Nginx模块块stream和ngx_http_proxy_connect_module使用体验

因项目环境限制,部署环境分为互联网环境(可访问互联网)和政务外网环境(不可访问互联网);但是因业务需要,需要实现政务外网环境访问访问外网;(原因不究~~~)

01

02

互联网区Server1 nginx搭建

ngx_http_proxy_connect_modulehttps://github.com/chobits/ngx_http_proxy_connect_module

1
2
3
4
5
6
7
8
9
10
11
12
13
14
yum install gcc gcc-c++ make automake autoconf libtool pcre pcre-devel zlib zlib-devel openssl openssl-devel wget
wget https://nginx.org/download/nginx-1.18.0.tar.gz
wget https://github.com/chobits/ngx_http_proxy_connect_module/archive/master.zip
tar xf nginx-1.18.0.tar.gz
unzip master.zip
cd nginx-1.18.0
patch -p1 < /usr/local/src/ngx_http_proxy_connect_module-master/patch/proxy_connect.patch
# nginx版本高于1.9.11,可以使用--add-dynamic-module=/path加载动态模块,配置文件里需要load_module模块位置;使用--add-module=PATH编译,配置文件里不用使用load_module指定模块;
./configure --prefix=/usr/local/nginx-1.18.0 --with-stream --add-dynamic-module=/usr/local/src/ngx_http_proxy_connect_module-master/
make
make install
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
worker_processes auto;
error_log logs/error.log info;
load_module /usr/local/nginx-1.18.0/modules/ngx_http_proxy_connect_module.so; #加载模块的配置必须必须放在这个位置
events {
worker_connections 1024;
}
http {
include mime.types;
default_type application/octet-stream;
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
access_log logs/access.log main;
sendfile on;
keepalive_timeout 65;
server {
listen 11001;
server_name localhost;
location /forecast_pic{
proxy_pass http://x.x.x.x:xx/forecast_pic ;
root html;
index index.html index.htm;
}
error_page 500 502 503 504 /50x.html;
location = /50x.html {
root html;
}
}
include proxy.conf; #为了方便查看,我把ngx_http_proxy_connect_module代理的配置单独放在这个文件里了
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
# cat proxy.conf
server {
listen 11003;
# dns resolver used by forward proxying
resolver 100.125.0.14;
location / {
proxy_pass http://$host$request_uri;
proxy_set_header HOST $http_host;
proxy_buffers 256 4k;
proxy_max_temp_file_size 0k;
proxy_connect_timeout 30;
proxy_send_timeout 60;
proxy_read_timeout 60;
proxy_next_upstream error timeout invalid_header http_502;
}
}
server {
listen 11004;
# dns resolver used by forward proxying
resolver 100.125.0.14; #指定cns
# forward proxy for CONNECT request
proxy_connect;
proxy_connect_allow 443; #指定https端口
proxy_connect_connect_timeout 10s;
proxy_connect_read_timeout 10s;
proxy_connect_send_timeout 10s;
# forward proxy for non-CONNECT request
location / {
proxy_pass http://$host;
proxy_set_header Host $host;
}
}

政务外网区 Server2 Nginx搭建

streamhttps://nginx.org/en/docs/stream/ngx_stream_core_module.html

nginx从1.9.0开始,新增加了一个stream模块,用来实现四层协议的转发、代理或者负载均衡等。(代理oracle、mysql等也是非常好用的,推荐~)

1
2
3
4
5
yum install gcc gcc-c++ make automake autoconf libtool pcre pcre-devel zlib zlib-devel openssl openssl-devel wget
wget https://nginx.org/download/nginx-1.18.0.tar.gz
tar xf nginx-1.18.0.tar.gz
cd nginx-1.18.0/
./configure --prefix=/usr/local/nginx-1.18.0/ --with-stream && make && make install
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
worker_processes 1;
events {
worker_connections 1024;
}
stream {
upstream proxy1 {
server 16.168.135.174:11003 weight=1 max_fails=2 fail_timeout=30s;
}
upstream proxy2 {
server 16.168.135.174:11004 weight=1 max_fails=2 fail_timeout=30s;
}
server {
listen 11003;
proxy_connect_timeout 1s;
proxy_timeout 3s;
proxy_pass proxy1;
}
server {
listen 11004;
proxy_connect_timeout 1s;
proxy_timeout 3s;
proxy_pass proxy2;
}
}
http {
include mime.types;
default_type application/octet-stream;
sendfile on;
keepalive_timeout 65;
server {
listen 11001;
server_name localhost;
location / {
if ($request_method = 'OPTIONS') {
add_header 'Access-Control-Allow-Origin' *;
add_header 'Access-Control-Allow-Credentials' 'true';
add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS';
add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,token,timestamp';
add_header 'Access-Control-Max-Age' 1728000;
add_header 'Content-Type' 'text/plain charset=UTF-8';
add_header 'Content-Length' 0;
return 204;
}
}
location /forecast_pic {
proxy_pass http://x.x.x.x:xx1/forecast_pic;
root html;
index index.html index.htm;
}
location /FJAtmoCompr {
proxy_pass http://x.x.x.x:xx2/FJAtmoCompr;
}
location /cdwarn {
proxy_pass http://x.x.x.x:xx3/cdwarn;
}
error_page 500 502 503 504 /50x.html;
location = /50x.html {
root html;
}
}
}

政务外网区 Server3 代理使用测试

03

为了长期使用,我们将代理设置为系统环境变量

1
2
3
4
5
6
7
vim /etc/profile
export http_proxy='16.167.5.198:11003'
export https_proxy='16.167.5.198:11004'
export ftp_proxy='16.167.5.198:11003'
source /etc/profile

04

独学无友,孤陋寡闻;学习记录,欢迎拍砖!