDQo+IEVudm95 w6nCoDogbWFyZGkg
MiBmw6l2cmllciAyMDEwIDE3OjA5DQo+IMOAwqA6IHVzZXJzQGh0dHBkLmFw YWNoZS5vcmcNCj4g
Q2PCoDogRW1tYW51ZWwgQmFpbGxldWwNCj4gT2JqZXTCoDogUmU6IFJFOiBb dXNlcnNAaHR0cGRd
IG11bHRpcGF0aCBwcm94eSBjaGFpbmluZyAoZmFpbG92ZXIpDQo+IA0KPiBF bW1hbnVlbCwNCj4g
DQo+IHRoYW5rIHlvdSBmb3IgeW91ciBhbnN3ZXIuDQo+IA0KPiBJIHJlYWQg c29tZSBkb2NzLCBt
YWRlIHNvbWUgdGVzdHMgYW5kIEkgZG9uJ3QgdGhpbmsgSSB3aWxsIHN1Y2Nl ZWQgdXNpbmcNCj4g
UHJveHlQYXNzIGFuZCB0aGUgYmFsYW5jZXIuDQo+IA0KPiBUbyBiZSBtb3Jl IHNwZWNpZmljLCBo
ZXJlIGlzIHRoZSBvcmlnaW5hbCBhcmNoaXRlY3R1cmUsIHdoaWNoIGlzIE9L IDoNCj4gV2ViIGNs
aWVudHMgaGF2ZSBhIHByb3h5IGNvbmZpZ3VyZWQgaW4gdGhlaXIgYnJvd3Nl ciA6IElQMSBwb3J0
IDk5OS4NCj4gVGhlIGZpcnN0IEFwYWNoZSBwcm94eSAod2l0aCBJUCBhZGRy ZXNzIElQMSkgbGlz
dGVucyBvbiBwb3J0IDk5OSBhbmQgaGFzIGENCj4gUHJveHlSZW1vdGUgY29u ZmlndXJhdGlvbiAo
IlByb3h5UmVtb3RlICogaHR0cDovL0lQMjo5OTkiKSwNCj4gVGhlIHNlY29u ZCBBcGFjaGUgcHJv
eHkgaW4gdGhlIGNoYWluICh3aXRoIElQIGFkZHJlc3MgSVAyKSBpcyB0aGUg bGFzDQo+IHByb3h5
IGluIHRoZSBjaGFpbiwgc28gaGUgcGVyZm9ybXMgdGhlIEROUyByZXF1ZXN0 IG9uIGJlaGFsZiBv
ZiB0aGUgY2xpZW50DQo+IGFuZCByZWFjaGVzIHRoZSB3ZWIgc2VydmVyLg0K PiANCj4gSSBkb24n
dCB1c2UgYW55IFJldmVyc2UgUHJveHkgZm9uY3Rpb25uYWxpdHksIGFuZCBJ IHRyeSB0byBwcm92
aWRlDQo+IGZhaWxvdmVyIGZvciB0aGUgc2Vjb25kIEFwYWNoZSBwcm94eSBp biB0aGUgY2hhaW4g
d2l0aCBJUCBhZGRyZXNzIElQMi4NCj4gDQo+IEkgdHJpZWQgdGhpcyBjb25m aWd1cmF0aW9uIGZv
ciB0aGUgZmlyc3QgcHJveHkgaW4gdGhlIGNoYWluIChJUDEpIDoNCj4gIlBy b3h5UmVtb3RlICog
aHR0cDovL0ZRRE46OTk5Ig0KPiByZXNvbHZpbmcgIkZRRE4iIHdpdGggMiBJ UCBhZGRyZXNzZXMs
IGFsd2F5cyBpbiB0aGUgc2FtZSBvcmRlciAoSVAyIHRoZW4NCj4gdGhlIElQ IG9mIHRoZSBuZXcg
cHJveHkgdXNlZCBmb3IgZmFpbG92ZXIpLg0KPiBVbmZvcnR1bmF0ZWx5IHRo aXMgaXMgdG9vIHNs
b3cgaWYgdGhlIGZpcnN0IGFkZHJlc3MgYmVjb21lIHVucmVhY2hhYmxlLg0K PiANCj4gSXQgc2Vl
bXMgdGhhdCBBcGFjaGUgaXMgbm90IGRlc2lnbmVkIHRvIGRvIHdoYXQgSSB0 cnkgdG8gZG8uIEkg
a2VlcA0KPiBzZWFyY2hpbmcuDQo+IA0KPiBSZWdhcmRzLA0KPiANCj4gUm9t YWluDQo+IA0KPiA9
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09DQo+ICBE YXRlIGR1IG1lc3Nh
Z2UgOiBmw6l2ci4gMDIgMjAxMCwgMTA6NTcgQU0NCj4gIERlIDogIkVtbWFu dWVsIEJhaWxsZXVs
IiA8RW1tYW51ZWwuQmFpbGxldWxAdGVsaW5kdXMuZnI+DQo+ICBBIDogInVz ZXJzQGh0dHBkLmFw
YWNoZS5vcmciIDx1c2Vyc0BodHRwZC5hcGFjaGUub3JnPg0KPiAgQ29waWUg Og0KPiAgU3VqZXQg
OiBSRTogW3VzZXJzQGh0dHBkXSBtdWx0aXBhdGggcHJveHkgY2hhaW5pbmcg KGZhaWxvdmVyKQ0K
PiANCj4gID4gLS0tLS1NZXNzYWdlIGQnb3JpZ2luZS0tLS0tDQo+ICA+IERl wqA6IFJvbWFpbiBE
ZSBSYXNzZSBbbWFpbHRvOnJvbWFpbi5kZXJhc3NlQGF0b3NvcmlnaW4uY29t XQ0KPiAgPiBFbnZv
ecOpwqA6IG1hcmRpIDIgZsOpdnJpZXIgMjAxMCAxMDoyNg0KPiAgPiDDgMKg OiB1c2Vyc0BodHRw
ZC5hcGFjaGUub3JnDQo+ICA+IE9iamV0wqA6IFt1c2Vyc0BodHRwZF0gbXVs dGlwYXRoIHByb3h5
IGNoYWluaW5nIChmYWlsb3ZlcikNCj4gID4NCj4gID4gSGksDQo+ICA+DQo+ ICA+IEkgdXNlIHRo
ZSBQcm94eVJlbW90ZSBEaXJlY3RpdmUgZnJvbSB0aGUgbW9kX3Byb3h5IG1v ZHVsZS4NCj4gID4N
Cj4gID4gSSB0cnkgdG8gZG8gbXVsdGlwYXRoIHByb3h5IGNoYWluaW5nLg0K PiAgPg0KPiAgPiBJ
IG1lYW4gOg0KPiAgPiBQcm94eVJlbW90ZSAqIGh0dHA6Ly8xOTIuMTY4LjEu MTo5OTkNCj4gID4g
UHJveHlSZW1vdGUgKiBodHRwOi8vMTkyLjE2OC4xLjI1NDo5OTkNCj4gID4N Cj4gID4gVGhlIGRl
c2lyZWQgZWZmZWN0IGlzIHRoYXQgQXBhY2hlIGZpcnN0bHkgdHJpZXMgdGhl IHByb3h5ICIxOTIu
MTY4LjEuMSINCj4gID4gYW5kIGZvcndhcmQgdGhlIHJlcXVlc3QgdG8gdGhp cyBwcm94eSBpZiBo
ZSBpcyBhdmFpbGFibGUuDQo+ICA+IElmIHRoaXMgcHJveHkgaXMgZG93biwg dGhlbiBJJ2QgbGlr
ZSBBcGFjaGUgdG8gdHJ5IHRoZSBzZWNvbmQgcHJveHkNCj4gID4gKDE5Mi4x NjguMS4yNTQpLCBz
byB0aGUgcGF0aCB0byB0aGUgd2ViIHNlcnZlciB3b3VsZCBiZSBkaWZmZXJl bnQNCj4gID4gKGZh
aWxvdmVyIGluIGNhc2Ugb2YgYSBkZWFkIHByb3h5KS4NCj4gID4NCj4gID4g QXQgdGhpcyB0aW1l
IEkgZGlkbid0IHN1Y2NlZWQgO2lmIHRoZSBmaXJzdCBwcm94eSBpcyBkb3du IHRoZW4gdGhlDQo+
ICA+IGNvbm5lY3Rpb24gZmFpbHMuDQo+ICA+DQo+ICA+IERvZXMgc29tZW9u ZSBoYXZlIGFscmVh
ZHkgc3VjY2VlZGVkIGluIGRvaW5nIHN1Y2ggYSB0aGluZyA/DQo+ICA+DQo+ ICA+IHJlZ2FyZHMs
DQo+ICA+DQo+ICA+IFJvbWFpbg0KPiAgPg0KPiAgPg0KPiANCj4gIEhpLA0K PiANCj4gIFRoZSAn
UHJveHlSZW1vdGUnIGRpcmVjdGl2ZSBkb2VzIG5vdCBzZWVtIHRvIGhhbmRs ZSBmYWlsb3ZlciBv
biBpdHMgb3duLA0KPiBhcyBwZXIgaHR0cDovL2h0dHBkLmFwYWNoZS5vcmcv ZG9jcy8yLjIvbW9k
L21vZF9wcm94eS5odG1sI3Byb3h5cmVtb3RlLg0KPiAgRGVwZW5kaW5nIG9u IHRoZSBjb25maWcg
b2YgeW91ciBBcGFjaGUgc2VydmVyIChpbiBwYXJ0aWN1bGFyIGlmIHlvdSB1 c2UNCj4gaXQgZm9y
IG90aGVyIHB1cnBvc2VzIC1pZSByZXZlcnNlIHByb3h5KSwgeW91IGNvdWxk IG1heWJlIHVzZSBh
ICJiYWxhbmNlcg0KPiBzZXR1cCIgd2l0aCB0d28gbWVtYmVycywgdGhlIGxh dHRlciBiZWluZyBj
b25maWd1cmVkIGFzICdob3Qtc3RhbmRieScgKD8pLg0KPiBTZWUgaHR0cDov L2h0dHBkLmFwYWNo
ZS5vcmcvZG9jcy8yLjIvbW9kL21vZF9wcm94eS5odG1sI3Byb3h5cGFzcyBp biB0aGUNCj4gc2Ft
ZSBkb2MgZm9yIGFuIHNhbXBsZSBjb25maWcuDQo+ICBJZiB5b3VyIGdvYWwg aXMgb25seSB0byBw
ZXJmb3JtIGZhaWxvdmVyIG9mIHByb3h5IHNlcnZlcnMsIHlvdSBtYXkgYWxz bw0KPiB1c2Ugb3Ro
ZXIgImZhaWxvdmVyIiB0ZWNobmlxdWVzIGFuZC9vciBzb2Z0d2FyZXMsIGZv ciBleC4gOiBMVlMs
IGhhcHJveHksDQo+IC4uLg0KPiANCj4gIFJlZ2FyZHMuDQo+IA0KPiAgRW1t YW51ZWwNCj4gDQo+
IA0KPiANCj4gUm9tYWluIERlIFJhc3NlDQo+IEF0b3MgT3JpZ2luIEluZm9n w6lyYW5jZQ0KPiBX
b3JrcGxhY2UgZXQgQ29tbXVuaWNhdGlvbnMgU2VydmljZXMNCj4gVG91ciBI b3Jpem9uDQo+IDY0
IHJ1ZSBkdSA4IE1haSAxOTQ1DQo+IDkyMDI1IE5hbnRlcnJlIENlZGV4DQoN Cg0KSU1ITywgdXNp
bmcgZG5zIHJvdW5kIHJvYmluIGlzIG5vdCB0aGUgcmlnaHQgd2F5IHRvIGdv IGluIHlvdXIgc2l0
dWF0aW9uLCBkdWUgdG8gVFRMcyBvZiByZWNvcmRzIGFuZCB2YXJpb3VzIGRu cyBjYWNoZXMgKGlu
Y2x1ZGluZyBpbiBicm93c2VycykgdGhhdCBjb3VsZCBtYWtlIHRoZSBmYWls b3ZlciB1bnVzYWJs
ZSAuLi4NCkFnYWluLCBpZiB5b3UganVzdCBoYXZlIHRvIHByb3ZpZGUgaHR0 cCBwcm94eSBmYWls
b3ZlciBmb3IgMiBib3hlcywgb25lIG9mIHRoZSBzaW1wbGVzdCBzZXR1cCB3 b3VsZCBiZSB0byB1
c2UgTFZTIChodHRwOi8vd3d3LmxpbnV4dmlydHVhbHNlcnZlci5vcmcvKSwg aW4gTFZTLURSIG1v
ZGUgZm9yIGV4YW1wbGUsIG9yIHNvbWUgb3RoZXIgc29mdCBsb2FkIGJhbGFu Y2VyIGxpa2UgaGFw
cm94eSAoaHR0cDovL2hhcHJveHkuMXd0LmV1LyksIHdoaWNoIEkgd291bGQg cmVjb21tZW5kIGZv
ciBzZXZlcmFsIHJlYXNvbnMsIGluY2x1ZGluZyBpdHMgZWFzZSBvZiB1c2Uu DQoNCkVtbWFudWVs
DQo=

Re: RE: RE: multipath proxy chaining (failover)

am 03.02.2010 10:08:29 von Romain De Rasse

Hi,

about DNS, the problem is more about timeouts than about TTLs or caches bec=
ause I don't use round robin but fixed rrsets. But still DNS is not the rig=
ht solution.

I'll definitely look more deeply at LVS and haproxy ; I firstly focused on =
Apache and DNS in order not to change the existing architecture too much (c=
ost effectiveness :-)

Thanks for your help.

Regards,

Romain

==================== =====3D=
===============3D
Date du message : fÃ©vr. 02 2010, 07:13 PM
De : "Emmanuel Bailleul"
A : "users@httpd.apache.org"
Copie :=20
Sujet : RE: RE: [users@httpd] multipath proxy chaining (failover)
=20
> -----Message d'origine-----
> DeÂ : Romain De Rasse [mailto:romain.derasse@atosorigin.com]
> EnvoyÃ©Â : mardi 2 fÃ©vrier 2010 17:09
> ÃÂ : users@httpd.apache.org
> CcÂ : Emmanuel Bailleul
> ObjetÂ : Re: RE: [users@httpd] multipath proxy chaining (failover)
>=20
> Emmanuel,
>=20
> thank you for your answer.
>=20
> I read some docs, made some tests and I don't think I will succeed using
> ProxyPass and the balancer.
>=20
> To be more specific, here is the original architecture, which is OK :
> Web clients have a proxy configured in their browser : IP1 port 999.
> The first Apache proxy (with IP address IP1) listens on port 999 and has=
a
> ProxyRemote configuration ("ProxyRemote * http://IP2:999"),
> The second Apache proxy in the chain (with IP address IP2) is the las
> proxy in the chain, so he performs the DNS request on behalf of the clie=
nt
> and reaches the web server.
>=20
> I don't use any Reverse Proxy fonctionnality, and I try to provide
> failover for the second Apache proxy in the chain with IP address IP2.
>=20
> I tried this configuration for the first proxy in the chain (IP1) :
> "ProxyRemote * http://FQDN:999"
> resolving "FQDN" with 2 IP addresses, always in the same order (IP2 then
> the IP of the new proxy used for failover).
> Unfortunately this is too slow if the first address become unreachable.
>=20
> It seems that Apache is not designed to do what I try to do. I keep
> searching.
>=20
> Regards,
>=20
> Romain
>=20
> ==================== =====
================
> Date du message : fÃ©vr. 02 2010, 10:57 AM
> De : "Emmanuel Bailleul"
> A : "users@httpd.apache.org"
> Copie :
> Sujet : RE: [users@httpd] multipath proxy chaining (failover)
>=20
> > -----Message d'origine-----
> > DeÂ : Romain De Rasse [mailto:romain.derasse@atosorigin.com]
> > EnvoyÃ©Â : mardi 2 fÃ©vrier 2010 10:26
> > ÃÂ : users@httpd.apache.org
> > ObjetÂ : [users@httpd] multipath proxy chaining (failover)
> >
> > Hi,
> >
> > I use the ProxyRemote Directive from the mod_proxy module.
> >
> > I try to do multipath proxy chaining.
> >
> > I mean :
> > ProxyRemote * http://192.168.1.1:999
> > ProxyRemote * http://192.168.1.254:999
> >
> > The desired effect is that Apache firstly tries the proxy "192.168.1.=
1"
> > and forward the request to this proxy if he is available.
> > If this proxy is down, then I'd like Apache to try the second proxy
> > (192.168.1.254), so the path to the web server would be different
> > (failover in case of a dead proxy).
> >
> > At this time I didn't succeed ;if the first proxy is down then the
> > connection fails.
> >
> > Does someone have already succeeded in doing such a thing ?
> >
> > regards,
> >
> > Romain
> >
> >
>=20
> Hi,
>=20
> The 'ProxyRemote' directive does not seem to handle failover on its own=
,
> as per http://httpd.apache.org/docs/2.2/mod/mod_proxy.html#proxyrem ote.
> Depending on the config of your Apache server (in particular if you use
> it for other purposes -ie reverse proxy), you could maybe use a "balance=
r
> setup" with two members, the latter being configured as 'hot-standby' (?=
).
> See http://httpd.apache.org/docs/2.2/mod/mod_proxy.html#proxypas s in the
> same doc for an sample config.
> If your goal is only to perform failover of proxy servers, you may also
> use other "failover" techniques and/or softwares, for ex. : LVS, haproxy=
,
> ...
>=20
> Regards.
>=20
> Emmanuel
>=20
>=20
>=20
> Romain De Rasse
> Atos Origin InfogÃ©rance
> Workplace et Communications Services
> Tour Horizon
> 64 rue du 8 Mai 1945
> 92025 Nanterre Cedex
=20
=20
IMHO, using dns round robin is not the right way to go in your situation, =
due to TTLs of records and various dns caches (including in browsers) that =
could make the failover unusable ...
Again, if you just have to provide http proxy failover for 2 boxes, one of=
the simplest setup would be to use LVS (http://www.linuxvirtualserver.org/=
), in LVS-DR mode for example, or some other soft load balancer like haprox=
y (http://haproxy.1wt.eu/), which I would recommend for several reasons, in=
cluding its ease of use.
=20
Emmanuel
=20

Romain De Rasse=20
Atos Origin InfogÃ©rance=20
Workplace et Communications Services
Tour Horizon=20
64 rue du 8 Mai 1945=20
92025 Nanterre Cedex

------------------------------------------------------------ ---------
The official User-To-User support forum of the Apache HTTP Server Project.
See for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org