proxy

代理服务器配置

概述

Squid、Nginx 代理、正向/反向代理配置技能。

Squid 正向代理

安装与管理

# 安装
apt install squid                     # Debian/Ubuntu
yum install squid                     # CentOS/RHEL

# 服务管理
systemctl start squid
systemctl enable squid
systemctl reload squid

# 检查配置
squid -k parse
squid -k check

基础配置

# /etc/squid/squid.conf
# 端口配置
http_port 3128

# ACL 定义
acl localnet src 10.0.0.0/8
acl localnet src 172.16.0.0/12
acl localnet src 192.168.0.0/16

acl SSL_ports port 443
acl Safe_ports port 80 21 443 70 210 280 488 591 777 1025-65535

# 访问控制
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localnet
http_access deny all

# 缓存配置
cache_dir ufs /var/spool/squid 100 16 256
maximum_object_size 100 MB
cache_mem 256 MB

# 日志
access_log /var/log/squid/access.log squid
cache_log /var/log/squid/cache.log

认证配置

# 基础认证
auth_param basic program /usr/lib/squid/basic_ncsa_auth /etc/squid/passwd
auth_param basic children 5
auth_param basic realm Squid Proxy
auth_param basic credentialsttl 2 hours

acl authenticated proxy_auth REQUIRED
http_access allow authenticated

# 创建用户
htpasswd -c /etc/squid/passwd user1
htpasswd /etc/squid/passwd user2

透明代理

# Squid 配置
http_port 3128 transparent

# iptables 重定向
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 3128
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j REDIRECT --to-port 3128

访问控制

# 时间控制
acl work_hours time MTWHF 09:00-18:00
http_access allow localnet work_hours

# 域名黑名单
acl blocked_sites dstdomain .facebook.com .youtube.com
http_access deny blocked_sites

# URL 正则
acl blocked_urls url_regex -i porn adult gambling
http_access deny blocked_urls

# 带宽限制
delay_pools 1
delay_class 1 2
delay_parameters 1 1000000/1000000 100000/100000
delay_access 1 allow localnet

Nginx 反向代理

基础反向代理

server {
    listen 80;
    server_name example.com;
    
    location / {
        proxy_pass http://backend:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}