Nginx四层代理

环境准备

–	–	–
节点	ip地址	角色
nginx_proxy	192.168.44.177	代理服务器
host1	192.168.44.174	ssh
host2	192.168.44.175	ssh

注：测试代理ssh，因此后端主机未配置服务

配置nginx四层代理

安装部署nginx

四层代理需四层代理模块 --with-stream

#解压nginx
[root@nginx_proxy ~]# tar xf nginx-1.17.6.tar.gz
#进入解压目录
[root@nginx_proxy ~]# cd nginx-1.17.6/
#安装工具包
[root@nginx_proxy nginx]# yum -y install make gcc pcre-devel openssl openssl-devel
#配置四层代理模块
[root@nginx_proxy nginx]# ./configure --with-stream
#编译安装nginx
[root@nginx_proxy nginx]# make && make install

修改配置

#进入nginx安装目录
[root@nginx_proxy nginx]# cd /usr/local/nginx/
#查看nginx加载的模块
[root@nginx_proxy nginx]# sbin/nginx -V
nginx version: nginx/1.17.6
built by gcc 4.8.5 20150623 (Red Hat 4.8.5-28) (GCC)
configure arguments: --with-stream
#修改配置文件（http上方新增stream）
[root@nginx_proxy nginx]# vim conf/nginx.conf
 12 events {
 13     worker_connections  1024;
 14 }
 15
 16 stream {	#增加新业务
 17 upstream ssh_proxy {	#创建集群，名字为ssh_proxy
 18 server 192.168.44.174:22;	#集群主机使用22端口对外提供服务
 19 server 192.168.44.175:22;
 20
 21 }
 22
 23
 24 server {
 25 listen 10022;	#监听端口
 26 proxy_pass ssh_proxy;	#监听端口后调用集群ssh_proxy
 27
 28
 29 }
 30
 31 }
 32
 33 http {
 34     include       mime.types;
 35     default_type  application/octet-stream;
 36

开启服务

#检查配置文件
[root@nginx_proxy nginx]# sbin/nginx -t
nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful
#开启服务
[root@nginx_proxy nginx]# sbin/nginx
#10022端口已被监听
[root@nginx_proxy nginx]# ss -utnlp | grep nginx
tcp    LISTEN     0      128       *:10022                 *:*                   users:(("nginx",pid=4102,fd=6),("nginx",pid=4101,fd=6))
tcp    LISTEN     0      128       *:80                    *:*                   users:(("nginx",pid=4102,fd=7),("nginx",pid=4101,fd=7))

访问测试

#访问ssh 192.168.44.177 -p 10022 会被代理到host1和host2
[root@nginx_proxy nginx]# ssh 192.168.44.177 -p 10022
The authenticity of host '[192.168.44.177]:10022 ([192.168.44.177]:10022)' can't be established.
ECDSA key fingerprint is SHA256:tF+VCaKG5Qk4d0mC95llAGhlBGwe3HzmpWfT6yQ+E/A.
ECDSA key fingerprint is MD5:20:39:f3:bd:32:35:73:ea:4a:ee:ec:00:a4:77:1e:ce.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '[192.168.44.177]:10022' (ECDSA) to the list of known hosts.
root@192.168.44.177's password:
Last login: Tue Sep  6 21:24:59 2022 from 192.168.44.1
[root@host1 ~]# exit
登出
Connection to 192.168.44.177 closed.
[root@nginx_proxy nginx]# ssh 192.168.44.177 -p 10022
root@192.168.44.177's password:
Last login: Tue Sep  6 21:25:23 2022 from 192.168.44.1
[root@host2 ~]# exit
登出
Connection to 192.168.44.177 closed.