proxy

Proxy server configuration

Overview

Squid, Nginx proxy, forward/reverse proxy configuration skills.

Squid forward proxy

Installation and management

# 安装
apt install squid                     # Debian/Ubuntu
yum install squid                     # CentOS/RHEL

# 服务管理
systemctl start squid
systemctl enable squid
systemctl reload squid

Check configuration

squid -k parse squid -k check

### 基础配置
```bash
# /etc/squid/squid.conf
# 端口配置
http_port 3128

# ACL 定义
acl localnet src 10.0.0.0/8
acl localnet src 172.16.0.0/12
acl localnet src 192.168.0.0/16

acl SSL_ports port 443
acl Safe_ports port 80 21 443 70 210 280 488 591 777 1025-65535

# 访问控制
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localnet
http_access deny all

# 缓存配置
cache_dir ufs /var/spool/squid 100 16 256
maximum_object_size 100 MB
cache_mem 256 MB

# 日志
access_log /var/log/squid/access.log squid
cache_log /var/log/squid/cache.log

Authentication configuration

# 基础认证
auth_param basic program /usr/lib/squid/basic_ncsa_auth /etc/squid/passwd
auth_param basic children 5
auth_param basic realm Squid Proxy
auth_param basic credentialsttl 2 hours

acl authenticated proxy_auth REQUIRED
http_access allow authenticated

# 创建用户
htpasswd -c /etc/squid/passwd user1
htpasswd /etc/squid/passwd user2

Transparent proxy

# Squid 配置
http_port 3128 transparent

# iptables 重定向
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 3128
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j REDIRECT --to-port 3128

Access control

# 时间控制
acl work_hours time MTWHF 09:00-18:00
http_access allow localnet work_hours

# 域名黑名单
acl blocked_sites dstdomain .facebook.com .youtube.com
http_access deny blocked_sites

# URL 正则
acl blocked_urls url_regex -i porn adult gambling
http_access deny blocked_urls

# 带宽限制
delay_pools 1
delay_class 1 2
delay_parameters 1 1000000/1000000 100000/100000
delay_access 1 allow localnet

Nginx reverse proxy

Basic reverse proxy

server {
    listen 80;
    server_name example.com;
    
    location / {
        proxy_pass http://backend:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

HTTPS reverse proxy

server {
    listen 443 ssl http2;
    server_name example.com;
    
    ssl_certificate /etc/nginx/ssl/cert.pem;
    ssl_certificate_key /etc/nginx/ssl/key.pem;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
    
    location / {
        proxy_pass http://backend:8080;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
    }
}

WebSocket proxy

location /ws {
    proxy_pass http://websocket_backend;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
    proxy_set_header Host $host;
    proxy_read_timeout 86400;
}

Cache configuration

proxy_cache_path /var/cache/nginx levels=1:2 keys_zone=my_cache:10m max_size=1g inactive=60m;

server {
    location / {
        proxy_pass http://backend;
        proxy_cache my_cache;
        proxy_cache_valid 200 302 10m;
        proxy_cache_valid 404 1m;
        proxy_cache_use_stale error timeout updating;
        add_header X-Cache-Status $upstream_cache_status;
    }
}

Nginx forward proxy

HTTP forward proxy

server {
    listen 8080;
    resolver 8.8.8.8;
    
    location / {
        proxy_pass http://$http_host$request_uri;
        proxy_set_header Host $http_host;
        proxy_buffers 256 4k;
        proxy_max_temp_file_size 0;
        proxy_connect_timeout 30;
    }
}

HTTPS forward proxy (ngx_http_proxy_connect_module)

server {
    listen 8080;
    resolver 8.8.8.8;
    
    proxy_connect;
    proxy_connect_allow 443 563;
    proxy_connect_connect_timeout 10s;
    proxy_connect_read_timeout 10s;
    proxy_connect_send_timeout 10s;
    
    location / {
        proxy_pass http://$host;
        proxy_set_header Host $host;
    }
}

HAProxy proxy

TCP proxy

frontend tcp_front
    bind *:3306
    mode tcp
    default_backend mysql_back

backend mysql_back
    mode tcp
    balance roundrobin
    server mysql1 192.168.1.10:3306 check
    server mysql2 192.168.1.11:3306 check

HTTP proxy

frontend http_front
    bind *:80
    mode http
    default_backend web_back

backend web_back
    mode http
    balance roundrobin
    option httpchk GET /health
    server web1 192.168.1.10:8080 check
    server web2 192.168.1.11:8080 check

SOCKS proxy

SSH SOCKS proxy

# 创建 SOCKS5 代理
ssh -D 1080 -f -C -q -N user@remote_server

# 后台运行
ssh -D 1080 -fNq user@remote_server

# 指定绑定地址
ssh -D 0.0.0.0:1080 -fNq user@remote_server

Dante SOCKS server

# 安装
apt install dante-server

# /etc/danted.conf
logoutput: syslog
internal: eth0 port = 1080
external: eth0

socksmethod: username
user.privileged: root
user.unprivileged: nobody

client pass {
    from: 192.168.0.0/16 to: 0.0.0.0/0
    log: connect disconnect error
}

socks pass {
    from: 192.168.0.0/16 to: 0.0.0.0/0
    log: connect disconnect error
}

Common scenarios

Scenario 1: Enterprise internet access proxy

# Squid 配置
http_port 3128
acl company_network src 10.0.0.0/8
acl blocked dstdomain "/etc/squid/blocked_sites.txt"
acl work_hours time MTWHF 09:00-18:00

http_access deny blocked
http_access allow company_network work_hours
http_access deny all

# 日志分析
cat /var/log/squid/access.log | awk '{print $7}' | sort | uniq -c | sort -rn | head -20

Scenario 2: API gateway

upstream api_v1 {
    server 192.168.1.10:8080;
    server 192.168.1.11:8080;
}

upstream api_v2 {
    server 192.168.1.20:8080;
    server 192.168.1.21:8080;
}

server {
    listen 80;
    
    location /api/v1 {
        proxy_pass http://api_v1;
        proxy_set_header X-API-Version "v1";
    }
    
    location /api/v2 {
        proxy_pass http://api_v2;
        proxy_set_header X-API-Version "v2";
    }
}

Scenario 3: Cross-origin proxy

server {
    listen 80;
    
    location /api/ {
        proxy_pass http://api.external.com/;
        
        # CORS 头
        add_header Access-Control-Allow-Origin *;
        add_header Access-Control-Allow-Methods "GET, POST, OPTIONS";
        add_header Access-Control-Allow-Headers "Authorization, Content-Type";
        
        if ($request_method = OPTIONS) {
            return 204;
        }
    }
}

Scenario 4: Proxy chain

# 使用 proxychains
# /etc/proxychains.conf
strict_chain
proxy_dns
[ProxyList]
socks5 127.0.0.1 1080
http 192.168.1.100 8080

# 使用
proxychains curl http://example.com

Troubleshooting

Issue	Troubleshooting method
Connection timeout	Check backend service, timeout configuration
502 error	Check backend health, proxy configuration
Cache not working	Check cache headers, cache configuration
Authentication failure	Check authentication configuration, username and password

# Squid 调试
squid -k parse
tail -f /var/log/squid/access.log
tail -f /var/log/squid/cache.log

# Nginx 调试
nginx -t
tail -f /var/log/nginx/error.log

# 测试代理
curl -x http://proxy:3128 http://example.com
curl -x socks5://127.0.0.1:1080 http://example.com

# 查看代理连接
ss -tnp | grep squid
netstat -tnp | grep nginx