nginx正向代理http/https和代理邮件服务nginx正向代理https
nginx正向代理http/https和代理邮件服务
在公司内网环境，不能直接连接外网。需要内网服务通过正向代理访问到外网。
nginx本身是不支持https协议请求转发，为了让nginx能达到这一效果需要借助第三方模块ngx_http_proxy_connect_module。首先下载这一模块：https:///chobits/ngx_http_proxy_connect_module
安装介质版本：
pcre-8.38.tar.gz
nginx-1.12.2.tar.gz
ngx_http_proxy_connect_module-master.zip
1.创建nginx账户
# groupadd -g 9996 nginx
# useradd -u 9996 -g 9996 nginx -s /sbin/nologin
2.解压缩
# cd /opt
# tar xf pcre-8.38.tar.gz
# tar xf nginx-1.12.2.tar.gz
# unzip ngx_http_proxy_connect_module-master.zip
3.安装依赖，如果未安装，则安装
# yum install-y gcc gcc-c++ openssl openssl-devel
4.安装pcre
# cd /opt/pcre-8.38
# ./configure --prefix=/usr/local/pcre
# make && make install
5.添加ngx_http_proxy_connect_module模块，切换到nginx解压包目录下
# cd /opt/nginx-1.12.2
# patch -p1 < /opt/ngx_http_proxy_connect_module-master/patch/proxy_connect.patch
6.编译安装nginx
# ./configure --prefix=/etc/nginx1.12.2 --with-http_ssl_module --with-pcre=/opt/pcre-8.38 --add-module=/opt/ngx_http_proxy_connect_module-master --pid-path=/var/run/ --with-mail --with-stream
# make && make install
7.检查安装编译
# /etc/nginx1.12.2/sbin/nginx -V
nginx version: nginx/1.12.2
built by gcc 4.4.7 20120313 (Red Hat 4.4.7-23) (GCC)
built with OpenSSL 1.0.1e-fips 11 Feb 2013
TLS SNI support enabled
configure arguments: --prefix=/etc/nginx1.12.2 --with-http_ssl_module --with-pcre=/opt/pcre-8.38 --add-module=/opt/ngx_http_proxy_connect_module-master --pid-path=/var/run/ --with-mail --with-stream
server {
resolver 114.114.114.114; #DNS解析地址
listen 10080; #监听地址
resolver_timeout 10s; #超时时间
proxy_connect; #启用"连接"http方法支持
proxy_connect_allow 443 563; #代理可以连接的端口
proxy_connect_connect_timeout 10s; #代理连接超时time
proxy_connect_read_timeout 10s;
proxy_connect_send_timeout 10s;
access_log /weblogs/nginx/proxy.access.log;
error_log /weblogs/nginx /proxy.error.log;
location / {
proxy_pass $scheme://$http_host$request_uri;
proxy_set_header Host $http_host;
proxy_buffers 256 4k;
proxy_max_temp_file_size 0;
proxy_connect_timeout 30s;
#allow 127.0.0.1; #ip限制
#deny all ;
}
}
1.在nginx.conf中最后添加stream段
stream{
log_format proxy '$remote_addr [$time_local] '
'$protocol $status $bytes_sent $bytes_received '
'$session_time "$upstream_addr" '
'"$upstream_bytes_sent" "$upstream_bytes_received" "$upstream_connect_time"';
access_log /weblogs/nginx/nginx_proxy.log proxy ;
include vhost/*.stream;
}
备注：stream段的配置要与http段在同级目录，配置文件已.stream结尾
2.添加邮件代理配置
server {
listen 25;
proxy_pass :25;
}
1.代理http/https配置
在/etc/profile添加以下内容
export http_proxy=10.10.11.193:9999
export https_proxy=10.10.11.193:9999
#source /etc/profile
2.测试命令（在客户端）
测试代理http
# curl -I http://www.baidu.com -v -x 10.10.11.93:10080
> Host: www.baidu.com
测试代理https
# curl -I https://www.baidu.com -v -x 10.10.11.93:10080
> Host:
方法1：在客户端/etc/hosts添加解析
方法2：在对应的邮件配置中修改将邮件域名改为正向代理IP