yum -y install squid
mkdir -p /var/log/squid/{logs,coredump_dir,cache_dir}
chown squid.squid -R /var/log/squid/
for i in `hostname -I`; do echo tcp_outgoing_address ${i} random_ip;done > /etc/squid/ip.list
systemctl enable squid
cat>/etc/squid/squid.conf<<EOF
acl manager proto cache_object
acl localhost src 127.0.0.1/32 ::1
acl to_localhost dst 127.0.0.0/8 0.0.0.0/32 ::1
#白名单
include /etc/squid/allow.list
acl SSL_ports port 443
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 # https
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl CONNECT method CONNECT
# set out - ip 配置出口IP
#acl localnet src 0.0.0.0/0
acl random_ip random 1/2
acl random_ip random 1/3
acl random_ip random 1/4
acl random_ip random 1/5
acl random_ip random 1/6
acl random_ip random 1/7
acl random_ip random 1/8
acl random_ip random 1/9
acl random_ip random 1/10
acl random_ip random 1/11
acl random_ip random 1/12
acl random_ip random 1/13
acl random_ip random 1/14
acl random_ip random 1/15
acl random_ip random 1/16
acl random_ip random 1/17
acl random_ip random 1/18
acl random_ip random 1/19
acl random_ip random 1/20
server_persistent_connections off
http_access deny manager
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow allowip
http_access deny all
# 设置代理端口
http_port 3228
include /etc/squid/ip.list
dns_nameservers 8.8.8.8
visible_hostname aliserver
request_header_access Via deny all
request_header_access X-Forwarded-For deny all
cache_mem 100 MB
cache_swap_low 90
cache_swap_high 95
cache_dir ufs /var/log/squid/cache_dir 100 16 256
cache_access_log /var/log/squid/logs/access.log
cache_log /var/log/squid/logs/cache.log
cache_store_log /var/log/squid/logs/store.log
coredump_dir /var/log/squid/coredump_dir
pid_filename /var/log/squid/squid.pid
# Add any of your own refresh_pattern entries above these.
refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
refresh_pattern . 0 20% 4320
EOF
添加白名单IP段
addlist(){
echo "acl allowip src $1">> /etc/squid/allow.list
}
addlist 123.456.789.0/24 #添加白名单IP段
需要安装一个openresty或者nginx, 版本大于1.15.10
编译安装参考http://www.kvm.la/1043.html , openresty二进制包版本较低没有更新, 建议编译安装一份.
首先把IPMI的IP丢进一个ip.list的文件里面, 一行一个IP.
#/bin/bash
i=1000 #vnc start port
b=2000
# hextoip() { hex=$1; printf "%d." 0x${hex:0:2}; printf "%d." 0x${hex:2:2}; printf "%d." 0x${hex:4:2}; printf "%d" 0x${hex:6:2}; }
#gethostip -x 10.0.12.1
stream_route_map=/etc/nginx/stream.route.map.conf
http_route_map=/etc/nginx/http.route.map.conf
echo " default 0;" > $stream_route_map
echo " default 0;" > $http_route_map
for IP in `cat /root/ipmi/ip.list | uniq -c |awk '{ print $2 }'`;
do
i=`expr $i + 1` ;
b=`expr $b + 1` ;
HEXIP=`gethostip -x $IP | tr 'A-Z' 'a-z'` ;
echo " ~*($IP|$i|$b|$HEXIP)$ IP<$IP>|VNC<$i>|BMC<$b>|HEX<$HEXIP>;" >>$http_route_map;
echo " ~*($b|$i)$ $IP;" >> $stream_route_map
done
nginx -s reload阅读剩余部分...