模板
教程
環境
性能
功能
管理
FreeBsd5.4+pf+squid反向代理實戰筆記
1、硬件配置
HP NETSERVER 800 PⅢ1000 內存256M Inter82559網卡兩張
2、分區情況
Filesystem Size Used Avail Capacity Mounted on
/dev/da0s1a 248M 54M 174M 24% /
devfs 1.0K 1.0K 0B 100% /dev
/dev/da0s1f 4.8G 130M 4.3G 3% /home
/dev/da0s1d 248M 12K 228M 0% /tmp
/dev/da0s1g 4.8G 565M 3.9G 12% /usr
/dev/da0s1e 5.8G 410K 5.3G 0% /var
3、系統安裝情況
采用最小化安裝
并且安裝src和ports（原本打算采用ports安裝，但是不知道怎么搞的，竟然不能cvs源碼，當然也就不能通過ports安裝，無奈之下只能采用源碼編譯）
4、內核編譯
沒有對內核采用優化，這里只是為了驗證pf和squid結合做反向代理的可行性，在實際的生產應用中應該對服務器內核做一定程度的優化。
cp GENERIC cache
編輯內核cache在內核中添加如下選項
device pflog
device pfsync
options ALTQ
options ALTQ_CBQ
編譯內核
cd ../config/cache
make depend
make
make install
至此內核編譯完畢
5、讓系統自動加載pf
編輯/etc/rc.conf
defaultrouter="218.4.xxx.xxx"
hostname="cache.aaa.com"
ifconfig_fxp0="inet 218.4.xxx.xxx netmask 255.255.255.248"
ifconfig_fxp1="inet 192.168.2.10 netmask 255.255.255.0"
gateway_enable="YES"
inetd_enable="YES"
pf_enable="YES"
pf_rules="/etc/pf.conf"
pf_flags=""
pflog_enable="YES"
pflog_logfile="/var/log/pflog"
sshd_enable="YES"
6、打開ip轉發
在/etc/sysctl.conf中添加如下內容
7、實現共享上網，最簡單的pf設置
lan_if="fxp1"
inter_net="192.168.2.0/24"
web_server="192.168.2.3"
ftp_server="192.168.2.3"
scrub in all
nat on $wan_if from $inter_net to any -> fxp0
rdr on fxp1 proto tcp from $lan_if to any port 80 -> $lan_if port 80
rdr on fxp1 proto tcp from any to any port 21 -> 127.0.0.1 port 8021
#rdr on fxp0 proto tcp from any to $wan_if port 80 ->$web_server port 8080
#rdr on fxp1 proto tcp from $lan_if to $wan_if port 80 ->$web_server port 8080
rdr on $wan_if proto tcp from any to any port 21 -> $ftp_server port 21
rdr on $wan_if proto tcp from any to any port 49152:65535 -> $ftp_server port 49152:65535
# in on $wan_if
pass in quick on $wan_if proto tcp from any to $ftp_server port 21 keep state
pass in quick on $wan_if proto tcp from any to $ftp_server port > 49151 keep state
# out on $lan_if
pass out quick on $lan_if proto tcp from any to $ftp_server port 21 keep state
pass out quick on $lan_if proto tcp from any to $ftp_server port > 49151 keep state
#Disable danger port
#Danger_Port="{445 135 139 593 5554 9995 9996}"
#block quick on $wan_if inet proto tcp from any to any port $Danger_Port
#block quick on $wan_if inet proto tcp from any to any port $Danger_Port
pass in all
pass out all
（最后這兩條在實際的應用中是不可靠的，應該先限制所有，然后逐步打開自己需要的服務）
pf的設置到此基本完畢
下面開始squid部分
1、安裝squid
--enable-referer-log
--enable-default-err-language=Simplify_Chinese
--enable-err-languages="Simplify_Chinese English"
--disable-internal-dns
--enable-pf-transparent
#make
#make install
#mkdir /home/cache(創建存放cache的目錄)
2、增加squid運行的用戶和用戶組（我的都設為squid）
ee /usr/local/squid/etc/squid.conf
在/etc/hosts中加入內部的DNS解析，比如我的：
192.168.2.3 mail.aaa.com
3、下面開始配置squid.conf文件（下面是我的配置文件）
cache_dir ufs /home/cache 1024 16 256
cache_mem 100 MB
cache_effective_user squid
cache_effective_group squid
http_port 80
httpd_aclearcase/" target="_blank" >ccel_host virtual
httpd_accel_single_host off
httpd_accel_port 80
httpd_accel_uses_host_header on
httpd_accel_with_proxy on
# accelerater my domain only
acl acceleratedHostA dstdomain . example1.com
#acl acceleratedHostB dstdomain .example2.com
#acl acceleratedHostC dstdomain .example3.com
# accelerater http protocol on port 80
acl acceleratedProtocol protocol HTTP
acl acceleratedPort port 80
# access arc
acl all src 0.0.0.0/0.0.0.0
# Allow requests when they are to the accelerated machine AND to the
# right port with right protocol
http_access allow acceleratedProtocol acceleratedPort acceleratedHostA
#http_access allow acceleratedProtocol acceleratedPort acceleratedHostB
#http_access allow acceleratedProtocol acceleratedPort acceleratedHostC
# logging
emulate_httpd_log on
cache_store_log none
# manager
acl manager proto cache_object
http_access allow manager all
cachemgr_passwd pass all
squid.conf文件配置完成
4、目錄權限設置
創建日志文件，默認的在/usr/local/squid/var/access.log
5、創建緩存目錄：
啟動squid
在這個筆記中我的構建意圖是
web服務通過squid反向代理來完成
至于其他（我現在只有ftp）服務則通過pf來完成
那么為了完成這個目標我們還需要在pf規則中添加如下語句
（$lan_if是我網關機的內網卡）凡是對80端口的訪問，都統統轉發到網關上Squid偵聽端口80，而在pf規則中只允許ftp服務通過（疑問是外網訪問呢，是否也需要添加類似的這句呢）
至此，FreeBsd5.4+pf+squid反向代理基本完成。
