Nginx正向代理的配置和使用

nginx正向代理http，nginx正向代理https

• 正向代理，指的是通过代理服务器 代理浏览器/客户端去重定向请求访问到目标服务器 的一种代理服务。正向代理服务的特点是代理服务器 代理的对象是浏览器/客户端，也就是对于目标服务器 来说浏览器/客户端是隐藏的。

• nginx默认支持正向代理Http，不支持https

• nginx官方并不支持直接转发https请求，nginx支持https需要ngx_http_proxy_connect_module模块。GitHub上开源了模块 https://github.com/chobits/ngx_http_proxy_connect_module。不过维护的ngx_http_proxy_connect_module模块的补丁也是有nginx版本限制的，需根据自身使用的nginx版本选择相应的正向代理模块。可以在REDEME.md的Select patch中查看nginx版本和模块的对应关系

安装包准备

下载nginx安装包

下载地址

下载正向代理模块的包

下载地址

版本与模块对照表

部署nginx服务

• 此处使用的是nginx-1.20.2，对应proxy_connect_rewrite_1018.patch

上传nginx包和正向模块包

mkdir /nginxcd /nginx[root@Mysql nginx]# ll-rw-r--r-- 1 root root 1062124 Feb 12 15:23 nginx-1.20.2.tar.gz-rw-r--r-- 1 root root   57926 Feb 12 15:23 ngx_http_proxy_connect_module-master.zip

解压,改名

tar -xf nginx.tar.gzunzip ngx_http_proxy_connect_module-master.ziplldrwxr-xr-x 9 1001 1001    4096 Feb 12 15:27 nginx-1.20.2-rw-r--r-- 1 root root 1062124 Feb 12 15:23 nginx-1.20.2.tar.gzdrwxr-xr-x 5 root root    4096 Feb  9 16:54 ngx_http_proxy_connect_module-master-rw-r--r-- 1 root root   57926 Feb 12 15:23 ngx_http_proxy_connect_module-master.zipmv ngx_http_proxy_connect_module-master ngx_http_proxy_connect_modulelldrwxr-xr-x 9 1001 1001    4096 Feb 12 15:27 nginx-1.20.2-rw-r--r-- 1 root root 1062124 Feb 12 15:23 nginx-1.20.2.tar.gzdrwxr-xr-x 5 root root    4096 Feb  9 16:54 ngx_http_proxy_connect_module-rw-r--r-- 1 root root   57926 Feb 12 15:23 ngx_http_proxy_connect_module-master.zip

安装nginx

yum -y install make GCc openssl openssl-devel pcre-devel zlib zlib-develcd nginx-1.20.2ll drwxr-xr-x 6 1001 1001   4096 Feb 12 15:20 auto-rw-r--r-- 1 1001 1001 312251 Nov 16  2021 CHANGES-rw-r--r-- 1 1001 1001 476577 Nov 16  2021 CHANGES.rudrwxr-xr-x 2 1001 1001   4096 Feb 12 15:20 conf-rwxr-xr-x 1 1001 1001   2590 Nov 16  2021 configuredrwxr-xr-x 4 1001 1001   4096 Feb 12 15:20 contribdrwxr-xr-x 2 1001 1001   4096 Feb 12 15:20 html-rw-r--r-- 1 1001 1001   1397 Nov 16  2021 LICENSEdrwxr-xr-x 2 1001 1001   4096 Feb 12 15:20 man-rw-r--r-- 1 1001 1001     49 Nov 16  2021 READMEdrwxr-xr-x 9 1001 1001   4096 Feb 12 15:20 srC# 查看正向代理模块proxy_connect_rewrite_1018.patch的位置ll ../ngx_http_proxy_connect_module/patch/-rw-r--r-- 1 root root 9849 Feb  9 16:54 proxy_connect_1014.patch-rw-r--r-- 1 root root 9697 Feb  9 16:54 proxy_connect.patch-rw-r--r-- 1 root root 9408 Feb  9 16:54 proxy_connect_rewrite_1014.patch-rw-r--r-- 1 root root 9505 Feb  9 16:54 proxy_connect_rewrite_101504.patch-rw-r--r-- 1 root root 9496 Feb  9 16:54 proxy_connect_rewrite_1015.patch-rw-r--r-- 1 root root 9553 Feb  9 16:54 proxy_connect_rewrite_1018.patch-rw-r--r-- 1 root root 9306 Feb  9 16:54 proxy_connect_rewrite_102101.patch-rw-r--r-- 1 root root 9337 Feb  9 16:54 proxy_connect_rewrite.patch# 导入模块 后面为模块路径patch -p1 < /nginx/ngx_http_proxy_connect_module/patch/proxy_connect_rewrite_1018.patch# 编译./configure --add-module=/nginx/ngx_http_proxy_connect_module# 安装，默认安装在/usr/local/nginx/make && make install# 查看nginxll /usr/local/nginx/drwx------ 2 nobody root 4096 Feb 12 15:47 client_body_tempdrwxr-xr-x 2 root   root 4096 Feb 12 15:46 confdrwx------ 2 nobody root 4096 Feb 12 15:47 fastcgi_tempdrwxr-xr-x 2 root   root 4096 Feb 12 15:28 htmldrwxr-xr-x 2 root   root 4096 Feb 12 15:47 logsdrwx------ 2 nobody root 4096 Feb 12 15:47 proxy_tempdrwxr-xr-x 2 root   root 4096 Feb 12 15:33 sbindrwx------ 2 nobody root 4096 Feb 12 15:47 scgi_tempdrwx------ 2 nobody root 4096 Feb 12 15:47 uwsgi_temp 

配置正向代理

cd /usr/local/nginx/#gzip  on;下添加vim conf/nginx.conf    #gzip  on;    #正向代理转发http请求    server {    #指定DNS服务器IP地址        resolver 114.114.114.114;    #监听80端口，http默认端口80        listen 80;    #服务器IP或域名            server_name  localhost;    #正向代理转发http请求    location / {        proxy_pass                 http://$host$request_uri;        proxy_set_header           HOST $host;        proxy_buffers              256 4k;        proxy_max_temp_file_size   0k;        proxy_connect_timeout      30;        proxy_send_timeout         60;        proxy_read_timeout         60;        proxy_next_upstream error  timeout invalid_header http_502;    }    }    #正向代理转发https请求    server {        #指定DNS服务器IP地址            resolver 114.114.114.114;        #监听443端口，https默认端口443        listen 443;        #正向代理转发https请求        proxy_connect;        proxy_connect_allow            443 563;        proxy_connect_connect_timeout  10s;        proxy_connect_read_timeout     10s;        proxy_connect_send_timeout     10s;     location / {             proxy_pass http://$host;             proxy_set_header Host $host;   }   }

创建nginx用户

• nginx服务以用户nginx身份启动

useradd nginx

检查nginx配置并启动

sbin/nginx -tsbin/nginx

ss -utNLP | grep nginxtcp    LISTEN     0      511       *:443                   *:*                   users:(("nginx",pid=6645,fd=7),("nginx",pid=6644,fd=7))tcp    LISTEN     0      511       *:80                    *:*                   users:(("nginx",pid=6645,fd=6),("nginx",pid=6644,fd=6))

nginx服务所在服务器验证正向代理功能

 curl -I http://www.baidu.com/ -v -x 127.0.0.1:80 curl -I https://www.baidu.com/ -v -x 127.0.0.1:443

curl -I http://www.baidu.com/ -v -x 127.0.0.1:80* About to connect() to proxy 127.0.0.1 port 80 (#0)*   Trying 127.0.0.1...* Connected to 127.0.0.1 (127.0.0.1) port 80 (#0)> HEAD http://www.baidu.com/ HTTP/1.1> User-Agent: curl/7.29.0> Host: www.baidu.com> Accept: **>< HTTP/1.1 200 OKHTTP/1.1 200 OK< Accept-Ranges: bytesAccept-Ranges: bytes< Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transfORMCache-Control: private, no-cache, no-store, proxy-revalidate, no-transform< Connection: keep-aliveConnection: keep-alive< Content-Length: 277Content-Length: 277< Content-Type: text/htmlContent-Type: text/html< Date: Sun, 12 Feb 2023 09:03:40 GMTDate: Sun, 12 Feb 2023 09:03:40 GMT< Etag: "575e1f60-115"Etag: "575e1f60-115"< Last-Modified: Mon, 13 Jun 2016 02:50:08 GMTLast-Modified: Mon, 13 Jun 2016 02:50:08 GMT< Pragma: no-cachePragma: no-cache< Server: bfe/1.0.8.18Server: bfe/1.0.8.18<* Connection #0 to host 127.0.0.1 left intact

配置不能访问外网的服务器（即内网服务器）,使其可以访问外网

liunx服务器配置

1.只配置使用yum时，能够使用正向代理访问外网

#追加配置vim /etc/yum.confproxy=http://192.168.0.20:80#nginx正向代理服务器的地址proxy=ftp://192.168.0.20:80#nginx正向代理服务器的地址

2.只配置使用wget时，能够使用正向代理访问外网

#追加配置vim /etc/wgetrchttp_proxy=192.168.0.20:80     #nginx正向代理服务器的地址http_proxy=192.168.0.20:443    #nginx正向代理服务器的地址

3.全局配置，所以访问请求都能够使用正向代理访问外网

#追加配置vim /etc/profilehttp_proxy=192.168.0.20:80https_proxy=192.168.0.20:443ftp_proxy=192.168.0.20:443export http_proxyexport https_proxyexport ftp_proxy# 加载配置source /etc/profile

windows服务器配置

验证不能访问外网的服务器（即内网服务器）,使用代理上网

curl -I http://www.baidu.comcurl -I https://www.baidu.com

curl -I http://www.baidu.comHTTP/1.1 200 OKServer: nginx/1.20.2Date: Sun, 12 Feb 2023 09:31:03 GMTContent-Type: text/htmlContent-Length: 277Connection: keep-aliveAccept-Ranges: bytesCache-Control: private, no-cache, no-store, proxy-revalidate, no-transformEtag: "575e1f60-115"Last-Modified: Mon, 13 Jun 2016 02:50:08 GMTPragma: no-cache

curl -I https://www.baidu.comHTTP/1.1 200 Connection EstablishedProxy-agent: nginxHTTP/1.1 200 OKAccept-Ranges: bytesCache-Control: private, no-cache, no-store, proxy-revalidate, no-transformConnection: keep-aliveContent-Length: 277Content-Type: text/htmlDate: Sun, 12 Feb 2023 09:31:07 GMTEtag: "575e1f60-115"Last-Modified: Mon, 13 Jun 2016 02:50:08 GMTPragma: no-cacheServer: bfe/1.0.8.18

来源地址：https://blog.csdn.net/qq_44659804/article/details/128997510