nginx实战(五) 正向代理支持https

前言

正向代理，是指内网用户设置代理服务器的IP及端口实现访问公网的访问方式（https://baike.baidu.com/item/正向代理/9524799）

nginx 自带的proxy 也可以实现正向代理功能，但是不支持https ，所以我选用了ngx_http_proxy_connect_module 模块

添加ngx_http_proxy_connect_module 模块

nginx 基础环境编译见nginx实战(一)

yum -y install patch
git clone https://github.com/chobits/ngx_http_proxy_connect_module.git
cd openresty-1.13.6.2
./configure --add-module=../ngx_http_proxy_connect_module
patch -d build/nginx-1.13.6/ -p 1 < ../ngx_http_proxy_connect_module/patch/proxy_connect_rewrite_1014.patch
gmake && gmake install

代理配置

cat>proxy_connect.conf<<EOF

log_format  proxy   '$remote_addr - $remote_user [$time_local] "$request" - $http_host '
                    'status:$status $body_bytes_sent "$http_referer" '
                    '"$http_user_agent" "$http_x_forwarded_for"';
server {
    listen       8080;
    server_name  localhost;
    #设置dns 地址
    resolver 202.96.209.133;
    resolver_timeout 30s;

    set $proxy_remote_address "";
    set $proxy_local_address "";

    proxy_connect;
    proxy_connect_connect_timeout 10s;
    proxy_connect_read_timeout 150;
    proxy_connect_send_timeout 10s;
    proxy_connect_send_lowat 0;
    proxy_connect_address $proxy_remote_address;
    proxy_connect_bind $proxy_local_address;

    access_log logs/proxy.access.log proxy;   

    location / {
        proxy_pass http://$http_host;
        proxy_set_header Host $host;
    }

    #error_page  404              /404.html;
    # redirect server error pages to the static page /50x.html
    #
    error_page   500 502 503 504  /50x.html;
    location = /50x.html {
        root   html;
    }
}
EOF

客户端代理设置

 

linux

cat >>/etc/profile<<EOF
printf -v no_proxy '%s,' 172.17.0.{1..255};  ## 生成内网所有ip
http_proxy=http://172.17.0.16:8080
https_proxy=http://172.17.0.16:8080
no_proxy="${no_proxy%,},localhost,127.0.0.1,localaddress,.localdomain.com" ## 排除本地ip
export http_proxy https_proxy no_proxy
EOF

docker 代理设置

vim /lib/systemd/system/docker.service
Environment="HTTP_PROXY=http://172.17.0.16:8080/" "HTTPS_PROXY=https://172.17.0.16:8080/"

参考

https://github.com/chobits/ngx_http_proxy_connect_module

转载于:https://blog.51cto.com/13673090/2306487