CentOS 作为服务端配置squid代理 + 作为客户端 socker5 代理上网
CentOS7 作为客户端 socker5 代理上网
Linux貌似默认不支持直接使用socks代理,使用privoxy将socks5转换为http代理
yum install -y privoxy
# 追击 代理ip 端口号
cat >>/etc/privoxy/config<<EOF
forward-socks5t / 172.16.0.254:1080 .
EOF
# 追击 到环境变量内
cat >>/etc/profile<<EOF
export all_proxy=http://127.0.0.1:8118
export http_proxy=http://127.0.0.1:8118
export https_proxy=http://127.0.0.1:8118
EOF
source /etc/profile
systemctl start privoxy
systemctl enable privoxy
curl ifconfig.io
# 查看结果
取消 http,https 代理
unset http_proxy
unset https_proxy
作为服务端配置squid代理
server端
IP：192.168.10.100 172.16.0.100
yum install -y squid
systemctl enable squid
systemctl start squid
netstat -lntup
不需要设置配置文件
clent端
只要和server端口处于一个网段下，均可使用代理地址
设置代理 IP 3128 即可通过代理服务器发出请求
squid 先定义规则，然后加载规则，类似静态路由 ，一定要把加载的规则 放到拒绝所有的前面
例子2 服务端 定义acl 访问控制列表 禁止IP访问
acl Safe_ports port 777 # multiling http
acl CONNECT method CONNECT
# 自定义 指定源IP禁止访问代理
acl badhost src 192.168.0.127
=============================================
# Recommended minimum Access Permission configuration:
#
# Deny requests to certain unsafe ports
http_access deny !Safe_ports
# Deny CONNECT to other than secure SSL ports
http_access deny CONNECT !SSL_ports
# Only allow cachemgr access from localhost
http_access allow localhost manager
http_access deny manager
# We strongly recommend the following be uncommented to protect innocent
# web applications running on the proxy server who think the only
# one who can access services on "localhost" is a local user
#http_access deny to_localhost
#
# INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS
#
# Example rule allowing access from your local networks.
# Adapt localnet in the ACL section to list your (internal) IP networks
# from where browsing should be allowed
http_access deny badhost # 要在放行所有本地IP的规则前面 拒绝
====================================================================================
http_access allow localnet
http_access allow localhost
# And finally deny all other access to this proxy
http_access deny all
案例2 禁止工作时间访问代理
acl Safe_ports port 777 # multiling http
acl CONNECT method CONNECT
# 自定义 工作时间 周一到周五的9点-17点
acl worktime time MTWHF 9:00-17:00
=============================================
# Recommended minimum Access Permission configuration:
#
# Deny requests to certain unsafe ports
http_access deny !Safe_ports
# Deny CONNECT to other than secure SSL ports
http_access deny CONNECT !SSL_ports
# Only allow cachemgr access from localhost
http_access allow localhost manager
http_access deny manager
# We strongly recommend the following be uncommented to protect innocent
# web applications running on the proxy server who think the only
# one who can access services on "localhost" is a local user
#http_access deny to_localhost
#
# INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS
#
# Example rule allowing access from your local networks.
# Adapt localnet in the ACL section to list your (internal) IP networks
# from where browsing should be allowed
http_access deny worktime # 上面的定义了工作时间 拒绝了工作时间上网
http_access deny !worktime # 上面的定义了工作时间 加！ 就是拒绝了非工作时间上网
====================================================================================
http_access allow localnet
http_access allow localhost
# And finally deny all other access to this proxy
http_access deny all
例子 4 禁止 访问目标固定IP 域名 , IP段访问域名
acl baddst dst 223.5.5.5
http_access deny baddst
acl baddst dstdomain .taobao.com .jd.com
http_access deny baddst
acl staff src 192.168.0.100-192.168.0.200
acl unbus baddstdomain .taobao.com .jd.com
http_access deny staff unbus
例子5 禁止访问目标 域名 以及 域名的IP地址
acl baddst dstdomain .taobao.com .jd.com
# 正则匹配规则 IP
acl xhost dstdom_regex ((25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])\.){3}(25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])
# 0.0.0.0 -- 255.255.255.255
http_access deny xhost baddst
例子 6 用户认证
密码文件
yum install -y httpd-tools
cd /etc/squid
htpasswd -c passwd user
======
auth_param basic program /usr/lib64/squid/basic_ncsa_auth /etc/squid/passwd
# 认证程序 认证的密码文件
auth_param basic children 10
# 允许的线程数
auth_param basic realm NEED PASSWD
# 弹窗的提示信息
acl authuser proxy_auth REQUIRED
# 设置一个使用代理的模式 密码登录模式
http_access allow authuser
# 设置放行 acl 登录账户密码 才能使用代理 ，放到拒绝所有的前面
http_access allow localnet
# 还要把localnet 本地的网段的IP 注销 ，这样所有IP 都能使用 用户名登录
# Deny requests to certain unsafe ports
http_access allow !Safe_ports
# Deny CONNECT to other than secure SSL ports
http_access allow CONNECT !SSL_ports
过proxifier的test
linux 如何使用 账户密码验证的代理
全局代理
vim /etc/profile
export http_proxy="http://test:123456@192.168.10.159:3128"
export https_proxy="http://test:123456@192.168.10.159:3128"
透明代理（一般使用openwrt 加密）
https://space.bilibili.com/586684152
浙公网安备 33010602011771号