一、Squid
1.1 Web代理的工作机制
- 缓存页面对象,减少重复请求
1.2 代理的基本类型
- 传统代理:适用于Internet,需明确指定服务器
- 透明代理:客户机不需指定代理服务器的地址和端口,而是通过默认路由、防火墙策略将Web访问重定向给代理服务器处理
1.3 使用代理的好处
- 提高Web访问速度
- 隐藏客户机的真实IP地址
实验
二、传统模式
20.0.0.21(squid服务器)
为了缓存页面对象,快速提供给后面的终端
设置缓存空间
[root@squid opt]# tar zxvf squid-3.4.6.tar.gz
[root@squid opt]# cd squid-3.4.6/
[root@squid squid-3.4.6]# yum -y install gcc gcc-c++ make
[root@squid squid-3.4.6]# ./configure --prefix=/usr/local/squid \ ###安装路径
> --sysconfdir=/etc \ ###配置文件所在目录
> --enable-arp-acl \ ###启动acl访问控制列表的功能
> --enable-linux-netfilter \ ###内核过滤
> --enable-linux-tproxy \ ###支持透明模式
> --enable-async-io=100 \ ###io优化
> --enable-err-language="Simplify_Chinese" \ ###报错提示支持中文
> --enable-underscore \ ###在url中支持下划线
> --enable-poll \ ###poll是一个功能,功能提升
> --enable-gnuregex ###支持正则表达式
[root@squid squid-3.4.6]# make -j3
[root@squid squid-3.4.6]# make install
[root@squid squid-3.4.6]# ln -s /usr/local/squid/sbin/* /usr/local/sbin/ ###让系统能识别
[root@squid squid-3.4.6]# useradd -M -s /sbin/nologin squid
[root@squid squid-3.4.6]# chown -R squid.squid /usr/local/squid/var/
[root@squid squid-3.4.6]# vim /etc/squid.conf ###修改主配置文件,分配缓存空间
'注释拒绝,添加允许'
http_access allow all
#http_access deny all
'在端口号下添加'
http_port 3128
cache_effective_user squid ###缓存管理的用户
cache_effective_group squid ###缓存管理的组
[root@squid squid-3.4.6]# squid -k parse ###检查语法有无问题
[root@squid squid-3.4.6]# squid -z ###初始化缓存
[root@squid squid-3.4.6]# 2020/10/30 11:47:30 kid1| Set Current Directory to /usr/local/squid/var/cache/squid
2020/10/30 11:47:30 kid1| Creating missing swap directories
2020/10/30 11:47:30 kid1| No cache_dir stores are configured.
[root@squid squid-3.4.6]# squid
[root@squid squid-3.4.6]# netstat -anpt | grep 3128
tcp6 0 0 :::3128 :::* LISTEN 39629/(squid-1)
[root@squid squid-3.4.6]# cd /etc/init.d/
[root@squid init.d]# vim squid
#! /bin/bash
#chkconfig: 2345 90 25
PID="/usr/local/squid/var/run/squid.pid"
CONF="/etc/squid.conf"
CMD="/usr/local/squid/sbin/squid"
case "$1" in
start)
netstat -anpt | grep squid &> /dev/null
if [ $? -eq 0 ]
then
echo "squid is running"
else
echo "正在启动 squid..."
$CMD
fi
;;
stop)
$CMD -k kill &> /dev/null
rm -rf $PID &> /dev/null
;;
status)
[ -f $PID ] &> /dev/null
if [ $? -eq 0 ]
then
netstat -anpt | grep squid
else
echo "squid is not running"
fi
;;
restart)
$0 stop &> /dev/null
echo "正在关闭 squid..."
$0 start &> /dev/null
echo "正在启动 squid..."
;;
reload)
$CMD -k reconfigure
;;
check)
$CMD -k parse
;;
*)
echo "用法:$0{start|stop|status|reload|check|restart}"
;;
esac
[root@squid init.d]# chmod +x squid
[root@squid init.d]# ls
functions netconsole network README squid
[root@squid init.d]# chkconfig --add squid ###让service列表中添加这个名称
[root@squid init.d]# chkconfig --level 35 squid on ###在init3 和init5 模式开机自启动,可以不敲
[root@squid init.d]# service squid stop
[root@squid init.d]# netstat -anpt | grep 3128
[root@squid init.d]# service squid start
正在启动 squid...
[root@squid init.d]# netstat -anpt | grep 3128
tcp6 0 0 :::3128 :::* LISTEN 39965/(squid-1)
[root@squid init.d]# vim /etc/squid.conf
http_port 3128
cache_effective_user squid
cache_effective_group squid
‘在这下面添加以下信息’
cache_mem 64 MB ###指定缓存功能所使用的的内存空间大小,便于保持访问表频繁的WEB对象,容量最好为4的倍数,单位MB
reply_body_max_size 10 MB ###允许用户下载的最大文件大小,以字节为单位。默认设置0表示不进行限制
maximum_object_size 4096 KB ###允许保存到缓存空间的最大对象大小,以KB为单位,超过大小限制的文件将不被缓存,而是直接转到用户端
[root@squid init.d]# iptables -L
[root@squid init.d]# iptables -F
[root@squid init.d]# iptables -t nat -L
[root@squid init.d]# iptables -t nat -F
[root@squid init.d]# iptables -I INPUT -p tcp --dport 3128 -j ACCEPT
[root@squid init.d]# service squid reload
[root@squid init.d]# netstat -anpt | grep 3128
tcp6 0 0 :::3128 :::* LISTEN 2418/(squid-1)
192.168.100.10(web服务器)
提供一个web页面
[root@web ~]# iptables -F
[root@web ~]# yum -y install httpd
[root@web ~]# systemctl start httpd
[root@web ~]# systemctl enable httpd
真机浏览器输入:20.0.0.22
[root@web ~]# cd /var/log/httpd/
[root@web httpd]# ll
总用量 8
-rw-r--r-- 1 root root 2651 10月 30 14:52 access_log
-rw-r--r-- 1 root root 925 10月 30 14:52 error_log
[root@web httpd]# cat access_log
20.0.0.1 - - [30/Oct/2020:14:52:37 +0800] "GET / HTTP/1.1" 403 4897 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.111 Safari/537.36"
20.0.0.1 - - [30/Oct/2020:14:52:37 +0800] "GET /noindex/css/open-sans.css HTTP/1.1" 200 5081 "http://20.0.0.22/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.111 Safari/537.36"
浏览器清空缓存,打开设置,选择高级,系统,打开代理,开启,并添加代理服务器的IP和端口
[root@web httpd]# cat access_log
20.0.0.21 - - [30/Oct/2020:15:00:10 +0800] "GET /noindex/css/fonts/Bold/OpenSans-Bold.ttf HTTP/1.1" 404 238 "http://20.0.0.22/noindex/css/open-sans.css" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.111 Safari/537.36"
20.0.0.21 - - [30/Oct/2020:15:00:10 +0800] "GET /favicon.ico HTTP/1.1" 404 209 "http://20.0.0.22/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.111 Safari/537.36"
三、透明模式
20.0.0.21
[root@squid init.d]# cd /etc/sysconfig/network-scripts/
[root@squid network-scripts]# cp ifcfg-ens33 ifcfg-ens36
[root@squid network-scripts]# vim ifcfg-ens36
IPADDR=192.168.100.1
[root@squid network-scripts]# systemctl restart network
[root@squid network-scripts]# ifconfig
'Squid主机添加双网卡(额外添加一个vmare1的网卡)'
[root@squid network-scripts]# vim /etc/sysctl.conf
net.ipv4.ip_forward = 1
[root@squid network-scripts]# sysctl -p
net.ipv4.ip_forward = 1
[root@squid network-scripts]# vim /etc/squid.conf
http_port 192.168.100.1:3128 transparent ###透明模式
[root@squid network-scripts]# service squid stop
[root@squid network-scripts]# service squid start
[root@squid network-scripts]# iptables -t nat -I PREROUTING -i ens36 -s 192.168.100.0/24 -p tcp --dport 80 -j REDIRECT --to 3128
[root@squid network-scripts]# iptables -t nat -I PREROUTING -i ens36 -s 192.168.100.0/24 -p tcp --dport 443 -j REDIRECT --to 3128
[root@squid network-scripts]# iptables -I INPUT -p tcp --dport 3128 -j ACCEPT
20.0.0.22
[root@web httpd]# ping 20.0.0.21
[root@web httpd]# ping 192.168.100.1
[root@web httpd]# route add -net 192.168.100.0/24 gw 20.0.0.21
20.0.0.22
[root@web httpd]# cat access_log
20.0.0.21 - - [30/Oct/2020:17:09:46 +0800] "GET /noindex/css/fonts/Bold/OpenSans-Bold.ttf HTTP/1.1" 404 238 "http://20.0.0.22/noindex/css/open-sans.css" "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0"
20.0.0.21 - - [30/Oct/2020:17:09:46 +0800] "GET /noindex/css/fonts/Light/OpenSans-Light.ttf HTTP/1.1" 404 240 "http://20.0.0.22/noindex/css/open-sans.css" "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0"