Squid在企业网络中的应用
一、squid简介Squid是一个缓存Internet数据的一个软件，其接收用户的下载申请，并自动处理所下载的数据。当一个用户想要下载一个主页时，可以向Squid发出一个申请，要Squid代替其进行下载，然后Squid连接所申请网站并请求该主页，接着把该主页传给用户同时保留一个备份，当别的用户申请同样的页面时，Squid把保存的备份立即传给用户，使用户觉得速度相当快。目前，Squid可以代理HTTP、FTP、GOPHER、SSL和WAIS协议，暂不能代理POP3、NNTP等协议。并且，Squid可以自动地进行处理，可以根据自己的需要设置Squid，使之过滤掉不想要的东西。
Squid可以工作在很多的操作系统中，如AIX、Digital、UNIX、FreeBSD、HP-UX、Irix、Linux、NetBSD、Nextstep、SCO、Solaris、OS/2等。
对于Web用户来说，Squid是一个高性能的代理缓存服务器，和一般的代理缓存软件不同、Squid用一个单独的、非模块化的、I/O驱动的进程来处理所有的客户端请求。
Squid由一个主要的服务程序Squid，一个DNS查询程序DNS server，几个重写请求和执行认证的程序，以及几个管理工具组成。当Squid启动以后，它可以派生出预先指定数目的DNS server进程，而每一个DNS server进程都可以执行单独的DNS查询，这样就大大减少了服务器等待DNS查询的时间。
二、配置ip及测试网络
1、添加双网卡
http://yunxia.blog.运维网.com/attachment/201208/30/5628445_1346347868lEah.png
2、给两块网卡配置ip地址
# ifconfig eth0 192.168.99.100 //内网ip地址
# ifconfig eth1 192.168.101.50 //外网ip地址
内网网卡
http://yunxia.blog.运维网.com/attachment/201208/30/5628445_13463478693Ba1.png
外网网卡
http://yunxia.blog.运维网.com/attachment/201208/30/5628445_1346347870GSDC.png
4、重启网络服务
# service network restart //重启网络服务，是配置的ip生效
http://yunxia.blog.运维网.com/attachment/201208/30/5628445_1346347871K39c.png
5、查看是否配置网关
# route –n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
192.168.101.0 0.0.0.0 255.255.255.0 U 0 0 0 eth1
192.168.99.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
169.254.0.0 0.0.0.0 255.255.0.0 U 0 0 0 eth1
0.0.0.0 192.168.101.254 0.0.0.0 UG 0 0 0 eth1 //有参数指向该网关
6、编辑域名文件，使内网实现上网功能
# vim /etc/resolv.conf
http://yunxia.blog.运维网.com/attachment/201208/30/5628445_1346347871T22g.png
7、在内网上ping外网网关和百度，看是否能上网
# ping 192.168.101.254 //可以ping通网关
http://yunxia.blog.运维网.com/attachment/201208/30/5628445_1346347873YqO7.png
# ping www.baidu.com//可以ping通百度，可以上网
http://yunxia.blog.运维网.com/attachment/201208/30/5628445_1346347874narp.png
三、安装squid
# mkdir /mnt/cdrom///建立光盘挂载点
mkdir: cannot create directory `/mnt/cdrom/': File exists
# mount /dev/cdrom /mnt/cdrom/ //挂载光盘
mount: block device /dev/cdrom is write-protected, mounting read-only
# cd /mnt/cdrom/Server///切换到该目录下找到安装文件
# ll squid-2.6.STABLE21-3.el5.i386.rpm
-r--r--r-- 278 root root 1341103 Sep 232008 squid-2.6.STABLE21-3.el5.i386.rpm//稳定版
# rpm -ivh squid-2.6.STABLE21-3.el5.i386.rpm //安装squid
http://yunxia.blog.运维网.com/attachment/201208/30/5628445_1346347875cRFU.png
安装成功！没有依赖性，直接可以安装！
查看squid的相关文件
# rpm -ql squid |less
/etc/rc.d/init.d/squid//独立守护进程
/etc/squid/squid.conf //配置脚本
/etc/squid/squid.conf.default//样例文件
四、相关案例
案例1 内网中实现上网
1、打开一台Windows虚拟机配置其ip地址，并添加代理服务器
http://yunxia.blog.运维网.com/attachment/201208/30/5628445_134634787683k0.png
2、添加代理服务器
http://yunxia.blog.运维网.com/attachment/201208/30/5628445_1346347878kWP5.png
3、编辑配置文件
# vim /etc/squid/squid.conf
http://yunxia.blog.运维网.com/attachment/201208/30/5628445_13463478797Hlv.png
5、初始化squid
# service squid start
init_cache_dir /var/spool/squid... Starting squid: . [ OK] //启动squid
6、查看端口是否启动
# netstat -tupln |less //端口已启动
http://yunxia.blog.运维网.com/attachment/201208/30/5628445_1346347880ce1T.png
# vim /etc/squid/squid.conf //编辑配置文件
7、写策略，使内网实现上网
http://yunxia.blog.运维网.com/attachment/201208/30/5628445_1346347881pgRP.png
# service squid restart //重启服务
Stopping squid: [OK]
Starting squid: . [ OK]
可以在内网中访问百度及其他网页，实现上网
http://yunxia.blog.运维网.com/attachment/201208/30/5628445_1346347883EdFD.png
8、将内网ip添加到端口号中
# vim /etc/squid/squid.conf
http://yunxia.blog.运维网.com/attachment/201208/30/5628445_1346347883b7ps.png
# squid -k parse//检测配置语法
# service squid restart
Stopping squid: .
Starting squid: .
9、查看端口情况
# netstat -tupln |less //端口号前面不再是0，而是内网的ip
http://yunxia.blog.运维网.com/attachment/201208/30/5628445_1346347884io7p.png
案例2 正向代理
一、基于源地址
# vim /etc/squid/squid.conf//编辑配置文件，使某个ip（192.168.99.10）地址不能访问网络，其他ip可访问网络
http://yunxia.blog.运维网.com/attachment/201208/30/5628445_1346347884wt9o.png
# service squid restart //重启服务
Stopping squid: . [ OK]
Starting squid: . [OK]
测试：
1、将用户机的ip设为192.168.99.10
http://yunxia.blog.运维网.com/attachment/201208/30/5628445_134634787683k0.png
2、在该用户的浏览器中访问网页
http://yunxia.blog.运维网.com/attachment/201208/30/5628445_13463478868xPq.png
不能访问外网！
3、将用户机的ip改为192.168.99.12
http://yunxia.blog.运维网.com/attachment/201208/30/5628445_1346347888uANA.png
4、在该用户的浏览器中访问网页
http://yunxia.blog.运维网.com/attachment/201208/30/5628445_1346347890Hsi4.png
此时，可以访问外网！
root@zyx squid]# vim /etc/squid/squid.conf //编辑配置文件，使某一范围的ip地址不能访问网络
http://yunxia.blog.运维网.com/attachment/201208/30/5628445_1346347890UXzJ.png
# service squid restart //重启服务
Stopping squid: ................ [ OK]
Starting squid: . [ OK]
5、刷新一下浏览器（注：此时用户主机ip为192.168.99.12）
http://yunxia.blog.运维网.com/attachment/201208/30/5628445_1346347892zesB.png
不能访问外网！
6、将用户主机ip改为192.168.99.20
http://yunxia.blog.运维网.com/attachment/201208/30/5628445_1346347894dypY.png
http://yunxia.blog.运维网.com/attachment/201208/30/5628445_1346347896tpUm.png
也不能访问外网！
7、将用户主机ip改为192.168.99.21
http://yunxia.blog.运维网.com/attachment/201208/30/5628445_1346347897pNyw.png
http://yunxia.blog.运维网.com/attachment/201208/30/5628445_1346347899x1bT.png
可以访问网络!
二，基于目的地址
1、编辑配置文件并写策略
# vim /etc/squid/squid.conf //
http://yunxia.blog.运维网.com/attachment/201208/30/5628445_1346347899ccNK.png
# service squid restart
Stopping squid:
Starting squid: .
http://yunxia.blog.运维网.com/attachment/201208/30/5628445_1346347902B7GD.png
http://yunxia.blog.运维网.com/attachment/201208/30/5628445_1346347903iOJ0.png
http://yunxia.blog.运维网.com/attachment/201208/30/5628445_1346347906QohD.png
三、基于URL
# vim /etc/squid/squid.conf
http://yunxia.blog.运维网.com/attachment/201208/30/5628445_1346347907X9qX.png
# service squid restart
Stopping squid: .
Starting squid: .
#
http://yunxia.blog.运维网.com/attachment/201208/30/5628445_13463479099PzU.png
http://yunxia.blog.运维网.com/attachment/201208/30/5628445_1346347911hv95.png
http://yunxia.blog.运维网.com/attachment/201208/30/5628445_1346347914AIQl.png
http://yunxia.blog.运维网.com/attachment/201208/30/5628445_1346347915TkuP.png
四，基于时间
# vim /etc/squid/squid.conf
http://yunxia.blog.运维网.com/attachment/201208/30/5628445_1346347916mBNJ.png
# service squid restart
Stopping squid: .
Starting squid: .
http://yunxia.blog.运维网.com/attachment/201208/30/5628445_1346347916vBIE.png
http://yunxia.blog.运维网.com/attachment/201208/30/5628445_1346347918n3DI.png
http://yunxia.blog.运维网.com/attachment/201208/30/5628445_1346347919KqmR.png
http://yunxia.blog.运维网.com/attachment/201208/30/5628445_1346347922rWuS.png
# vim /etc/squid/squid.conf
http://yunxia.blog.运维网.com/attachment/201208/30/5628445_1346347923a1ex.png
# service squid restart
Stopping squid:
Starting squid: .
http://yunxia.blog.运维网.com/attachment/201208/30/5628445_1346347925GpKC.png
# vim /etc/squid/squid.conf
http://yunxia.blog.运维网.com/attachment/201208/30/5628445_1346347926xb4D.png
# service squid restart
Stopping squid: . [ OK]
Starting squid: . [OK ]
http://yunxia.blog.运维网.com/attachment/201208/30/5628445_1346347926eCw0.png
http://yunxia.blog.运维网.com/attachment/201208/30/5628445_1346347932NpbO.png
修改一下服务器的时间
http://yunxia.blog.运维网.com/attachment/201208/30/5628445_1346347932HHn7.png
http://yunxia.blog.运维网.com/attachment/201209/2/5628445_1346566351PQ2K.png
案例3 透明代理
1、设置浏览器
http://yunxia.blog.运维网.com/attachment/201209/2/5628445_1346566352vwnv.png
2、给客户机配置ip地址（注：客户机的网关及DNS均要设置）
http://yunxia.blog.运维网.com/attachment/201209/2/5628445_1346566354Lob5.png
3、编辑此文件，实现nat转换功能
# vim /etc/sysctl.conf //将下图显示项的0改为1
http://yunxia.blog.运维网.com/attachment/201209/2/5628445_1346566354C3sM.png
# sysctl –p//使nat转换生效
http://yunxia.blog.运维网.com/attachment/201209/2/5628445_1346566356b1Ta.png
4、在squid所在的机器上，设置DNS关于NAT的转换
# iptables -t nat -A POSTROUTING -s 192.168.99.0/24 -p udp --dport 53 -o eth1 -j MASQUERADE //做nat解析
http://yunxia.blog.运维网.com/attachment/201209/2/5628445_1346566356HIfd.png
# iptables -t nat -L -v –n
http://yunxia.blog.运维网.com/attachment/201209/2/5628445_1346566358hYo1.png
5、设置端口重定向
# iptables -t nat -A PRETROUTING -p tcp --dport 80 -i eth0 -j REDIRECT --to-ports 3128 //将别的网站的80端口的请求提取到3128端口，通过nat转换提取，通过路由转发前的链实现
root@zyx ~]# iptables -t nat -L -v –n
http://yunxia.blog.运维网.com/attachment/201209/2/5628445_1346566360rFfL.png
6、编辑配置文件
# vim /etc/squid/squid.conf //禁用以前设置的规则，以免干扰nat转换
http://yunxia.blog.运维网.com/attachment/201209/2/5628445_1346566361xkLW.png
7、将3128端口设为透明
http://yunxia.blog.运维网.com/attachment/201209/2/5628445_1346566362QOBg.png
# service squid restart //重启服务
Stopping squid: [OK]
Starting squid: . [OK]
8、在客户机上访问因特网
http://yunxia.blog.运维网.com/attachment/201209/2/5628445_1346566366SDWm.png
http://yunxia.blog.运维网.com/attachment/201209/2/5628445_1346566370gDq4.png
可以成功访问网络！透明代理成功！
案例4 反向代理
http://yunxia.blog.运维网.com/attachment/201209/2/5628445_1346566370z4e2.png
http://yunxia.blog.运维网.com/attachment/201209/2/5628445_1346566371m3m4.png
http://yunxia.blog.运维网.com/attachment/201209/2/5628445_1346566371mPl1.png
http://yunxia.blog.运维网.com/attachment/201209/2/5628445_1346566372uM9s.png
# mkdir /mnt/cdrom
mkdir: cannot create directory `/mnt/cdrom': File exists
# mount /dev/cdrom /mnt/cdrom/
mount: block device /dev/cdrom is write-protected, mounting read-only
# cd /mnt/cdrom/Server/
# rpm -ivh httpd-2.2.3-31.el5.i386.rpm
Preparing... ###########################################
package httpd-2.2.3-31.el5.i386 is already installed
# cd /var/www/html/
# echo "welcom to my home" >index.html
# service httpd restart
Stopping httpd: [ OK]
Starting httpd: [OK]
# cd /mnt/cdrom/Server/
# rpm -ivh lynx-2.8.5-28.1.el5_2.1.i386.rpm
Preparing... ###########################################
1:lynx ###########################################
# lynxhttp://127.0.0.1
http://yunxia.blog.运维网.com/attachment/201209/2/5628445_1346566372uUNA.png
http://yunxia.blog.运维网.com/attachment/201209/2/5628445_1346566373OZ27.png
http://yunxia.blog.运维网.com/attachment/201209/2/5628445_134656637361IN.png
页:
[1]