Configuration and use of nginx forward proxy

Enterprise 2023-05-05 17:22:34 views: null

Configuration and use of nginx forward proxy

Configuration and use of nginx forward proxy

nginx forward proxy http, nginx forward proxy https

  • Forward proxy refers to a proxy service that uses a proxy server to proxy browsers/clients to redirect requests to access the target server. The characteristic of the forward proxy service is that the proxy object of the proxy server is the browser/client, that is, the browser/client is hidden from the target server.

  • nginx supports forward proxy http by default, but does not support https

  • Nginx officially does not support forwarding HTTPS requests directly. Nginx supports HTTPS and requires the ngx_http_proxy_connect_module module. The module https://github.com/chobits/ngx_http_proxy_connect_module is open source on github. However, the patch of the maintained ngx_http_proxy_connect_module module is also limited by the nginx version. You need to select the corresponding forward proxy module according to the nginx version you use. You can view the corresponding relationship between nginx version and module in Select patch of REDEME.md

Installation package preparation

Download the nginx installation package

download link

insert image description here

Download the package of the forward proxy module

download link
insert image description here

Version and module comparison table

insert image description here

Deploy nginx service

  • Nginx-1.20.2 is used here, corresponding to proxy_connect_rewrite_1018.patch

Upload nginx package and forward module package

mkdir /nginx
cd /nginx

[root@mysql nginx]# ll

-rw-r--r-- 1 root root 1062124 Feb 12 15:23 nginx-1.20.2.tar.gz
-rw-r--r-- 1 root root   57926 Feb 12 15:23 ngx_http_proxy_connect_module-master.zip

decompress, rename

tar -xf nginx.tar.gz
unzip ngx_http_proxy_connect_module-master.zip


ll
drwxr-xr-x 9 1001 1001    4096 Feb 12 15:27 nginx-1.20.2
-rw-r--r-- 1 root root 1062124 Feb 12 15:23 nginx-1.20.2.tar.gz
drwxr-xr-x 5 root root    4096 Feb  9 16:54 ngx_http_proxy_connect_module-master
-rw-r--r-- 1 root root   57926 Feb 12 15:23 ngx_http_proxy_connect_module-master.zip

mv ngx_http_proxy_connect_module-master ngx_http_proxy_connect_module

ll
drwxr-xr-x 9 1001 1001    4096 Feb 12 15:27 nginx-1.20.2
-rw-r--r-- 1 root root 1062124 Feb 12 15:23 nginx-1.20.2.tar.gz
drwxr-xr-x 5 root root    4096 Feb  9 16:54 ngx_http_proxy_connect_module
-rw-r--r-- 1 root root   57926 Feb 12 15:23 ngx_http_proxy_connect_module-master.zip

install nginx

yum -y install make gcc openssl openssl-devel pcre-devel zlib zlib-devel

cd nginx-1.20.2

ll 
drwxr-xr-x 6 1001 1001   4096 Feb 12 15:20 auto
-rw-r--r-- 1 1001 1001 312251 Nov 16  2021 CHANGES
-rw-r--r-- 1 1001 1001 476577 Nov 16  2021 CHANGES.ru
drwxr-xr-x 2 1001 1001   4096 Feb 12 15:20 conf
-rwxr-xr-x 1 1001 1001   2590 Nov 16  2021 configure
drwxr-xr-x 4 1001 1001   4096 Feb 12 15:20 contrib
drwxr-xr-x 2 1001 1001   4096 Feb 12 15:20 html
-rw-r--r-- 1 1001 1001   1397 Nov 16  2021 LICENSE
drwxr-xr-x 2 1001 1001   4096 Feb 12 15:20 man
-rw-r--r-- 1 1001 1001     49 Nov 16  2021 README
drwxr-xr-x 9 1001 1001   4096 Feb 12 15:20 src

# 查看正向代理模块proxy_connect_rewrite_1018.patch的位置
ll ../ngx_http_proxy_connect_module/patch/
-rw-r--r-- 1 root root 9849 Feb  9 16:54 proxy_connect_1014.patch
-rw-r--r-- 1 root root 9697 Feb  9 16:54 proxy_connect.patch
-rw-r--r-- 1 root root 9408 Feb  9 16:54 proxy_connect_rewrite_1014.patch
-rw-r--r-- 1 root root 9505 Feb  9 16:54 proxy_connect_rewrite_101504.patch
-rw-r--r-- 1 root root 9496 Feb  9 16:54 proxy_connect_rewrite_1015.patch
-rw-r--r-- 1 root root 9553 Feb  9 16:54 proxy_connect_rewrite_1018.patch
-rw-r--r-- 1 root root 9306 Feb  9 16:54 proxy_connect_rewrite_102101.patch
-rw-r--r-- 1 root root 9337 Feb  9 16:54 proxy_connect_rewrite.patch

# 导入模块 后面为模块路径
patch -p1 < /nginx/ngx_http_proxy_connect_module/patch/proxy_connect_rewrite_1018.patch

# 编译
./configure --add-module=/nginx/ngx_http_proxy_connect_module

# 安装，默认安装在/usr/local/nginx/
make && make install

# 查看nginx
ll /usr/local/nginx/
drwx------ 2 nobody root 4096 Feb 12 15:47 client_body_temp
drwxr-xr-x 2 root   root 4096 Feb 12 15:46 conf
drwx------ 2 nobody root 4096 Feb 12 15:47 fastcgi_temp
drwxr-xr-x 2 root   root 4096 Feb 12 15:28 html
drwxr-xr-x 2 root   root 4096 Feb 12 15:47 logs
drwx------ 2 nobody root 4096 Feb 12 15:47 proxy_temp
drwxr-xr-x 2 root   root 4096 Feb 12 15:33 sbin
drwx------ 2 nobody root 4096 Feb 12 15:47 scgi_temp
drwx------ 2 nobody root 4096 Feb 12 15:47 uwsgi_temp

Configure forward proxy

cd /usr/local/nginx/

#gzip  on;下添加
vim conf/nginx.conf
    #gzip  on;

    #正向代理转发http请求
    server {
    
    
    #指定DNS服务器IP地址
        resolver 114.114.114.114;
    #监听80端口，http默认端口80
        listen 80;
    #服务器IP或域名
            server_name  localhost;
    #正向代理转发http请求
    location / {
    
    
        proxy_pass                 http://$host$request_uri;
        proxy_set_header           HOST $host;
        proxy_buffers              256 4k;
        proxy_max_temp_file_size   0k;
        proxy_connect_timeout      30;
        proxy_send_timeout         60;
        proxy_read_timeout         60;
        proxy_next_upstream error  timeout invalid_header http_502;
    }
    }
    #正向代理转发https请求
    server {
    
    
        #指定DNS服务器IP地址
            resolver 114.114.114.114;
        #监听443端口，https默认端口443
        listen 443;
        #正向代理转发https请求
        proxy_connect;
        proxy_connect_allow            443 563;
        proxy_connect_connect_timeout  10s;
        proxy_connect_read_timeout     10s;
        proxy_connect_send_timeout     10s;
     location / {
    
    
             proxy_pass http://$host;
             proxy_set_header Host $host;
   }
   }

create nginx user

  • The nginx service starts as user nginx
useradd nginx

Check nginx configuration and start

sbin/nginx -t
sbin/nginx

ss -utnlp | grep nginx
tcp    LISTEN     0      511       *:443                   *:*                   users:(("nginx",pid=6645,fd=7),("nginx",pid=6644,fd=7))
tcp    LISTEN     0      511       *:80                    *:*                   users:(("nginx",pid=6645,fd=6),("nginx",pid=6644,fd=6))

The server where the nginx service is located verifies the forward proxy function

 curl -I http://www.baidu.com/ -v -x 127.0.0.1:80
 curl -I https://www.baidu.com/ -v -x 127.0.0.1:443

curl -I http://www.baidu.com/ -v -x 127.0.0.1:80
* About to connect() to proxy 127.0.0.1 port 80 (#0)
*   Trying 127.0.0.1...
* Connected to 127.0.0.1 (127.0.0.1) port 80 (#0)
> HEAD http://www.baidu.com/ HTTP/1.1
> User-Agent: curl/7.29.0
> Host: www.baidu.com
> Accept: */*
> Proxy-Connection: Keep-Alive
>
< HTTP/1.1 200 OK
HTTP/1.1 200 OK
< Server: nginx/1.20.2
Server: nginx/1.20.2
< Date: Sun, 12 Feb 2023 09:03:40 GMT
Date: Sun, 12 Feb 2023 09:03:40 GMT
< Content-Type: text/html
Content-Type: text/html
< Content-Length: 277
Content-Length: 277
< Connection: keep-alive
Connection: keep-alive
< Accept-Ranges: bytes
Accept-Ranges: bytes
< Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform
Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform
< Etag: "575e1f60-115"
Etag: "575e1f60-115"
< Last-Modified: Mon, 13 Jun 2016 02:50:08 GMT
Last-Modified: Mon, 13 Jun 2016 02:50:08 GMT
< Pragma: no-cache
Pragma: no-cache

<
* Connection #0 to host 127.0.0.1 left intact

curl -I https://www.baidu.com/ -v -x 127.0.0.1:443
* About to connect() to proxy 127.0.0.1 port 443 (#0)
*   Trying 127.0.0.1...
* Connected to 127.0.0.1 (127.0.0.1) port 443 (#0)
* Establish HTTP proxy tunnel to www.baidu.com:443
> CONNECT www.baidu.com:443 HTTP/1.1
> Host: www.baidu.com:443
> User-Agent: curl/7.29.0
> Proxy-Connection: Keep-Alive
>
< HTTP/1.1 200 Connection Established
HTTP/1.1 200 Connection Established
< Proxy-agent: nginx
Proxy-agent: nginx
<

* Proxy replied OK to CONNECT request
* Initializing NSS with certpath: sql:/etc/pki/nssdb
*   CAfile: /etc/pki/tls/certs/ca-bundle.crt
  CApath: none
* SSL connection using TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
* Server certificate:
*       subject: CN=baidu.com,O="Beijing Baidu Netcom Science Technology Co., Ltd",OU=service operation department,L=beijing,ST=beijing,C=CN
*       start date: Jul 05 05:16:02 2022 GMT
*       expire date: Aug 06 05:16:01 2023 GMT
*       common name: baidu.com
*       issuer: CN=GlobalSign RSA OV SSL CA 2018,O=GlobalSign nv-sa,C=BE
> HEAD / HTTP/1.1
> User-Agent: curl/7.29.0
> Host: www.baidu.com
> Accept: */*
>
< HTTP/1.1 200 OK
HTTP/1.1 200 OK
< Accept-Ranges: bytes
Accept-Ranges: bytes
< Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform
Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform
< Connection: keep-alive
Connection: keep-alive
< Content-Length: 277
Content-Length: 277
< Content-Type: text/html
Content-Type: text/html
< Date: Sun, 12 Feb 2023 09:03:40 GMT
Date: Sun, 12 Feb 2023 09:03:40 GMT
< Etag: "575e1f60-115"
Etag: "575e1f60-115"
< Last-Modified: Mon, 13 Jun 2016 02:50:08 GMT
Last-Modified: Mon, 13 Jun 2016 02:50:08 GMT
< Pragma: no-cache
Pragma: no-cache
< Server: bfe/1.0.8.18
Server: bfe/1.0.8.18

<
* Connection #0 to host 127.0.0.1 left intact

Configure a server that cannot access the external network (that is, an internal network server) so that it can access the external network

Liunx server configuration

1. When only configuring yum, you can use the forward proxy to access the external network

#追加配置
vim /etc/yum.conf
proxy=http://192.168.0.20:80		#nginx正向代理服务器的地址
proxy=ftp://192.168.0.20:80			#nginx正向代理服务器的地址

2. When only configuring wget, you can use the forward proxy to access the external network

#追加配置
vim /etc/wgetrc
http_proxy=192.168.0.20:80     #nginx正向代理服务器的地址
http_proxy=192.168.0.20:443    #nginx正向代理服务器的地址

3. Global configuration, so access requests can use the forward proxy to access the external network

#追加配置
vim /etc/profile
http_proxy=192.168.0.20:80
https_proxy=192.168.0.20:443
ftp_proxy=192.168.0.20:443

export http_proxy
export https_proxy
export ftp_proxy

# 加载配置
source /etc/profile

windows server configuration

insert image description here

Verify that the server that cannot access the external network (that is, the internal network server) uses a proxy to access the Internet

curl -I http://www.baidu.com
curl -I https://www.baidu.com

curl -I http://www.baidu.com
HTTP/1.1 200 OK
Server: nginx/1.20.2
Date: Sun, 12 Feb 2023 09:31:03 GMT
Content-Type: text/html
Content-Length: 277
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform
Etag: "575e1f60-115"
Last-Modified: Mon, 13 Jun 2016 02:50:08 GMT
Pragma: no-cache

curl -I https://www.baidu.com
HTTP/1.1 200 Connection Established
Proxy-agent: nginx

HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform
Connection: keep-alive
Content-Length: 277
Content-Type: text/html
Date: Sun, 12 Feb 2023 09:31:07 GMT
Etag: "575e1f60-115"
Last-Modified: Mon, 13 Jun 2016 02:50:08 GMT
Pragma: no-cache
Server: bfe/1.0.8.18

Guess you like

Origin blog.csdn.net/qq_44659804/article/details/128997510
Recommended
TIOBE May list: Fortran “resurrected” into Top 10
GCC 14.1 released
Ranking
B. Little Girl and Game【1300 / 回文字符串 博弈论】
CIKERS Shane 20190613
"Javascript advanced programming" study notes - the constructor and prototype
beeline hiveserver2 start
springboot - Automatically backup mysql data every day
Data Storage Full Solution--Detailed Persistence Technology
Detailed Explanation of Spring Web MVC DispatcherServlet—Official Original
TCP / IP protocol layers structure and function
Command type literal pos: unknown； Fallback type literal pos: unknown] with root cause
Design of multifunctional curtain controller with indoor anti-theft alarm
Daily
More
2024-05-08(18)
2024-05-07(34)
2024-05-06(6)
2024-05-05(0)
2024-05-04(18)
2024-05-03(8)
2024-05-02(0)
2024-05-01(4)
2024-04-30(36)
2024-04-29(5)

Code World

© 2018 codetd.com