squid透明代理网关

squid server

内网 eth0 192.168.209.253

外网 eth1 172.16.10.128

1.安装squid和dns

[root@study ~]# yum -y install bind bind-chroot caching-nameserver squid

[root@study ~]# chkconfig --add squid

[root@study ~]# chkconfig squid on

[root@study ~]# chkconfig --add named

[root@study ~]# chkconfig named on

 

2.修改squid配置文件

[root@study ~]# vim /etc/squid/squid.conf

修改：

http_port 3128 transparent #加入transparent

cache_mem 512 MB #设置squid内存大小

cache_dir ufs /var/spool/squid 10240 16 256 #设置cache目录

cache_log /var/log/squid/cache.log #缓存日记

acl all src 0.0.0.0/0.0.0.0

acl web src 192.168.209.0/255.255.255.0 #定义acl，名为web

http_access allow web #允许web访问

http_access deny all

half_closed_clients off

maximum_object_size 32768 KB

cache_swap_low 90

cache_swap_high 95

visible_hostname 192.168.209.253

 

修改后结果：

[root@study ~]# egrep -v '^#|^$' /etc/squid/squid.conf

acl all src 0.0.0.0/0.0.0.0
acl web src 192.168.209.0/255.255.255.0
acl manager proto cache_object
acl localhost src 127.0.0.1/255.255.255.255
acl to_localhost dst 127.0.0.0/8
acl SSL_ports port 443
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 # https
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl CONNECT method CONNECT
http_access allow manager localhost
http_access deny manager
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localhost
http_access allow web
http_access deny all
icp_access allow all
http_port 3128 transparent
hierarchy_stoplist cgi-bin ?
cache_mem 512 MB
cache_dir ufs /var/spool/squid 10240 16 256
maximum_object_size 32768 KB
cache_swap_low 90
cache_swap_high 95
access_log /var/log/squid/access.log squid
cache_log /var/log/squid/cache.log
acl QUERY urlpath_regex cgi-bin \?
cache deny QUERY
refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern . 0 20% 4320
acl apache rep_header Server ^Apache
broken_vary_encoding allow apache
visible_hostname 192.168.209.253
coredump_dir /var/spool/squid

 

3.配置缓存Cache-only服务器

[root@study ~]# mv /etc/named.caching-nameserver.conf /etc/named.conf

[root@study ~]# vim /etc/named.conf

options {
        listen-on port 53 { any; };
        listen-on-v6 port 53 { ::1; };
        directory       "/var/named";
        dump-file       "/var/named/data/cache_dump.db";
        statistics-file "/var/named/data/named_stats.txt";
        memstatistics-file "/var/named/data/named_mem_stats.txt";

        allow-query     { any; };
        allow-query-cache { any; };
};
logging {
        channel default_debug {
                file "data/named.run";
                severity dynamic;
        };
};
view localhost_resolver {
        forward only;
        forwarders {
                202.96.128.86;
                202.96.128.143;
        };

        match-clients      { any; };
        match-destinations { any; };
        recursion yes;
        include "/etc/named.rfc1912.zones";
};

[root@study ~]# /etc/init.d/named start

 

4.开启内核路由功能

[root@study ~]# vim /etc/sysctl.conf

修改：

net.ipv4.ip_forward = 1

[root@study ~]# sysctl -p #使用配置生效

 

5.配置iptables

[root@study ~]# iptables -t nat -F

[root@study ~]# iptables -t nat -A POSTROUTING -s 192.168.209.0/24 -o eth1 -j MASQUERADE

[root@study ~]# iptables -t nat -A PREROUTING -p tcp -s 192.168.209.0/24 \

 --dport 80 -j REDIRECT --to-ports 3128

#将来自80端口的请求转向给squid的3128端口

[root@study ~]# service iptables save

 

6.客户机配置及测试

查看访问记录

 

7.其他

如果你的内存容量足够大，可以把内存做为缓存盘，把squid的缓存直接保存到内存中，从而加快访问的速度。实现的方法是利用系统默认加载的/dev/shm，也就是tmpfs文件系统，它默认最大为内存的一半大小，使用df -h可以看到，当空间不足时可以占用swap的空间，但由于数据是直接保存在内存中，所以服务器重启后数据会丢失。

[root@study ~]# mount -t tmpfs -o size=512M,nr_inodes=1000000 -o noatime tmpfs /var/spool/squid/

[root@study ~]# squid -z

[root@study ~]# /etc/init.d/squid start

把上面的命令写成启动脚本，下次重启时自动生效。

 

附：squid命中率返回的状态：

1.TCP_HIT

A valid copy of the requested object was in the cache。

就是说我squid本地有从源拿过来的这个请求，并且在本地已经做了cache，在请求的时候可以直接回复客户端的请求。

2.TCP_MEM_HIT

A valid copy of the requested object was in the cache and it was in memory, thus avoiding disk accesses.

内存cache命中

3.TCP_IMS_HIT

The client issued an IMS request for an object which was in the cache and fresh.

客户端发送了If-Modified-Since请求，请求的对象在cache中并且刷新。

4.TCP_REFRESH_HIT

The requested object was cached but STALE. The IMS query for the object resulted in "304 not modified".

就是这个请求的cache存在，但是不是最新的，是旧的。客户端的If-Modified-Since请求是"304 not modified"

5.TCP_MISS

The requested object was not in the cache.

就是说cache中没有客户端的请求。一般的比如说404 FIRST_UP_PARENT

6.TCP_REFRESH_MISS

The requested object was cached but STALE. The IMS query returned the new content.

这个请求已经被cache了，但是是旧的。If-Modified-Since请求返回了一个新的内容。