天天看點

linux内網機器通路外網代理設定



摘要: 公司一般出于安全考慮, 在同一區域網路中隻有一台機器可以通路外網,運維進行了整體的限制, 但是在後面的工作中,需要在機器上安裝一些軟體,及指令,是以其他的機器需要通路外網來簡化工作, 但又不能打亂原有運維的設定,是以需要在能通路外網的機器上做個代理。

第一步、二步都是在能通路外網的機器上操作, 第三步是在不能通路外網機器上操作。

1、檢查機器

     在操作中發現通路外網的機器本身不能使用yum 安裝軟體,故需要配置yum安裝源。如果可以的,這步可忽略。

[[email protected] test]# lsb_release -a
LSB Version:    :core-4.0-amd64:core-4.0-ia32:core-4.0-noarch:graphics-4.0-amd64:graphics-4.0-ia32:graphics-4.0-noarch:printing-4.0-amd64:printing-4.0-ia32:printing-4.0-noarch
Distributor ID: RedHatEnterpriseServer
Description:    Red Hat Enterprise Linux Server release 5.7 (Tikanga)
Release:        5.7
Codename:       Tikanga
[[email protected] test]# cd /etc/yum.repos.d/
[[email protected] test]# wget http://mirrors.163.com/.help/CentOS5-Base-163.repo
           
[[email protected] test]# lsb_release -a
LSB Version:    :core-4.0-amd64:core-4.0-ia32:core-4.0-noarch:graphics-4.0-amd64:graphics-4.0-ia32:graphics-4.0-noarch:printing-4.0-amd64:printing-4.0-ia32:printing-4.0-noarch
Distributor ID: RedHatEnterpriseServer
Description:    Red Hat Enterprise Linux Server release 5.7 (Tikanga)
Release:        5.7
Codename:       Tikanga
[[email protected] test]# cd /etc/yum.repos.d/
[[email protected] test]# wget http://mirrors.163.com/.help/CentOS5-Base-163.repo
           

中間 wget 所擷取的檔案,需要将$releasever 修改為 5

# CentOS-Base.repo
#
# The mirror system uses the connecting IP address of the client and the
# update status of each mirror to pick mirrors that are updated to and
# geographically close to the client.  You should use this for CentOS updates
# unless you are manually picking other mirrors.
#
# If the mirrorlist= does not work for you, as a fall back you can try the 
# remarked out baseurl= line instead.
#
#

[base]
name=CentOS-5 - Base - 163.com
baseurl=http://mirrors.163.com/centos/5/os/$basearch/
#mirrorlist=http://mirrorlist.centos.org/?release=5&arch=$basearch&repo=os
gpgcheck=1
gpgkey=http://mirror.centos.org/centos/RPM-GPG-KEY-CentOS-5

#released updates 
[updates]
name=CentOS-5 - Updates - 163.com
baseurl=http://mirrors.163.com/centos/5/updates/$basearch/
#mirrorlist=http://mirrorlist.centos.org/?release=5&arch=$basearch&repo=updates
gpgcheck=1
gpgkey=http://mirror.centos.org/centos/RPM-GPG-KEY-CentOS-5

#packages used/produced in the build but not released
[addons]
name=CentOS-5 - Addons - 163.com
baseurl=http://mirrors.163.com/centos/5/addons/$basearch/
#mirrorlist=http://mirrorlist.centos.org/?release=5&arch=$basearch&repo=addons
gpgcheck=1
gpgkey=http://mirror.centos.org/centos/RPM-GPG-KEY-CentOS-5

#additional packages that may be useful
[extras]
name=CentOS-5 - Extras - 163.com
baseurl=http://mirrors.163.com/centos/5/extras/$basearch/
#mirrorlist=http://mirrorlist.centos.org/?release=5&arch=$basearch&repo=extras
gpgcheck=1
gpgkey=http://mirror.centos.org/centos/RPM-GPG-KEY-CentOS-5

#additional packages that extend functionality of existing packages
[centosplus]
name=CentOS-5 - Plus - 163.com
baseurl=http://mirrors.163.com/centos/5/centosplus/$basearch/
#mirrorlist=http://mirrorlist.centos.org/?release=5&arch=$basearch&repo=centosplus
gpgcheck=1
enabled=0
gpgkey=http://mirror.centos.org/centos/RPM-GPG-KEY-CentOS-5

#contrib - packages by Centos Users
[contrib]
name=CentOS-5 - Contrib - 163.com
baseurl=http://mirrors.163.com/centos/5/contrib/$basearch/
#mirrorlist=http://mirrorlist.centos.org/?release=5&arch=$basearch&repo=contrib
gpgcheck=1
enabled=0
gpgkey=http://mirror.centos.org/centos/RPM-GPG-KEY-CentOS-5
           
# CentOS-Base.repo
#
# The mirror system uses the connecting IP address of the client and the
# update status of each mirror to pick mirrors that are updated to and
# geographically close to the client.  You should use this for CentOS updates
# unless you are manually picking other mirrors.
#
# If the mirrorlist= does not work for you, as a fall back you can try the 
# remarked out baseurl= line instead.
#
#

[base]
name=CentOS-5 - Base - 163.com
baseurl=http://mirrors.163.com/centos/5/os/$basearch/
#mirrorlist=http://mirrorlist.centos.org/?release=5&arch=$basearch&repo=os
gpgcheck=1
gpgkey=http://mirror.centos.org/centos/RPM-GPG-KEY-CentOS-5

#released updates 
[updates]
name=CentOS-5 - Updates - 163.com
baseurl=http://mirrors.163.com/centos/5/updates/$basearch/
#mirrorlist=http://mirrorlist.centos.org/?release=5&arch=$basearch&repo=updates
gpgcheck=1
gpgkey=http://mirror.centos.org/centos/RPM-GPG-KEY-CentOS-5

#packages used/produced in the build but not released
[addons]
name=CentOS-5 - Addons - 163.com
baseurl=http://mirrors.163.com/centos/5/addons/$basearch/
#mirrorlist=http://mirrorlist.centos.org/?release=5&arch=$basearch&repo=addons
gpgcheck=1
gpgkey=http://mirror.centos.org/centos/RPM-GPG-KEY-CentOS-5

#additional packages that may be useful
[extras]
name=CentOS-5 - Extras - 163.com
baseurl=http://mirrors.163.com/centos/5/extras/$basearch/
#mirrorlist=http://mirrorlist.centos.org/?release=5&arch=$basearch&repo=extras
gpgcheck=1
gpgkey=http://mirror.centos.org/centos/RPM-GPG-KEY-CentOS-5

#additional packages that extend functionality of existing packages
[centosplus]
name=CentOS-5 - Plus - 163.com
baseurl=http://mirrors.163.com/centos/5/centosplus/$basearch/
#mirrorlist=http://mirrorlist.centos.org/?release=5&arch=$basearch&repo=centosplus
gpgcheck=1
enabled=0
gpgkey=http://mirror.centos.org/centos/RPM-GPG-KEY-CentOS-5

#contrib - packages by Centos Users
[contrib]
name=CentOS-5 - Contrib - 163.com
baseurl=http://mirrors.163.com/centos/5/contrib/$basearch/
#mirrorlist=http://mirrorlist.centos.org/?release=5&arch=$basearch&repo=contrib
gpgcheck=1
enabled=0
gpgkey=http://mirror.centos.org/centos/RPM-GPG-KEY-CentOS-5
           

  yum clean all  清除原有緩存

  yum list           擷取yum清單

  如果出現清單資料如下這種表示設定成功

sqlite-devel.i386                                                                            3.3.6-7                                                                   base     
sqlite-devel.x86_64                                                                          3.3.6-7                                                                   base     
squashfs-tools.x86_64                                                                        3.0-4                                                                     base     
squirrelmail.noarch                                                                          1.4.8-21.el5.centos                                                       base     
srptools.x86_64                                                                              0.0.4-10.el5                                                              base     
sssd.x86_64                                                                                  1.5.1-70.el5                                                              base     
sssd-client.i386                                                                             1.5.1-70.el5                                                              base     
sssd-client.x86_64                                                                           1.5.1-70.el5                                                              base     
sssd-tools.x86_64                                                                            1.5.1-70.el5                                                              base
           

2、安裝squid

    squid介紹及其簡單配置

    前面準備好yum指令, 可以直接線上安裝

yum install squid
           
yum install squid
           

   安裝完成後, cd  /etc/squid/ 目下, 修改squid.conf 檔案中的内容,修改之前, 可以先備份該檔案:

cp squid.conf squid.conf_bak
           
cp squid.conf squid.conf_bak
           

  然後找到 檔案中的 http_access deny all   将其修改為 http_access allow all  表示所有使用者都可以通路這個代理,

  還有找到  http_port 3128  修改為   http_port 192.168.3.171:3128  這裡的IP及端口是 squid的代理IP及端口,

  該IP是能通路外網機器的IP位址,如果是本機,則可以不用修改該位址, 下面啟動squid 代理

[[email protected] squid]# squid -k parse
[[email protected] squid]# 
[[email protected] squid]# 
[[email protected] squid]# squid -z
2014/07/22 14:43:01| Creating Swap Directories
[[email protected]t squid]# 
[[email protected] squid]# 
[[email protected] squid]# service squid start
Starting squid:                                            [  OK  ]
[[email protected] squid]# 
[[email protected] squid]# 
[[email protected] squid]# 
[[email protected] squid]# netstat -nltp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address               Foreign Address             State       PID/Program name   
tcp        0      0 0.0.0.0:111                 0.0.0.0:*                   LISTEN      4341/portmap        
<span style="color: rgb(255, 0, 0);">tcp        0      0 0.0.0.0:3128                0.0.0.0:*                   LISTEN      22862/(squid)  </span>     
tcp        0      0 0.0.0.0:792                 0.0.0.0:*                   LISTEN      4426/rpc.statd
           

 3、配置不能通路外網的機器代理

   在其他有需要通路外網的内網機器上設定其通路外部網絡的代理機器

export http_proxy=<span style="color: rgb(255, 0, 0);">http://192.168.3.171:3128</span>
           

    export的效力僅及于該此登陸操作,非全局,詳細内容可參考:linux環境變量 export指令詳解

   這樣就可以讓不能通路外部網絡的内網機器通過可以通路外網的機器做為代理通路到外部網絡,來友善安裝一些軟體,指令等操作。

4、測試

     在配置的内網機器上執行:curl www.baidu.com,出現以下内容即通路網絡成功:

[[email protected] ~]$ curl www.baidu.com
<!DOCTYPE html>
<!--STATUS OK--><html> <head><meta http-equiv=content-type content=text/html;charset=utf-8><meta http-equiv=X-UA-Compatible content=IE=Edge>
<meta content=always name=referrer><link rel=stylesheet type=text/css href=http://s1.bdstatic.com/r/www/cache/bdorz/baidu.min.css>
<title>百度一下,你就知道</title></head> <body link=#0000cc> <div id=wrapper> <div id=head> <div class=head_wrapper> 
<div class=s_form> <div class=s_form_wrapper> <div id=lg> <img hidefocus=true src=//www.baidu.com/img/bd_logo1.png width=270 height=129> 
</div> <form id=form name=f action=//www.baidu.com/s class=fm> <input type=hidden name=bdorz_come value=1> 
<input type=hidden name=ie value=utf-8> <input type=hidden name=f value=8> <input type=hidden name=rsv_bp value=1> 
<input type=hidden name=rsv_idx value=1> <input type=hidden name=tn value=baidu><span class="bg s_ipt_wr">
<input id=kw name=wd class=s_ipt value maxlength=255 autocomplete=off autofocus></span><span class="bg s_btn_wr">
<input type=submit id=su value=百度一下 class="bg s_btn"></span> </form> </div> </div> <div id=u1> 
<a href=http://news.baidu.com name=tj_trnews class=mnav>新聞</a> <a href=http://www.hao123.com name=tj_trhao123 class=mnav>hao123</a> 
<a href=http://map.baidu.com name=tj_trmap class=mnav>地圖</a> <a href=http://v.baidu.com name=tj_trvideo class=mnav>視訊</a>...</html>
           

繼續閱讀