金庸武功之“碧血剑法”----squid做透明代理-CSDN博客

一.试验目的:公司阿里云环境要求之开放一个代理服务器，其他服务器不允许有外网IP

二.环境拓扑:

A:代理服务器：（利用squid做透明代理） (centos7.2)

[root@captain squid]# ip a

eth0:10.30.204.122

eth1:116.62.XX.XX

B：客户端服务器：(centos7.2)

[root@captain squid]# ip a

eth0:10.30.204.90

三.试验环境准备(A,B都执行）

yum -y update
关闭SEliunx

[root@localhost~]# vi /etc/sysconfig/selinux

SELINUX=disabled

3.关闭防火墙

[root@localhost~]# systemctl stop firewalld

[root@localhost~]# systemctl disable firewalld

[root@localhost~]# systemctl status firewalld

4.同步系统时间

[root@localhost~]# rm -rf /etc/localtime

[root@localhost ~]# ln -s /usr/share/zoneinfo/Asia/Shanghai /etc/localtime

[root@localhost~]# yum install -y ntpdate

[root@localhost~]# /usr/sbin/ntpdate -u202.120.2.101 && hwclock -w

systemctl enable ntpdate && systemctlstart ntpdate

[root@localhost~]# crontab -e

*/5 * * * * /usr/sbin/ntpdate -u 202.120.2.101 && hwclock -w

5.修改主机名

hostnamectl --static set-hostname XXX

6.打开路由转发

vi /etc/sysctl.conf

输入net.ipv4.ip_forward=1

四.A代理服务器配置

[root@openstack ~]# yum install -y gcc openssl openssl-devel #依赖软件要先提前安装

[root@openstack ~]# yum install squid

[root@openstack ~] # cd /etc/squid

[root@openstack ~] # openssl req -new > lidongbest5.csr

Generating a 2048 bit RSA private key

..........................................................................+++

.........................................................................................................+++

writing new private key to 'privkey.pem'

Enter PEM pass phrase: #输入密码，后面会用到，比如这里输入123456

Verifying - Enter PEM pass phrase:

-----

You are about to be asked to enter information that will be incorporated

into your certificate request.

What you are about to enter is what is called a Distinguished Name or a DN.

There are quite a few fields but you can leave some blank

For some fields there will be a default value,

If you enter '.', the field will be left blank.

-----

Country Name (2 letter code) [XX]:cn #国家

State or Province Name (full name) []:beijing #省份

Locality Name (eg, city) [Default City]:beijing #地区名字

Organization Name (eg, company) [Default Company Ltd]:sjwl #公司名

Organizational Unit Name (eg, section) []:Technology #部门

Common Name (eg, your name or your server's hostname) []:sjwl #CA主机名

Email Address []:mengxl@shengjing360.com #邮箱

Please enter the following 'extra' attributes

to be sent with your certificate request

A challenge password []:123456 #证书请求密钥，CA读取证书的时候需要输入密码

An optional company name []:sjwl #-公司名称，CA读取证书的时候需要输入名称

[root@bastion-IDC squid]# openssl rsa -in privkey.pem -out lidongbest5.key

Enter pass phrase for privkey.pem: #输入上面设置的密码123456

writing RSA key

[root@bastion-IDC squid]# openssl x509 -in lidongbest5.csr -out lidongbest5.crt -req -signkey lidongbest5.key -days 3650

Signature ok

subject=/C=cn/ST=beijing/L=beijing/O=huanqiu/OU=Technology/CN=huanqiu/emailAddress=wangshibo@xqshijie.cn

Getting Private key

[root@openstack ~] # cp squid.conf squidbackup.conf

[root@openstack ~]# vi squid.conf

http_access deny all 改成 http_access allow all

# Squid normally listens to port 3128

http_port 8086 transparent

https_port 443 cert=/etc/squid/lidongbest5.crt key=/etc/squid/lidongbest5.key

dns_nameservers 8.8.8.8

cache_mem 1600 MB

cache_log /var/log/squid/cache.log

visible_hostname captain

启动squid，启动前进行测试和初始化
[root@openstack squid]# squid -k parse #测试
2016/08/09 13:35:04| Processing Configuration File: /etc/squid/squid.conf (depth 0)
2016/08/09 13:35:04| Processing: acl manager proto cache_object
..............
..............
2016/08/09 13:35:04| Processing: refresh_pattern . 0 20% 4320
2016/08/09 13:35:04| Initializing https proxy context

[root@openstack squid]# squid -z #初始化
2016/08/09 13:35:12| Creating Swap Directories

[root@openstack squid]# systemctl start squid.service

[root@openstack squid]# systemctl enable squid.service

iptables配置安装：

[root@openstack squid]# systemctl stop firewall.service

[root@openstack squid]# systemctl disable firewalld.service
[root@openstack squid]# yum install iptables-services

[root@openstack squid]# cd /etc/sysconfig/

[root@openstack squid]# vi iptables

# Generated by iptables-save v1.4.21 on Tue Mar 28 17:42:00 2017

*nat

:PREROUTING ACCEPT [0:0]

:INPUT ACCEPT [0:0]

:OUTPUT ACCEPT [0:0]

:POSTROUTING ACCEPT [0:0]

-A PREROUTING -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 8086

-A PREROUTING -p tcp -m tcp --dport 443 -j REDIRECT --to-ports 443

COMMIT

# Completed on Tue Mar 28 17:42:00 2017

# Generated by iptables-save v1.4.21 on Tue Mar 28 17:42:00 2017

*filter

:INPUT ACCEPT [42:2941]

:FORWARD ACCEPT [0:0]

:OUTPUT ACCEPT [1950:331902]

-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

-A INPUT -p icmp -j ACCEPT

-A INPUT -i lo -j ACCEPT

-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT

-A INPUT -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT

COMMIT

# Completed on Tue Mar 28 17:42:00 2017

[root@openstack squid]# systemctl restart iptables.service

五.客户端服务器配置：

客户端安装配置stunnel

　　1，安装

　　[root@openstack squid]# yum install stunnel -y #这里虽是阿里云内网，但有它内部的yum源

　　[root@openstack squid]# vi /etc/stunnel/stunnel.conf

client = yes

[https]

accept = 127.0.0.1:8088

connect = 10.30.204.122:443

如果报，FIPS_mode_set: 2D06C06E: error:2D06C06E:FIPS routines:FIPS_module_mode_set:fingerprint does not match，

stunnel.conf配置文件中加上，fips = no

2.启动stunnel并查看

[root@openstack squid]# stunnel //启动，默认配置文件路径 /etc/stunnel/stunnel.conf

[root@openstack squid]# ps -ef |grep stunnel //查看

root 15972 0.0 0.0 103256 848 pts/0 S+ 17:30 0:00 grep stunnel

　　root 21099 0.0 0.0 41532 1060 pts/0 S 15:42 0:00 stunnel

　　root 21100 0.0 0.0 41532 1060 pts/0 S 15:42 0:00 stunnel

　　root 21101 0.0 0.0 41532 1060 pts/0 S 15:42 0:00 stunnel

　　root 21102 0.0 0.0 41532 1060 pts/0 S 15:42 0:00 stunnel

　　root 21103 0.0 0.0 41532 1060 pts/0 S 15:42 0:00 stunnel

　　root 21104 0.0 0.0 2077984 6824 ? Ss 15:42 0:00 stunnel

3.配置/etc/profile系统环境变量
底部添加下面两行
[root@dev-new-test1 stunnel]# vim /etc/profile

export http_proxy=http://10.30.204.122:8086

export https_proxy=http://127.0.0.1:8088

4.测试

curl https://www.baidu.com

curl www.baidu.com

5.额外的要求：

如果需要做访问控制（比如只允许某些IP的客户端才能连接代理服务器）

试验中是只允许

http://blog.chinaunix.net/uid-25266990-id-2722465.html

参考：http://www.linuxidc.com/Linux/2017-02/140398.htm

http://www.xuexila.com/diannao/xitong/linux/648947.html

http://www.centoscn.com/CentOS/config/2016/0708/7599.html