免费注册 查看新帖 |

Chinaunix

  平台 论坛 博客 文库
最近访问板块 发新帖
查看: 2972 | 回复: 3

[proxy] (原创)freebsd5.4+pf+oops实现透明代理试验笔记 [复制链接]

论坛徽章:
0
发表于 2006-04-27 18:14 |显示全部楼层
freebsd5.4+pf+oops实现透明代理试验笔记
作者 硬-盘
20060427

more /etc/rc.conf
defaultrouter="218.75.x.x"
gateway_enable="YES"
hostname="firewall.test.com"
ifconfig_fxp0="inet 218.75.y.y netmask 255.255.255.128"
ifconfig_fxp1="inet 192.168.0.1 netmask 255.255.255.192"
ifconfig_fxp1_alias0="inet 192.168.1.62 netmask 255.255.255.192"
ifconfig_fxp1_alias1="inet 192.168.2.62 netmask 255.255.255.192"
ifconfig_fxp1_alias2="inet 192.168.3.62 netmask 255.255.255.192"
sshd_enable="YES"
pf_enable="YES"
pflog_enable="YES"
pflog_logfile="/var/log/pflog"
sendmail_enable="NONE"
ntpdate_enable="YES" # Run ntpdate to sync time on boot (or NO).
ntpdate_flags="207.46.232.189" # time.windows.com
oops_enable="yes"

more /etc/pf.conf
#firewall by tds 20050601

#macros
wanif="fxp0"
lanif="fxp1"
oops="127.0.0.1"
tcpsrv="{22,113}"
lan0="{192.168.0.0/26}"
lan1="{192.168.2.0/26}"
lan3="{192.168.3.0/26}"
lan4="{192.168.1.0/26}"
ftpsrv="192.168.0.8"
bt1="192.168.0.38"
bt2="192.168.0.39"
noroute="{127.0.0.0/8,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16}"

#options
set block-policy return
set loginterface $wanif
set optimization aggressive

#scrub
scrub in all

#nat and rdr
nat on $wanif from $lan0 to any -> $wanif
nat on $wanif from $lan1 to any -> $wanif
nat on $wanif from $lan3 to any -> $wanif
nat on $wanif from $lan4 to any -> $wanif

rdr on $lanif proto tcp from any to any port 80 -> $oops port 3128
rdr on $wanif proto tcp from any to any port 21 -> $ftpsrv
rdr on $wanif proto tcp from any to any port 18888 -> $bt2
rdr on $wanif proto tcp from any to any port 4662 -> $bt2
rdr on $wanif proto udp from any to any port 4672 -> $bt2
rdr on $wanif proto tcp from any to any port 3389 -> $bt2
rdr on $wanif proto tcp from any to any port 3388 -> $bt1 port 3389

#filter rules
block all
block drop in quick on $wanif from $noroute
block drop out quick on $wanif from any to $noroute
block drop out quick on $wanif from any to 202.103.67.53
pass quick on lo0 all
pass in quick on $lanif from $lanif:network to any keep state
pass out quick on $lanif from any to $lanif:network keep state

pass in quick on $wanif proto tcp from any to $wanif port $tcpsrv flags S/SA keep state
pass in quick on $wanif proto tcp from any to $ftpsrv port 21 flags S/SA keep state
pass in quick on $wanif proto tcp from any to $bt2 port {3389,4662,18888} flags S/SA keep state
pass in quick on $wanif proto tcp from any to $bt1 port 3389 flags S/SA keep state
pass in quick on $wanif proto udp from any to $bt2 port 4672 keep state
pass out on $wanif proto tcp all flags S/SA keep state
pass out on $wanif proto {udp,icmp} all keep state

more /usr/local/etc/oops/oops.cfg
只记录修改部分
nameserver 127.0.0.1
nameserver 220.168.208.3
nameserver 220.168.208.6

http_port 3128
#icp_port 3130
userid oops

logfile /var/log/oops/oops.log { 3 1m } unbuffered
accesslog /var/log/oops/access.log { 3 1m } unbuffered
pidfile /var/run/oops/oops.pid
statistics /var/run/oops/oops_statfile
mem_max 128m
lo_mark 80m
disk-low-free 3
disk-ok-free 5

force_http11
force_completion 85
maxresident 1m
insert_x_forwarded_for no
insert_via no
always_check_freshness


group mynet {
##
# You can describe group ip adresses here, or using src_ip acl's
# with networks_acl directive.
# networks_acl always have higher preference (checked first) and
# are checked in the order of appearance.
# If host wil not fall in any networks_acl - we check in networks.
# networks are ordered by masklen - longest masks(most specific networks)
# are checked first.
##
networks 192.168/16 127/8 ;
redir_mods transparent;(添加此行实现透明代理)
# networks_acl LOCAL_NETWORKS !BAD_NETWORKS ;
badports [0:79],110,138,139,513,[6000:6010] ;
miss allow;

module transparent { (实现透明代理)
# myport can have next form:
# myport [{hostname|ip_addr}:]port ...
myport 3128
# broken_browsers MSIE
}

storage {
path /usr/local/oops/storages/oops_storage ;
# Size of the storage. Can be in bytes or 'auto'. Auto is
# usefull for pre-created storages or disk slices.
# NOTE: 'size auto' won't work for Linux on disk slices.
# To use large ( > 2G ) files run configure with --enable-large-files

size 200m ; (磁盘高速缓存)

安装过程
1, cd /usr/ports/www/oops/
make config 选中
[X] DB4 Berkeley DB v4 storage
make install clean
2, 修改/usr/local/etc/oops/oops.cfg
3,cd /usr/local/sbin/
oops -z -c /usr/local/etc/oops/oops.cfg (创建其磁盘高速缓存)
4,vi /etc/rc.conf加入oops_enable="yes"
5,reboot

###本文基本实现oops+pf实现透明代理,oops其他认证,带宽管理登都没用上
在此贴出,以起抛砖引玉作用,肯请用过oops的大侠指教!谢谢。
参考文章
高性能、多线程的高速Web代理服务器--OOPS!
2005-08-24 10:00 am
作者:linux宝库 (http://www.linuxmine.com)
来自:linux宝库 (http://www.linuxmine.com)
现存:http://www.linuxmine.com/2668.html
联系:linuxmine#gmail.com

一些其他问题:

1,oops需要什么配置的机器工作良好
2,缓存大小该怎么配置
谢谢。

论坛徽章:
0
发表于 2006-05-02 00:08 |显示全部楼层
无论实现的结果如何(我能力有限),我必须加你精华!!!!

论坛徽章:
0
发表于 2007-01-31 16:55 |显示全部楼层
学习中

论坛徽章:
0
发表于 2007-05-15 01:08 |显示全部楼层
学习!!!!!!!
您需要登录后才可以回帖 登录 | 注册

本版积分规则 发表回复

SACC2019中国系统架构师大会

【数字转型 架构演进】SACC2019中国系统架构师大会,8.5折限时优惠重磅来袭!
2019年10月31日~11月2日第11届中国系统架构师大会(SACC2019)将在北京隆重召开。四大主线并行的演讲模式,1个主会场、20个技术专场、超千人参与的会议规模,100+来自互联网、金融、制造业、电商等领域的嘉宾阵容,将为广大参会者提供一场最具价值的技术交流盛会。

限时8.5折扣期:2019年9月30日前


----------------------------------------

大会官网>>
  

北京盛拓优讯信息技术有限公司. 版权所有 16024965号-6 北京市公安局海淀分局网监中心备案编号:11010802020122
中国互联网协会会员  联系我们:huangweiwei@it168.com
感谢所有关心和支持过ChinaUnix的朋友们 转载本站内容请注明原作者名及出处

清除 Cookies - ChinaUnix - Archiver - WAP - TOP