一、web代理的工作机制
两台服务器
传统模式中，客户端知道自己是一个代理
透明模式中，不需要对客户端进行设置
二、代理的基本类型
- 传统代理：适用于internet，需明确指明服务端
- 透明代理：客户机不需要指定代理服务器的地址和端口，而是通过默认路由、防火墙策略将web访问重定向给代理服务器处理
三、使用代理的好处
- 提高web’访问速度
- 隐藏客户机的真实IP地址
四、实操演示传统代理
web端IP：192.168.247.160
squid端IP：192.168.247.206
win10客户端IP：192.168.247.200
1.修改主机名，便于识别
[[email protected] ~]# hostnamectl set-hostname squid
[[email protected] ~]# su
[[email protected] ~]#
[[email protected] ~]# hostnamectl set-hostname web
[[email protected] ~]# su
[[email protected] ~]#squid为了缓存页面对象，需要设置缓存空间，后面会设置
2.编译安装squid
首先解压squid，安装编译工具
[[email protected] ~]# mkdir /abc
mkdir: cannot create directory ‘/abc’: File exists
[[email protected] ~]# mount.cifs //192.168.254.10/linuxs /abc
Password for [email protected]//192.168.254.10/linuxs:
[[email protected] ~]# cd /abc
[[email protected] abc]# tar zxvf squid-3.4.6.tar.gz -C /opt
[[email protected] abc]# cd /opt
[[email protected] opt]# ls
mysql-5.7.17 rh squid-3.4.6
[[email protected] opt]# cd squid-3.4.6/
[[email protected] squid-3.4.6]# ls
acinclude configure CREDITS INSTALL QUICKSTART src
aclocal.m4 configure.ac doc lib README test-suite
bootstrap.sh contrib errors libltdl RELEASENOTES.html tools
cfgaux CONTRIBUTORS helpers Makefile.am scripts
ChangeLog COPYING icons Makefile.in snmplib
compat COPYRIGHT include po4a.conf SPONSORS
[[email protected] squid-3.4.6]# yum install gcc gcc-c++ make pcre* perl* -yconfigure 配置，make安装
acl 防控制列表，可在acl中设置通过mac地址进行管理，防止IP七篇
- netfilter 内核过滤
- tproxy 支持透明模式
- io 对于io的优化，异步I/O，提升存储性能
- err-language 报错信息设置为中文
- underscore 允许url中支持下划线
- poll 提升功能性，使用poll（）模式
- gnuregex 支持正则表达式gnu
[[email protected] squid-3.4.6]# ./configure --prefix=/usr/local/squid --sysconfdir=/etc --enable-arp-acl --enable-linux-netfilter --enable-linux-tproxy --enable-async-io=100 --enable-err-language="Simplify_Chinese" --enable-underscore --enable-poll --enable-gnuregex [[email protected] squid-3.4.6]# make && make install [[email protected] squid-3.4.6]# ln -s /usr/local/squid/sbin/* /usr/local/sbin/ //优化命令路径 [[email protected] squid-3.4.6]# useradd -M -s /sbin/nologin squid //创建squid程序用户 [[email protected] squid-3.4.6]# chown -R squid.squid /usr/local/squid/var/ //给程序用户squid的程序目录的权限 [[email protected] squid-3.4.6]# vim /etc/squid.conf //编辑配置文件 55 # And finally deny all other access to this proxy 56 http_access allow all #允许所有，关闭拒绝所有，若是拒绝所有，需要放到配置文件的最下方，否则会自deny生效起，后面的参数都不会生效 57 #http_access deny all 58 59 # Squid normally listens to port 3128 60 http_port 3128 61 cache_effective_user squid #增加用户和组 62 cache_effective_group squid [[email protected] squid-3.4.6]# squid -k parse //验证语法 [[email protected] squid-3.4.6]# squid -z //初始化缓存，然后squid启用 [[email protected] squid-3.4.6]# squid //启动 [[email protected] squid-3.4.6]# netstat -natp | grep 3128 tcp6 0 0 :::3128 :::* LISTEN 71471/(squid-1)3.创建systemctl 启动脚本
[[email protected] squid-3.4.6]# cd /etc/init.d/ [[email protected] init.d]# vim squid #!/bin/bash #chkconfig: 2345 90 25 PID="/usr/local/squid/var/run/squid.pid" CONF="/etc/squid.conf" CMD="/usr/local/squid/sbin/squid" case "$1" in start) netstat -natp | grep squid &> /dev/null if [ $? -eq 0 ] then echo "squid is running" else echo "正在启动 squid..." $CMD fi ;; stop) $CMD -k kill &> /dev/null rm -rf $PID &> /dev/null ;; status) [ -f $PID ] &> /dev/null if [ $? -eq 0 ] then netstat -natp | grep squid else echo "squid is not running" fi ;; restart) $0 stop &> /dev/null echo "正在关闭 squid..." $0 start &> /dev/null echo "正在启动 squid..." ;; reload) $CMD -k reconfigure ;; check) $CMD -k parse ;; *) echo "用法: $0(start|stop|status|reload|check|restart)" ;; esac4.给脚本执行权限，加入到chkconfig中
[[email protected] init.d]# chmod +x squid [[email protected] init.d]# chkconfig --add squid [[email protected] init.d]# chkconfig --level 35 squid on [[email protected] init.d]# netstat -natp | grep 3128 [[email protected] init.d]# service squid start 正在启动 squid... [[email protected] init.d]# netstat -natp | grep 3128 tcp6 0 0 :::3128 :::* LISTEN 102925/(squid-1) [[email protected] init.d]# service squid stop [[email protected] init.d]# netstat -natp | grep 3128 [[email protected] init.d]# setenforce 05.设置缓存参数
[[email protected] init.d]# vim /etc/squid.conf http_port 3128 cache_effective_user squid cache_effective_group squid //增加下面三行 cache_mem 64 MB //缓存64M的内容 reply_body_max_size 10 MB //禁止下载的超过10MB的文件 maximum_object_size 4096 KB //超过4MB的文件不进行缓存增加的参数放在http_access deny all 前面才会生效
6.设置iptables规则[[email protected] init.d]# iptables -F //清空规则 [[email protected] init.d]# iptables -L //查看规则 [[email protected] init.d]# iptables -t nat -F [[email protected] init.d]# iptables -I INPUT -p tcp --dport 3128 -j ACCEPT [[email protected] init.d]# service squid reload [[email protected] init.d]# netstat -natp | grep 3128 tcp6 0 0 :::3128 :::* LISTEN 17863/(squid-1)7.配置web端和客户端
[[email protected] ~]# systemctl stop firewalld [[email protected] ~]# setenforce 0 [[email protected] ~]# yum install httpd -y [[email protected] ~]# netstat -natp | grep 80 [[email protected] ~]# systemctl start httpd [[email protected] ~]# netstat -natp | grep 80 tcp6 0 0 :::80 :::* LISTEN 128136/httpd打开一台虚拟机win10，去访问web
查看web端httpd的访问日志[[email protected] httpd]# cd /var/log/httpd/ [[email protected] httpd]# cat access_log 192.168.247.200 - - [02/Feb/2020:10:58:32 +0800] "GET /noindex/css/fonts/Semibold/OpenSans-Semibold.ttf HTTP/1.1" 404 246 "http://192.168.247.160/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.10240"开始配置代理
输入代理服务器ip和端口号，点击保存，然后关闭，关闭浏览器
重新打开浏览器，再次访问web
再次查看httpd日志
此时可以发现访问ip变成了192.168.247.206[[email protected] httpd]# cat access_log 192.168.247.206 - - [02/Feb/2020:11:10:47 +0800] "GET /noindex/css/fonts/Light/OpenSans-Light.woff HTTP/1.1"
原文地址：https://blog.51cto.com/14557905/2481920
时间： 2024-08-02 18:26:33