背景：
使用squid代理配置二级squid代理（父代理）模式，访问外部网络服务器获取数据
网络构架：
根据客户需求及云服务商构架环境的因素，部署结构如下图所示：
环境需求：
服务器数量： 4台
系统：centos 6.7
软件：squid-3.0
网络： A、B两台服务器能访问外部网络，C1与C2不允许访问外网，只能访问A、B
防火墙：均开启允许8080端口访问
部署：
1、A B C1 C2均部署squid-3.0服务，部署方式如下：
1、安装编译环境
yum -y install gcc make patch gcc-c++ gcc-g77 flex bison autoconf automake openssl*
2、下载squid-3.0 软件
cd /usr/local/src/ wget http://www.squid-cache.org/Versions/v3/3.0/squid-3.0.STABLE18.tar.gz
3、解压并安装
tar zxvf squid-3.0.STABLE18.tar.gz cd squid-3.0.STABLE18 ./configure --prefix=/usr/local/squid-3.0 --enable-auth=basic --enable-basic-auth-helpers=NCSA --sysconfdir=/usr/local/squid-3.0/etc --bindir=/usr/local/squid-3.0/bin --sbindir=/usr/local/squid-3.0/sbin --mandir=/usr/local/squid-3.0/share/man --enable-gnuregex --enable-carp --enable-async-io=8080 --enable-removal-policies=heap,lru --enable-icmp --enable-delay-pools --enable-useragent-log --enable-referer-log --enable-kill-parent-hack --enable-snmp --enable-arp-acl --enable-htcp --enable-cache-digests --enable-default-err-language=Simplify_Chinese --enable-err-languages="Simplify_Chinese" --enable-poll --enable-linux-netfilter --disable-ident-lookups --enable-underscores --enable-auth="basic" --enable-basic-auth-helpers="NCSA" --enable-external-acl-helpers="ip_user" --enable-x-accelerator-vary --enable-ssl
#如果需要支持访问https，则编译时候需要添加 --enable-ssl
#还需要执行这个 yum -y install openssl* 否则会报错
#structs.h:1161: 错误：ISO C++ 不允许声明无类型的‘SSL_SESSION’
#重新解压，编译执行安装
cd /home/lvnian/tools rm -rf squid-3.0.STABLE20 tar xf squid-3.0.STABLE20.tar.gz make make install useradd squid -s /sbin/nologin mkdir -p /var/spool/squid mkdir -p /var/log/squid chown nobody:nobody -R /var/log/squid/ chown nobody:nobody -R /var/spool/squid/ touch /usr/local/squid-3.0/var/logs/cache.log touch /usr/local/squid-3.0/var/logs/store.log chown nobody:nobody -R /usr/local/squid-3.0/var/logs mkdir -p /vdb/squid/logs mkdir -p /vdb/squid/spool/squid touch /vdb/squid/logs/squidaccess.log touch /vdb/squid/logs/cache.log touch /vdb/squid/logs/store.log chown nobody:nobody -R /vdb/squid
4、备份默认配置
cd /usr/local/squid-3.0/etc/ cp squid.conf squid.conf-default > squid.conf
5、配置修改
5.1、A与B squid.conf 配置
cat >> squid.conf <<eof
acl download urlpath_regex -i \.mp3 \.avi \.rmvb \.rm \.ra \.ram \.mpe \.smi \.rar
acl protos proto HTTP FTP
acl methods method GET POST PUT HEAD
acl IMpports port 80
acl IMpports port 443
acl IMpports port 8080
acl CONNECT method CONNECT
http_access allow IMpports
http_access allow protos
http_access allow methods
http_access allow CONNECT IMpports
http_access deny CONNECT !IMpports
http_access allow all
http_port 8080
hierarchy_stoplist cgi-bin ?
logformat combined %>a %ui %un [%tl] "%rm %ru HTTP/%rv" %Hs %<st "%{Referer}>h" "%{User-Agent}>h" %Ss:%Sh
access_log /vdb/squid/logs/squidaccess.log combined
cache_log /vdb/squid/logs/cache.log
cache_store_log /vdb/squid/logs/store.log
refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern . 0 20% 4320
coredump_dir /vdb/squid/spool/squid
pid_filename /var/run/squid.pid
cache_dir ufs /vdb/squid/spool/squid 256 8 16
cache_mem 256 MB
visible_hostname Test_squidproxy
eof5.2、C1与C2 squid.conf配置
cat >> squid.conf <<eof
#cache_peer 120.24.x.x parent 8080 0 login=用户名:密码 default #父代理是认证模式
cache_peer A-IP parent 8080 0 proxy-only no-query defaule #父代理是无认证访问模式,default设置默认使用代理
cache_peer B-IP parent 8080 0 proxy-only no-query #均衡分布连接
never_direct allow all #可以使用cache_peer指令添加Squid将要求内容的父代理。此外，您可以分别使用always_direct或never_direct控制是直接还是间接获取内容
acl protos proto HTTP FTP
acl methods method GET POST PUT HEAD
acl IMpports port 80
acl IMpports port 443
acl IMpports port 8080
acl CONNECT method CONNECT
http_access allow IMpports
http_access allow protos
http_access allow methods
http_access allow CONNECT IMpports
http_access deny CONNECT !IMpports
http_access allow all
http_port 8080
hierarchy_stoplist cgi-bin ?
logformat combined %>a %1tr %ui %un [%tl] "%rm %ru HTTP/%rv" %Hs %<st "%{Referer}>h" "%{User-Agent}>h" %Ss:%Sh
access_log /var/log/squid/access.log combined
refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern . 0 20% 4320
coredump_dir /var/spool/squid
pid_filename /var/run/squid.pid
cache_dir ufs /var/spool/squid 256 8 16
cache_mem 64 MB
visible_hostname longtianlu_test_squidproxy
eof
6、启动方式：
6.1 A 与B服务启动方式
./squid -z #初始化缓存目录 ./squid -N -d1 #显示启动过程，观察是否有报错信息 /usr/local/squid-3.0/sbin/squid -s #后台启动 #加入开机自启动 echo "/usr/local/squid-3.0/sbin/squid -s " >>/etc/rc.local
6.2 C1与C2服务启动方式
./squid -z #初始化缓存目录 ./squid -N -d1 #显示启动过程，观察是否有报错信息 /usr/local/squid-3.0/sbin/squid -s -D #后台启动并不检测DNS，不加-D启动则会报错 #加入开机自启动 echo "/usr/local/squid-3.0/sbin/squid -s -D" >>/etc/rc.local
7、测试验证环境通过IPTABLES 将禁止C1\C2访问外部网络，仅允许访问A与B
:INPUT ACCEPT [0:0] :OUTPUT ACCEPT [0:0] -A INPUT -p tcp --dport 53 -A OUTPUT -p tcp --sport 53 -A INPUT -p udp --dport 53 -A OUTPUT -p udp --sport 53 -A OUTPUT -d 127.0.0.1 -j ACCEPT -A OUTPUT -d 172.0.0.0/8 -j ACCEPT -A OUTPUT -d A-IP -j ACCEPT -A OUTPUT -d B-IP -j ACCEPT -A OUTPUT -j DROP
8、系统参数修改
net.core.somaxconn = 262144 net.ipv4.tcp_max_orphans = 3276800 net.ipv4.tcp_max_syn_backlog = 262144 net.ipv4.tcp_timestamps = 0 net.ipv4.tcp_synack_retries = 1 net.ipv4.tcp_syn_retries = 1 net.ipv4.tcp_tw_recycle = 1 net.ipv4.tcp_tw_reuse = 1 net.ipv4.tcp_mem = 94500000 915000000 927000000 net.ipv4.tcp_fin_timeout = 1 net.ipv4.tcp_keepalive_time = 15 net.ipv4.ip_local_port_range = 1024 65535
9、检测验证
1、通过netstat -nuplt查看8080端口是否启动 2、ps -ef |grep squid 进程是否正常 3、通过终端或者浏览器配置http代理 C1 or C2 端口8080 测试是否能访问外部网络
