Linux下Squid正向/反向代理配置
應用場景： 1、正向代理 Squid被數以百計的網絡提供商用來為他們的用戶提供最好的網頁訪問，為了提升性能和常用內容來減少帶寬squid充分利用客戶端和服務端的數據流。Squid還能路由內容請求到服務器，以各種方式構建緩存服務器多層次結構，優化網絡吞吐量 2、反向代理（網站內容加速和分發）Squid是一個支持HTTP, HTTPS, FTP的web緩存代理，它能通過緩存和反復使用頻繁訪問的網頁來減少帶寬、提高響應速度。Squid被廣泛用于訪問控制和做前端加速，它能運行在大部分 操作系統平臺上，Squid能減少服務器的壓力，提高客戶端的響應速度，其高級的內容路由配置允許建立集群和負載均衡來處理各種WEB請求，3.2及之后 的版本基本都已支持SMP和多CPU
應用場景：
1、正向代理
Squid被數以百計的網絡提供商用來為他們的用戶提供最好的網頁訪問，為了提升性能和常用內容來減少帶寬squid充分利用客戶端和服務端的數據流。Squid還能路由內容請求到服務器，以各種方式構建緩存服務器多層次結構，優化網絡吞吐量
2、反向代理（網站內容加速和分發）
一、正向代理
環境：
Squid
eth0: 10.0.2.15
eth1: 192.168.1.10
Client
eth0: 192.168.1.100
1、Squid 安裝
A、yum安裝
yum install squid -y
B、編譯安裝
groupadd squid
useradd -g squid -s /sbin/nologin squid
cd ~/downloads/
wget http://www.squid-cache.org/Versions/v3/3.5/squid-3.5.4.tar.xz
tar -Jxf squid-3.5.4.tar.xz
cd squid-3.5.4
./configure \
--prefix=/usr/local/squid/ \
--localstatedir=/var \ #緩存目錄
--mandir=/usr/share/man \
--enable-async-io=200 \ #async模式來運行squid，線程數
--enable-icmp \
--enable-delay-pools \ #延時池，這樣能對某些特定的請求限制額定帶寬
--enable-kill-parent-hack \ #關掉suqid的時候，連同父進程一起關掉
--enable-epoll \
--enable-snmp \ #可以讓MRTG使用SNMP協議對服務器的流量狀態進行監測
--enable-cache-digests \ #啟用緩存摘要支持
--with-large-files \
--disable-arp-acl \ #禁用對客戶端的MAC地址進行管理
--disable-ident-lookups
./configure --prefix=/usr/local/squid/ --localstatedir=/var --mandir=/usr/share/man --enable-async-io=200 --enable-icmp --enable-delay-pools --enable-kill-parent-hack --enable-epoll --enable-snmp --enable-cache-digests --with-large-files --disable-arp-acl --disable-ident-lookups
make && make install
vim /etc /init.d/squid #Squid 啟動腳本
| #!/bin/bash # Squid server script # chkconfig: 2345 86 17 # description: Squid prxoy server squid_prefix='/usr/local/squid' squid_pid='/var/run/squid.pid' start() { if [ -e $squid_pid ]; then echo "squid already start, nothing " else $squid_prefix/sbin/squid -k parse >> /dev/null 2>&1 #check config_file if [ $? -ne 0 ]; then echo "squid config_file is Error " else echo "Squid is starting..." $squid_prefix/sbin/squid -s fi fi } stop() { if [ ! -e $squid_pid ]; then echo "squid already start stop, nothing " else echo "Squid is stoping..." $squid_prefix/sbin/squid -k shutdown fi } status() { if [ -e $squid_pid ]; then echo "squid (pid `cat $squid_pid`) is running..." else echo "Squid is stop" fi } case $1 in start) start ;; stop) stop ;; restart) stop sleep 40 #shutdown_lifetime is 30(default) start ;; status) status ;; reload) echo "Squid is reloading" $squid_prefix/sbin/squid -k reconfigure ;; *) echo "Usage: $0 {start|stop|restart|status|reload}" ;; esac |
</tr>
</tbody>
</table>
| 0 3 * * * /usr/local/squid/sbin/squid -k rotate #每天3點切割一次 | </tr> </tbody> </table>
| #1、規則會依次執行，先執行的先優先生效 #2、先局部后整體，一般先局部拒絕再允許，最后定義一條拒絕策略（匹配完執行） # 訪問控制規則，更多見 http://wiki.squid-cache.org/SquidFaq/SquidAcl acl 163mail dstdomain .163.com # URL words #acl Cooking1 url_regex -i cooking acl Bad_Url url_regex -i "/usr/local/squid/etc/Bad_Url.lst" # Local network acl Mynetwork src 192.168.1.0/24 #acl Arp1 arp 01:02:03:04:05:06 acl localnet src 10.0.0.0/8 # RFC1918 possible internal network acl localnet src 172.16.0.0/12 # RFC1918 possible internal network acl localnet src 192.168.0.0/16 # RFC1918 possible internal network acl localnet src fc00::/7 # RFC 4193 local private network range acl localnet src fe80::/10 # RFC 4291 link-local (directly plugged) machine # No Cache Site acl No_cache dstdomain .2345.com # Cache delete acl Purge method PURGE # Specific User acl Admin src 192.168.1.11 acl Manage src 192.168.1.15-192.168.1.25 # Bad Client IP acl Bad_client src "/usr/local/squid/etc/Bad_client.lst" # Max Conn acl Max_conn maxconn 10 # Work time acl Work_time time MTWHF 09:00-12:00 acl Work_time time MTWHF 13:00-17:00 cache deny No_cache always_direct allow 163mail http_access allow Admin Purge http_access deny Purge http_access allow Admin http_access allow Manage http_access deny Bad_client http_access deny Bad_Url http_access deny Max_conn Mynetwork http_access allow MyNetwork Work_time http_access deny Mynetwork #http_access allow Mynetwork http_access allow localnet http_access allow localhost http_access deny all http_port 3128 dns_nameservers 114.114.114.114 8.8.8.8 # DNS服務器，優先級比 ‘/etc/resolv.conf’ 更高 #MyNetwork acl MyNetwork src 192.168.1.0/24 192.168.18.0/24 # Local_host network http_access allow MyNetwork cache_dir ufs /var/cache/squid 100 16 256 # #100M、16個子目錄、256個子子目錄，可有多個. maximum_object_size 4 MB #4MB, cache的最大文件數 cache_mem 32 MB #對象內存緩存，一般設置成服務器內存的一半或更多 half_closed_clients off #關閉半連接 cache_swap_high 95 #95,達到%100時刪除內容到swap_low值 cache_swap_low 80 #90， #maximum_object_size_in_memory 512 KB #512KB，內存cache的最大文件大小 cache_effective_user squid #運行用戶 cache_effective_group squid # log access_log /var/log/squid/access.log cache_log /var/log/squid/cache.log pid_filename /var/run/squid.pid visible_hostname Proxy.Srv01 #顯示名 cache_mgr chenxuwq@163.com #管理員mail #數據過期算法，percent為百分比，低于該值則數據不過期 #refresh_pattern [-i] regexp min percent max [option] # Add any of your own refresh_pattern entries above these. # refresh_pattern ^ftp: 1440 20% 10080 refresh_pattern ^gopher: 1440 0% 1440 refresh_pattern -i (/cgi-bin/|\?) 0 0% 0 refresh_pattern . 0 20% 4320 |
</tr>
</tbody>
</table>
| http_port 3128 intercept | </tr> </tbody> </table>
| # Controls IP packet forwarding net.ipv4.ip_forward = 1 # Controls source route verification net.ipv4.conf.default.rp_filter = 0 # Do not accept source routing net.ipv4.conf.default.accept_source_route = 0 |
</tr>
</tbody>
</table>
| options { listen-on port 53 { 192.168.18.10; 192.168.1.10; }; # listen-on port 53 { any; }; listen-on-v6 port 53 { ::1; }; directory "/var/named"; dump-file "/var/named/data/cache_dump.db"; statistics-file "/var/named/data/named_stats.txt"; memstatistics-file "/var/named/data/named_mem_stats.txt"; allow-query { 192.168.18.0/24; 192.168.1.0/24; }; # allow-query { any; }; recursion yes; dnssec-enable yes; dnssec-validation yes; dnssec-lookaside auto; rrset-order { order cyclic; }; /* Path to ISC DLV key */ bindkeys-file "/etc/named.iscdlv.key"; managed-keys-directory "/var/named/dynamic"; }; logging { channel default_debug { file "data/named.run"; severity dynamic; }; }; zone "." IN { type hint; file "named.ca"; }; include "/etc/named.rfc1912.zones"; include "/etc/named.root.key"; vim /etc/named.rfc1912.zones #DNS區域定義 zone "test.org" IN { type master; file "test.org.zone"; allow-update { none; }; }; zone "1.168.192.in-adr.arpatest" IN { type master; file "1.168.192.org.zone"; allow-update { none; }; }; |
</tr>
</tbody>
</table>
| $TTL 3H @ IN SOA ns.test.org. root.test.org. ( 1 ; serial 1D ; refresh 1H ; retry 1W ; expire 3H ) ; minimum @ IN NS ns.test.org. ns IN A 192.168.18.10 www IN A 192.168.18.10 |
</tr>
</tbody>
</table>
| $TTL 3H @ IN SOA ns.test.org. root.test.org. ( 1 ; serial 1D ; refresh 1H ; retry 1W ; expire 3H ) ; minimum @ IN NS ns.test.org. 10 IN PTR http://www.test.org. |
</tr>
</tbody>
</table>
http_port 80 accel vhost #accel設置squid為加速模式，vhost實現實現反向代理 http_port 3128 #方便squidclient管理緩存 # 設置后臺源服務器 #cache_peer hostname type[parent] [sibling] [multicast] http- port icp-port [0] [option] #no-query 不使用ICP查詢源服務器 round-robin 輪 詢 weigh=N 權重 cache_peer 192.168.1.11 parent 80 0 no-query originserver round-robin name=webServer1 cache_peer 192.168.1.15 parent 80 0 no-query originserver round-robin name=webServer2 visible_hostname Proxy.Srv01 #顯示名 |
</tr>
</tbody>
</table>