squid：不能用tcp_outgoing_address连接到peer

我遇到了configuration两个鱿鱼服务器的问题。 我有以下计划 –

主要思想是通过父鱿鱼从rackspace和amazon下载所有文件，并将所有文件存储在他的caching中。

在main_squid服务器上configuration了PBR（iptables + ip route）。 所有的数据包都经过了收到请求的相同频道

• 虚拟networking可重复testing
• networkingstream量不会通过使用Xen + libvirt的桥接接口从VM转发到networking
• 如何通过VPN发送cURL发出的HTTP请求？
• iptables可以丢弃stream量，但不能redirect
• 通过VPN提供公共访问本地Web服务器

# ip ru sh 0: from all lookup local 1000: from all fwmark 0x3e8 lookup ISP1 2000: from all fwmark 0x7d0 lookup ISP2 3011: from all fwmark 0xbc3 lookup ISP3 32762: from xxx.xxx.xxx.62 lookup ISP1 32763: from yyy.yyy.yyy.239 lookup ISP2 32764: from zzz.zzz.zzz.10 lookup ISP3 32766: from all lookup main 32767: from all lookup default 

main_squid squid.conf http_port 192.168.210.1:3128透明

 cache_peer 192.168.220.2 sibling 3128 3130 dead_peer_timeout 5 seconds acl AMAZON dstdom_regex -i (.*)s3\.amazonaws\.com cache_peer_access 192.168.220.2 allow AMAZON acl RACKSPACE dstdom_regex -i (.*)rackcdn\.com cache_peer_access 192.168.220.2 allow RACKSPACE url_rewrite_program /usr/bin/squidguard url_rewrite_children 32 cache_dir null /tmp cache_store_log none cache deny all acl local_net src 192.168.0.0/16 http_access allow local_net parent_squid squid.conf http_port 192.168.220.2:3128 acl main_squid src 192.168.220.1 http_access allow main_squid http_access allow manager localhost http_access allow manager main_squid icp_access allow main_squid cache_mem 30 GB maximum_object_size_in_memory 128 MB cache_dir aufs /squid 400000 16 256 minimum_object_size 16384 KB maximum_object_size 1024 MB cache_swap_low 93 cache_swap_high 98 acl PSD urlpath_regex -i \.psd$ cache allow PSD acl ZIP urlpath_regex -i \.zip$ cache allow ZIP acl OTHER url_regex -i ^http://* cache deny OTHER refresh_pattern \.psd$ 2592000 100 2592000 override-lastmod override-expire ignore-reload ignore-no-cache refresh_pattern \.zip$ 2592000 100 2592000 override-lastmod override-expire ignore-reload ignore-no-cache 

一切工作正常，直到我取消main_squid以下行注释

 tcp_outgoing_address yyy.yyy.yyy.239 

当我尝试从亚马逊下载任何zip文件时，我在cache.log中看到以下消息

 2013/04/22 01:00:41| TCP connection to 192.168.220.2/3128 failed 

如果我在yyy.yyy.yyy.239上运行tcpdump，我看到main_squid试图通过外部接口连接到父节点，但没有成功。

所以我的问题。 即使configuration了tcp_outgoing_address选项，我如何configurationmain_squid它可以连接到父级？

PS

 # squid -v Squid Cache: Version 2.6.STABLE21 configure options: '--host=x86_64-unknown-linux-gnu' '--build=x86_64-unknown-linux-gnu' '--program-prefix=' '--prefix=/usr' '--exec-prefix=/usr' '--bindir=/usr/bin' '--sbindir=/usr/sbin' '--sysconfdir=/etc' '--includedir=/usr/include' '--libdir=/usr/lib64' '--libexecdir=/usr/libexec' '--sharedstatedir=/var/lib' '--mandir=/usr/share/man' '--infodir=/usr/share/info' '--exec_prefix=/usr' '--bindir=/usr/sbin' '--libexecdir=/usr/lib64/squid' '--localstatedir=/var' '--datadir=/usr/share' '--sysconfdir=/etc/squid' '--enable-arp-acl' '--enable-epoll' '--enable-snmp' '--enable-removal-policies=heap,lru' '--enable-storeio=aufs,coss,diskd,null,ufs' '--enable-ssl' '--with-openssl=/usr/kerberos' '--enable-delay-pools' '--enable-linux-netfilter' '--with-pthreads' '--enable-ntlm-auth-helpers=SMB,fakeauth' '--enable-external-acl-helpers=ip_user,ldap_group,unix_group,wbinfo_group' '--enable-auth=basic,digest,ntlm,negotiate' '--enable-negotiate-auth-helpers=squid_kerb_auth' '--enable-digest-auth-helpers=password' '--with-winbind-auth-challenge' '--enable-useragent-log' '--enable-referer-log' '--disable-dependency-tracking' '--enable-cachemgr-hostname=localhost' '--enable-underscores' '--enable-basic-auth-helpers=LDAP,MSNT,NCSA,PAM,SMB,YP,getpwnam,multi-domain-NTLM,SASL' '--enable-cache-digests' '--enable-ident-lookups' '--enable-follow-x-forwarded-for' '--enable-wccpv2' '--enable-fd-config' '--with-maxfd=16384' 'build_alias=x86_64-unknown-linux-gnu' 'host_alias=x86_64-unknown-linux-gnu' 'CFLAGS=-D_FORTIFY_SOURCE=2 -fPIE -Os -g -pipe -fsigned-char' 'LDFLAGS=-pie' 

任何帮助将不胜感激

 acl parent_squid dst 192.168.220.2/32 tcp_outgoing_address 192.168.220.1 parent_squid tcp_outgoing_address yyy.yyy.yyy.239 !parent_squid 

 iptables -t nat -A PREROUTING -d 192.168.220.2/32 -j SNAT --to 192.168.220.1 

 acl local_net src 192.168.0.0/16 acl parent_peer peername PARENT_PEER acl parent_squid dst 192.168.220.2 acl FILE_TO_CACHE urlpath_regex \.(zip|iso|rar)$ acl STORAGE dstdomain storage.example.net http_port 192.168.220.1:3128 intercept icp_port 3130 cache_peer 192.168.220.2 parent 3128 3130 name=PARENT_PEER connect-timeout=7 proxy-only cache_peer_access PARENT_PEER allow STORAGE FILE_TO_CACHE # to connect to parent via internal interface tcp_outgoing_address 192.168.220.1 parent_peer # to properly get cache digest from parent tcp_outgoing_address 192.168.220.1 parent_squid # sent all other packets via ISP2 tcp_outgoing_address yyy.yyy.yyy.239 local_net 

 acl main_squid src 192.168.220.1 acl FILE_TO_CACHE urlpath_regex -i \.(zip|iso|rar)$ cache allow FILE_TO_CACHE cache deny all http_access allow main_squid http_access allow localhost http_access deny all icp_port 3130 icp_access allow main_squid icp_access deny all http_port 192.168.220.2:3128 cache_mem 12 GB maximum_object_size_in_memory 64 MB minimum_object_size 16384 KB maximum_object_size 1024 MB cache_swap_low 93 cache_swap_high 98 refresh_pattern \.iso$ 129600 100 129600 override-lastmod override-expire ignore-reload refresh_pattern \.zip$ 129600 100 129600 override-lastmod override-expire ignore-reload refresh_pattern \.rar$ 129600 100 129600 override-lastmod override-expire ignore-reload cache_effective_user squid cache_effective_group squid