Nginx 四层 (stream) 代理exchange2016 的owa,anywhere,ActiveSync等 443端口

环境： 我的Linux是 欧拉系统 24.03  。

 

nginx版本

 

安装常用工具，关闭selinux。

dnf update -y
dnf install -y net-tools lsof wget zip unzip tree vim-enhanced telnet nmap sysstat iotop iftop
setenforce 0
sed -i 's/^SELINUX=enforcing/SELINUX=disabled/' /etc/selinux/config
cat /etc/selinux/config

systemctl enable --now chronyd

 

打开防火墙端口。 

 firewall-cmd --list-all
 firewall-cmd --permanent --add-port={80,443}/tcp
 firewall-cmd --reload

安装nginx

 dnf install -y nginx nginx-mod-stream
 nginx -t
 nginx -v
 nginx -V | grep stream
 nginx -V | grep --withi-stream
 systemctl start nginx
 systemctl enable nginx
 systemctl status nginx

 

全局修改IPV4 连接数和超时时间。 这里一定要修改，不然tcp的长连接容易中断。

 代码是这样，添加这4行 ：

net.ipv4.ip_forward = 1
net.ipv4.tcp_keepalive_time = 300
net.ipv4.tcp_keepalive_intvl = 30
net.ipv4.tcp_keepalive_probes = 3

 

以下是nginx.conf文件代码。

user nginx;
worker_processes auto;
worker_rlimit_nofile 65535;

error_log /var/log/nginx/error.log warn;
pid /run/nginx.pid;

include /usr/share/nginx/modules/*.conf;

events {
    worker_connections 8192;
}

stream {
    log_format exchange_stream
        '$remote_addr [$time_local] '
        '$protocol $status '
        'bytes_sent=$bytes_sent bytes_received=$bytes_received '
        'session_time=$session_time '
        'upstream=$upstream_addr '
        'upstream_connect_time=$upstream_connect_time';

    access_log /var/log/nginx/exchange_stream_access.log exchange_stream;
    error_log  /var/log/nginx/exchange_stream_error.log warn;

    upstream exchange_https {
        least_conn;
        server 192.168.19.13:443 max_fails=10 fail_timeout=30s;
        server 192.168.19.14:443 max_fails=10 fail_timeout=30s;
    }

    server {
        listen 192.168.19.198:443;
        proxy_pass exchange_https;

        proxy_connect_timeout 30s;
        proxy_timeout 1h;

        proxy_next_upstream on;
        proxy_next_upstream_tries 2;
        proxy_next_upstream_timeout 10s;
    }
}

按照这个方式试试。 先观察443端口是否稳定。 如果稳定，再延续到25 110  995  993 等端口，根据实际情况。 以上都是4层代理。并不是 7层代理，7层代理更好。但是因为我用的开源版的nginx，没有主动检查的功能，所以用4层可能更加合适。

优化后的代码； 做了会话保持和异步。

user nginx;
worker_processes auto;
worker_rlimit_nofile 65535;

error_log /var/log/nginx/error.log warn;
pid /run/nginx.pid;

include /usr/share/nginx/modules/*.conf;

events {
    use epoll;
    multi_accept on;
    worker_connections 65535;
}

stream {
    log_format exchange_stream
        '$remote_addr [$time_local] '
        '$protocol $status '
        'bytes_sent=$bytes_sent bytes_received=$bytes_received '
        'session_time=$session_time '
        'upstream=$upstream_addr '
        'upstream_connect_time=$upstream_connect_time';

    access_log /var/log/nginx/exchange_stream_access.log exchange_stream;
    error_log  /var/log/nginx/exchange_stream_error.log warn;

    upstream exchange_https {
        #least_conn;
        hash $remote_addr consistent;
        server 192.168.19.13:443 max_fails=10 fail_timeout=30s;
        server 192.168.19.14:443 max_fails=10 fail_timeout=30s;
    }

    server {
        listen 192.168.19.198:443;
        proxy_pass exchange_https;

        proxy_connect_timeout 30s;
        proxy_timeout 1h;

        proxy_next_upstream on;
        proxy_next_upstream_tries 2;
        proxy_next_upstream_timeout 10s;
    }
}

 

 

因为欧拉系统有个默认日志截断是在凌晨三点，我把改成了每周一次就好了，不用每日。不然截断的时候，outlook跳弹窗。