CentOS7下搭建nginx反向代理服务器使得外网可以二级域名访问内网应用
创建nginx的本地yum源
[root@localhost ~]# yum list |grep nginx
No package nginx available.
[root@localhost ~]# //给跪了，什么鬼，怎么没有nginx的rpm？算了，直接自己手动配一个官网repo吧
[root@localhost ~]# //访问nginx官网，进入dowload页面，翻到底部的Pre-Build Package，选stable version
---------------------------
To set up the yum repository for RHEL/CentOS, create the file named /etc/yum.repos.d/nginx.repo with the following contents:
[nginx]
name=nginx repo
baseurl=http://nginx.org/packages/OS/OSRELEASE/$basearch/
gpgcheck=0
enabled=1
Replace “OS” with “rhel” or “centos”, depending on the distribution used, and “OSRELEASE” with “5”, “6”, or “7”, for 5.x, 6.x, or 7.x versions, respectively.
---------------------------
[root@localhost ~]#
[root@localhost ~]# //大意就是：创建/etc/yum.repos.d/nginx.repo文件，贴入模板内容，替换相应的系统和软件版本号
[root@localhost ~]#
[root@localhost ~]# cd /etc/yum.repos.d
[root@localhost yum.repos.d]# vi nginx.repo
[nginx]
name=nginx repo
baseurl=http://nginx.org/packages/centos/7/$basearch/
gpgcheck=0
enabled=1
:wq以yum方式安装nginx
[root@localhost yum.repos.d]# yum list |grep nginx
nginx.x86_64 1:1.10.0-1.el7.ngx nginx
nginx-debug.x86_64 1:1.8.0-1.el7.ngx nginx
nginx-debuginfo.x86_64 1:1.10.0-1.el7.ngx nginx
nginx-module-geoip.x86_64 1:1.10.0-1.el7.ngx nginx
nginx-module-image-filter.x86_64 1:1.10.0-1.el7.ngx nginx
nginx-module-njs.x86_64 1:1.10.0.0.0.20160414.1c50334fbea6-1.el7.ngx
nginx
nginx-module-perl.x86_64 1:1.10.0-1.el7.ngx nginx
nginx-module-xslt.x86_64 1:1.10.0-1.el7.ngx nginx
nginx-nr-agent.noarch 2.0.0-9.el7.ngx nginx
pcp-pmda-nginx.x86_64 3.10.6-2.el7 base
[root@localhost yum.repos.d]# yum install nginx.x86_64
Loaded plugins: fastestmirror, langpacks
Loading mirror speeds from cached hostfile
* rpmforge: mirrors.neusoft.edu.cn
Resolving Dependencies
--> Running transaction check
---> Package nginx.x86_64 1:1.10.0-1.el7.ngx will be installed
--> Finished Dependency Resolution
Dependencies Resolved
####################################################################################
Package Arch Version Repository Size
####################################################################################
Installing:
nginx x86_64 1:1.10.0-1.el7.ngx nginx 640 k
Transaction Summary
####################################################################################
Install 1 Package
Total download size: 640 k
Installed size: 2.1 M
Is this ok [y/d/N]: y
Downloading packages:
nginx-1.10.0-1.el7.ngx.x86_64.rpm | 640 kB 00:00:18
Running transaction check
Running transaction test
Transaction test succeeded
Running transaction
Installing : 1:nginx-1.10.0-1.el7.ngx.x86_64 1/1
----------------------------------------------------------------------
Thanks for using nginx!
Please find the official documentation for nginx here:
* http://nginx.org/en/docs/
Commercial subscriptions for nginx are available on:
* http://nginx.com/products/
----------------------------------------------------------------------
Verifying : 1:nginx-1.10.0-1.el7.ngx.x86_64 1/1
Installed:
nginx.x86_64 1:1.10.0-1.el7.ngx
Complete!
[root@localhost yum.repos.d]# nginx -v
nginx version: nginx/1.10.0
[root@localhost yum.repos.d]# service nginx start
Redirecting to /bin/systemctl start nginx.service
● nginx.service - nginx - high performance web server
Loaded: loaded (/usr/lib/systemd/system/nginx.service; disabled; vendor preset: disabled)
Active: active (running) since Tue 2016-05-10 10:19:20 CST; 3s ago
Docs: http://nginx.org/en/docs/
Process: 29730 ExecStart#/usr/sbin/nginx -c /etc/nginx/nginx.conf (code#exited, status#0/SUCCESS)
Process: 29729 ExecStartPre#/usr/sbin/nginx -t -c /etc/nginx/nginx.conf (code#exited, status#0/SUCCESS)
Main PID: 29733 (nginx)
CGroup: /system.slice/nginx.service
├─29733 nginx: master process /usr/sbin/nginx -c /etc/nginx/nginx.conf
└─29734 nginx: worker process
May 10 10:19:20 localhost systemd[1]: Starting nginx - high performance web server...
May 10 10:19:20 localhost nginx[29729]: nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
May 10 10:19:20 localhost nginx[29729]: nginx: configuration file /etc/nginx/nginx.conf test is successful
May 10 10:19:20 localhost systemd[1]: Failed to read PID from file /run/nginx.pid: Invalid argument
May 10 10:19:20 localhost systemd[1]: Started nginx - high performance web server.
[root@localhost yum.repos.d]# curl localhost //或者打开浏览器访问http://localhost/
Welcome to nginx!
Welcome to nginx!
If you see this page, the nginx web server is successfully installed and
working. Further configuration is required.
For online documentation and support please refer to
#"http://nginx.org/">nginx.org.
Commercial support is available at
#"http://nginx.com/">nginx.com.
Thank you for using nginx.
ok安装好了，下面就是配置的事情
配置nginx为反向代理服务器
设置nginx开机自启动
[root@localhost yum.repos.d]# cd /etc/nginx
[root@localhost nginx]# chkconfig nginx on
Note: Forwarding request to 'systemctl enable nginx.service'.
Created symlink from /etc/systemd/system/multi-user.target.wants/nginx.service to /usr/lib/systemd/system/nginx.service.设置nginx的反向代理规则
[root@localhost nginx]# vi nginx.conf
user nginx;
worker_processes 1;
error_log /var/log/nginx/error.log warn;
pid /var/run/nginx.pid;
events {
worker_connections 1024;
}
http {
include /etc/nginx/mime.types;
default_type application/octet-stream;
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
access_log /var/log/nginx/access.log main;
sendfile on;
#tcp_nopush on;
keepalive_timeout 65;
gzip on;
#modify@2016-05-10 11:30
include /etc/nginx/conf.d/reverse-proxy.conf;
client_max_body_size 50m; #缓冲区代理缓冲用户端请求的最大字节数,可以理解为保存到本地再传给用户
client_body_buffer_size 256k;
client_header_timeout 3m;
client_body_timeout 3m;
send_timeout 3m;
proxy_connect_timeout 300s; #nginx跟后端服务器连接超时时间(代理连接超时)
proxy_read_timeout 300s; #连接成功后，后端服务器响应时间(代理接收超时)
proxy_send_timeout 300s;
proxy_buffer_size 64k; #设置代理服务器（nginx）保存用户头信息的缓冲区大小
proxy_buffers 4 32k; #proxy_buffers缓冲区，网页平均在32k以下的话，这样设置
proxy_busy_buffers_size 64k; #高负荷下缓冲大小（proxy_buffers*2）
proxy_temp_file_write_size 64k; #设定缓存文件夹大小，大于这个值，将从upstream服务器传递请求，而不缓冲到磁盘
proxy_ignore_client_abort on; #不允许代理端主动关闭连接
server {
listen 80;
server_name localhost;
location / {
root html;
index index.html index.htm;
}
error_page 500 502 503 504 /50x.html;
location # /50x.html {
root html;
}
}
#modification is done!
}
:wq
[root@localhost nginx]# cd conf.d/
[root@localhost conf.d]# vi reverse-proxy.conf
## wiki.myweb.org -> http://10.1.1.230:8013
server
{
listen 80;
server_name wiki.myweb.org;
location / {
proxy_redirect off;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_pass http://10.1.1.230:8013;
}
access_log /var/log/nginx/wiki_access.log;
}
## zentao.myweb.org/zentao -> http://10.1.1.240:49017/zentao
server
{
listen 80;
server_name zentao.myweb.org;
location / {
proxy_redirect off;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_pass http://10.1.1.240:49017;
}
access_log /var/log/nginx/zentao_access.log;
}
## trac.myweb.org -> http://10.1.1.240:8000/
server
{
listen 80;
server_name trac.myweb.org;
location / {
proxy_redirect off;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_pass http://10.1.1.240:8000;
}
access_log /var/log/nginx/trac_access.log;
}
## kb2.myweb.org -> http://10.1.1.230:8080/
server
{
listen 80;
server_name kb2.myweb.org;
location / {
proxy_redirect off;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_pass http://10.1.1.230:8080;
}
access_log /var/log/nginx/iphmk_admin_kb2_access.log;
}
:wq
[root@localhost conf.d]# service start nginx
最后一步
因为我们nginx的反向代理服务器是部署在10.1.1.230上，它本身也是内网服务器，所以需要在路由器上配一个路由转发规则：
所有从外网80端口进来的请求，都转发到nginx所在的服务器，由nginx来负责转发。
路由器设置：虚拟服务器
WAN口 wan1
WAN端口 80 常用服务： DNS(53)
LAN端口 80
内网IP 10.1.1.230
协议： 全部ok，大公告成～
本文参考以下博文来实现部署：
http://blog.csdn.net/hejingyuan6/article/details/47262419 （考虑做window的测试）
http://www.ttlsa.com/nginx/use-nginx-proxy/
http://blog.csdn.net/isresultxal/article/details/50674378
http://blog.csdn.net/xshalk/article/details/51313101 （后续我也要做证书授权的说）
后续的改进
我这种代理配置，看着不怎么美观，我记得有更优美的配置方式的，等悠闲的时候，可以继续优化。
【重要补充：】
对了，还忘记了交代：还需要一个自己的域名（myweb.org），才可以这样去使用二级域名来解析内网应用。
如果没有，可以申请阿里云服务，然后在路由器上，来绑定内网入口的网络服务商分配给动态IP（这步很简单，就是路由器上设置填上申请的动态域名就好了）
这里的工作，属于准备期工作，申请啊备案啊，还是很繁琐的，本次没有记录下来～