代理服务器配置
概述
Squid、Nginx 代理、正向/反向代理配置技能。
Squid 正向代理
安装与管理
安装
apt install squid # Debian/Ubuntu yum install squid # CentOS/RHEL
服务管理
systemctl start squid systemctl enable squid systemctl reload squid
检查配置
squid -k parse squid -k check
基础配置
/etc/squid/squid.conf
端口配置
http_port 3128
ACL 定义
acl localnet src 10.0.0.0/8 acl localnet src 172.16.0.0/12 acl localnet src 192.168.0.0/16
acl SSL_ports port 443 acl Safe_ports port 80 21 443 70 210 280 488 591 777 1025-65535
访问控制
http_access deny !Safe_ports http_access deny CONNECT !SSL_ports http_access allow localnet http_access deny all
缓存配置
cache_dir ufs /var/spool/squid 100 16 256 maximum_object_size 100 MB cache_mem 256 MB
日志
access_log /var/log/squid/access.log squid cache_log /var/log/squid/cache.log
认证配置
基础认证
auth_param basic program /usr/lib/squid/basic_ncsa_auth /etc/squid/passwd auth_param basic children 5 auth_param basic realm Squid Proxy auth_param basic credentialsttl 2 hours
acl authenticated proxy_auth REQUIRED http_access allow authenticated
创建用户
htpasswd -c /etc/squid/passwd user1 htpasswd /etc/squid/passwd user2
透明代理
Squid 配置
http_port 3128 transparent
iptables 重定向
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 3128 iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j REDIRECT --to-port 3128
访问控制
时间控制
acl work_hours time MTWHF 09:00-18:00 http_access allow localnet work_hours
域名黑名单
acl blocked_sites dstdomain .facebook.com .youtube.com http_access deny blocked_sites
URL 正则
acl blocked_urls url_regex -i porn adult gambling http_access deny blocked_urls
带宽限制
delay_pools 1 delay_class 1 2 delay_parameters 1 1000000/1000000 100000/100000 delay_access 1 allow localnet
Nginx 反向代理
基础反向代理
server { listen 80; server_name example.com;
location / {
proxy_pass http://backend:8080;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}
HTTPS 反向代理
server { listen 443 ssl http2; server_name example.com;
ssl_certificate /etc/nginx/ssl/cert.pem;
ssl_certificate_key /etc/nginx/ssl/key.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
location / {
proxy_pass http://backend:8080;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
}
}
WebSocket 代理
location /ws { proxy_pass http://websocket_backend; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; proxy_set_header Host $host; proxy_read_timeout 86400; }
缓存配置
proxy_cache_path /var/cache/nginx levels=1:2 keys_zone=my_cache:10m max_size=1g inactive=60m;
server { location / { proxy_pass http://backend; proxy_cache my_cache; proxy_cache_valid 200 302 10m; proxy_cache_valid 404 1m; proxy_cache_use_stale error timeout updating; add_header X-Cache-Status $upstream_cache_status; } }
Nginx 正向代理
HTTP 正向代理
server { listen 8080; resolver 8.8.8.8;
location / {
proxy_pass http://$http_host$request_uri;
proxy_set_header Host $http_host;
proxy_buffers 256 4k;
proxy_max_temp_file_size 0;
proxy_connect_timeout 30;
}
}
HTTPS 正向代理（ngx_http_proxy_connect_module）
server { listen 8080; resolver 8.8.8.8;
proxy_connect;
proxy_connect_allow 443 563;
proxy_connect_connect_timeout 10s;
proxy_connect_read_timeout 10s;
proxy_connect_send_timeout 10s;
location / {
proxy_pass http://$host;
proxy_set_header Host $host;
}
}
HAProxy 代理
TCP 代理
frontend tcp_front bind *:3306 mode tcp default_backend mysql_back
backend mysql_back mode tcp balance roundrobin server mysql1 192.168.1.10:3306 check server mysql2 192.168.1.11:3306 check
HTTP 代理
frontend http_front bind *:80 mode http default_backend web_back
backend web_back mode http balance roundrobin option httpchk GET /health server web1 192.168.1.10:8080 check server web2 192.168.1.11:8080 check
SOCKS 代理
SSH SOCKS 代理
创建 SOCKS5 代理
ssh -D 1080 -f -C -q -N user@remote_server
后台运行
ssh -D 1080 -fNq user@remote_server
指定绑定地址
ssh -D 0.0.0.0:1080 -fNq user@remote_server
Dante SOCKS 服务器
安装
apt install dante-server
/etc/danted.conf
logoutput: syslog internal: eth0 port = 1080 external: eth0
socksmethod: username user.privileged: root user.unprivileged: nobody
client pass { from: 192.168.0.0/16 to: 0.0.0.0/0 log: connect disconnect error }
socks pass { from: 192.168.0.0/16 to: 0.0.0.0/0 log: connect disconnect error }
常见场景
场景 1：企业上网代理
Squid 配置
http_port 3128 acl company_network src 10.0.0.0/8 acl blocked dstdomain "/etc/squid/blocked_sites.txt" acl work_hours time MTWHF 09:00-18:00
http_access deny blocked http_access allow company_network work_hours http_access deny all
日志分析
cat /var/log/squid/access.log | awk '{print $7}' | sort | uniq -c | sort -rn | head -20
场景 2：API 网关
upstream api_v1 { server 192.168.1.10:8080; server 192.168.1.11:8080; }
upstream api_v2 { server 192.168.1.20:8080; server 192.168.1.21:8080; }
server { listen 80;
location /api/v1 {
proxy_pass http://api_v1;
proxy_set_header X-API-Version "v1";
}
location /api/v2 {
proxy_pass http://api_v2;
proxy_set_header X-API-Version "v2";
}
}
场景 3：跨域代理
server { listen 80;
location /api/ {
proxy_pass http://api.external.com/;
# CORS 头
add_header Access-Control-Allow-Origin *;
add_header Access-Control-Allow-Methods "GET, POST, OPTIONS";
add_header Access-Control-Allow-Headers "Authorization, Content-Type";
if ($request_method = OPTIONS) {
return 204;
}
}
}
场景 4：代理链
使用 proxychains
/etc/proxychains.conf
strict_chain proxy_dns [ProxyList] socks5 127.0.0.1 1080 http 192.168.1.100 8080
使用
proxychains curl http://example.com
故障排查
问题 排查方法
连接超时 检查后端服务、超时配置
502 错误 检查后端健康、代理配置
缓存不生效 检查缓存头、缓存配置
认证失败 检查认证配置、用户密码
Squid 调试
squid -k parse tail -f /var/log/squid/access.log tail -f /var/log/squid/cache.log
Nginx 调试
nginx -t tail -f /var/log/nginx/error.log
测试代理
curl -x http://proxy:3128 http://example.com curl -x socks5://127.0.0.1:1080 http://example.com
查看代理连接
ss -tnp | grep squid netstat -tnp | grep nginx