【移動應(yīng)用開發(fā)技術(shù)】Squid透明代理安裝與設(shè)置

環(huán)境如下：操作系統(tǒng)：CentOS6.4eth0:（LAN口）eth2:

(WAN口)一.iptables的配置1.啟動ip_forward(IP轉(zhuǎn)發(fā))修改/etc/sysctl.conf將net.ipv4.ip_forward=1并運行sysctl-p，使之生效[root@nagios~]#

vim

/etc/sysctl.conf[root@nagios

~]#

sysctl

-p

net.ipv4.ip_forward

=

1

net.ipv4.conf.default.rp_filter

=

1

net.ipv4.conf.default.accept_source_route

=

0

kernel.sysrq

=

0

kernel.core_uses_pid

=

1

net.ipv4.tcp_syncookies

=

1

kernel.msgmnb

=

65536

kernel.msgmax

=

65536

kernel.shmmax

=

68719476736

kernel.shmall

=

42949672962.清空iptables所有表的規(guī)則并查看nat表[root@nagios

~]#

iptables

-F

[root@nagios

~]#

iptables

-t

nat

-F

[root@nagios

~]#

iptables

-t

mangle

-F

[root@nagios

~]#

iptables

-t

nat

-L

Chain

PREROUTING

(policy

ACCEPT)

target

prot

opt

source

destination

Chain

POSTROUTING

(policy

ACCEPT)

target

prot

opt

source

destination

Chain

OUTPUT

(policy

ACCEPT)

target

prot

opt

source

destination3.設(shè)置端口重定向[root@nagios

~]#

iptables

-t

nat

-A

PREROUTING

-p

tcp

--dport

80

-j

REDIRECT

--to-port

3128#在NAT表的PREROUTING鏈加目標(biāo)動作REDIRECT，將入站的數(shù)據(jù)包進(jìn)行重定向，將80端口重定向到3128端口4.設(shè)置iptables路由DNS數(shù)據(jù)[root@nagios~]#iptables

-t

nat

-A

POSTROUTING

-s

/24

-p

udp

--dport

53

-d

6

-j

SNAT

--to-source

[root@nagios~]#iptables

-t

nat

-A

POSTROUTING

-s

/24

-p

tcp

--dport

53

-d

6

-j

SNAT

--to-source

說明：可以看出上面DNS是通過服務(wù)器的NAT功能來實現(xiàn)，6是外部DNS服務(wù)器地址，而是我們WAN口的IP。如果外部DNS服務(wù)器經(jīng)常變更的話，可以直接將DNS忽略掉:iptables-tnat-APOSTROUTING-s/24-ptcp--dport53

-jSNAT--to-sourceiptables-tnat-APOSTROUTING-s/24-pudp--dport53

-jSNAT--to-source5.保存iptables設(shè)置及重啟iptables服務(wù)[root@Nagios

~]#

service

iptables

save

[root@Nagios

~]#

service

iptables

restart

iptables:

Saving

firewall

rules

to

/etc/sysconfig/iptables:[

OK

]

[root@Nagios

~]#

iptables

-t

nat

-L

Chain

PREROUTING

(policy

ACCEPT)

target

prot

opt

source

destination

REDIRECT

tcp

--

/24

anywhere

tcp

dpt:http

redir

ports

3128

Chain

POSTROUTING

(policy

ACCEPT)

target

prot

opt

source

destination

SNAT

udp

--

/24

6

udp

dpt:domain

to:

SNAT

tcp

--

/24

6

tcp

dpt:domain

to:

Chain

OUTPUT

(policy

ACCEPT)

target

prot

opt

source

destination二.Squid的安裝與配置我們使用yum來安裝Squid:[root@nagios

~]#

yum

-y

install

squid備份squid的配置文件，防止因為配置錯誤[root@nagios

~]#

cp

/etc/squid/squid.conf

/etc/squid/squid.conf_bak配置squid.conf找到http_port3128修改成http_port0:3128transparent并添加visible_hostname

squid

acl

innet

src

/24

http_access

allow

innet

http_access

deny

all下面就運行squid-z進(jìn)行初始化[root@nagios

~]#

squid

-z

2013/05/29

13:41:43|

Creating

Swap

Directories啟動squid代理服務(wù)器[root@nagios

~]#

service

squid

start重新啟動iptables服務(wù)[root@nagios

~]#

service

iptables

restart并將squid及iptables設(shè)置成開機(jī)啟動[root@nagios

~]#

chkconfig

--level

35

squid

on

[root@nagios

~]#

chkconfig

--level

35

iptables

on客戶端網(wǎng)絡(luò)設(shè)置：DNS設(shè)置為轉(zhuǎn)發(fā)的DNSIP其他設(shè)置：隱藏錯誤頁面Squid版本httpd_suppress_version_string

on不記錄訪問日志cache_store_log

none

cache_access_log

/dev/null

cache_log

/dev/null隱藏Header頭部信息(3.0以后版本)request_header_access

Via

deny

all

request_header_access

Server

deny

all

request_header_access

X-Cache

deny

all

request_header_acc