Squid代理服务器
模拟内网客户机IP192.168.1.10 代理服务器内网口IP192.168.1.254 代理服务器外网口IP202.0.0.252 外网服务器IP202.0.0.10
一 安装及运行控制squid
1 编译安装Squid
tar –zxf squid- -C /usr/src
cd /usr/src/squid-
./configure –prefix=/usr/local/squid –sysconfdir=/etc –enable-linux-netfilter –enable-async-io=240 –enable-default-err-language=Simplify_Chinese –disable-poll –enable-epoll –enable-gnuregex && make && make install
ln -s /usr/local/squid/sbin/ /usr/local/sbin/
useradd -M -s /sbin/nologin squid
chown -R squid:squid /usr/local/squid/var/
2 修改配置文件
vim /etc/squid.conf
http_port 3128
添加
cache_effective_user squid //指定squid的程序用户，用来设置初始化的账户
cache_effective_group squid
去除62行“#”号
3 squid运行控制
squid -z //初始化缓存目录
squid // 启动squid服务
拓展：添加脚本，使用chkconfig和systemctl工具进行管理
vim /etc/init.d/squid
#!/bin/bash
#chkconfig: 2345 90 25
#config: /etc/squid.conf
#pidfile: /usr/local/squid/var/run/squid.pid
#Description: Squid-Internet Object Cache
PID="/usr/local/squid/var/run/squid.pid"
CONF="/etc/squid.conf"
CMD="/usr/local/squid/sbin/squid"
case "$1" in
start)
netstat -anpt | grep squid &> /dev/null
if [ $? -eg 0 ]
then
echo "squid id runing"
else
echo "正在启动squid…"
$CMD
fi
;;
stop)
$CMD -k kill &> /dev/null
rm -rf $PID &> /dev/null
;;
status)
[ -f $PID ] &> /dev/null
if [ $? -eq 0 ]
then
netstat -anpt | grep squid
else
echo "Squid is not runing."
fi
;;
restart)
$0 stop &> /dev/null
echo "正在关闭squid…"
$0 start &> /dev/null
echo "正在启动squid…"
;;
reload)
$CMD -k reconfigure
;;
check)
$CMD -k parse
;;
)
echo "用法：$0 {start | stop | restart | reload | check | status}"
;;
esac
chmod +x /etc/init.d/squid
chkconfig –add squid //tianjiaxitongfuw
systemctl restart squid
二 构建代理服务器
1 传统代理
在浏览器中手动添加代理 IP为代理服务器192.168.1.254 端口为3128
2 透明代理
(1)配置squid支持透明代理
vim /etc/squid.conf
添加 http_port 192.168.1.254:3128 transparent
systemctl restart squid
vim /etc/sysctl.conf
添加 net.ipv4.ip_forward = 1
sysctl -p
(2)设置firewalld的重新定向策略
systemctl start firewalld
firewall-cmd –zone=external –add-interface=ens33 //内网接口
firewall-cmd –zone=internal –add-interface=ens37 //外网接口
firewall-cmd –zone=external –add-service=http
firewall-cmd –zone=external –add-service=https
firewall-cmd –zone=external –add-port=3128/tcp
firewall-cmd –direct –add-rule ipv4 nat PREROUTING 0 -i ens33 -p tcp –dport 80 -j REDIRECT –to-ports 3128
firewall-cmd –direct –add-rule ipv4 nat PREROUTING 0 -i ens33 -p tcp –dport 443 -j REDIRECT –to-ports 3128
firewall-cmd –runtime-to-permanent
验证时客户机的网关为代理服务器的内网ip，同时关闭手动代理
