4. Proxy Server 犖犖朽犢犖犖 Caching
PC
PC
PC
Router Switch
Proxy Server
Modem
202.129.16.238 202.129.48.1
202.129.48.2
202.129.48.10
202.129.48.11
202.129.48.12
Dedicated Line to ISP
EthernetSerial
5. Proxy Server 犖犖朽犢犖犖犖犖園犖 Caching + Gateway
PC PC
PC
Router
Switch
Proxy + Gateway
Server
Modem
202.129.16.238 202.129.48.1
202.129.48.2
Dedicated Line to ISP
EthernetSerial
Switch
202.129.48.5
192.168.1.1
192.168.1.11
192.168.1.12
192.168.1.13
Web Server
Ftp Server
Mail Server
202.129.48.6
202.129.48.7
202.129.48.8
202.129.16.236/30 202.129.48.0/30
202.129.48.4/29
192.168.1.0/24
6. 犖犖о顕犖÷肩犖迦検犖迦牽犖犢犖犖巌犖÷犖犖巌検犖犖犖 Proxy Server
Access List (ACL)
犖犢犖迦見犖犖犖о険犖犢犖о献犖迦犖犖犖迦牽犢犖犖犖迦
犖犖犖犖犢犖о犖犢犖犖犖犖朽犢犖¥犖犖謹犖犖犖萎肩犖犖
犖犖迦検 IP 犖犖犖劇賢 Network 犢犖 犢 犢犖犖犖迦
Transparent Proxy 犖犖劇賢犖犖迦牽犢犖犖犖迦 Internet 犢犖犖∇犖朽犢犖犖犖劇犖犖 Client
犢犖¥犖犖犖犖犖萎犖 IP 犖犖犖 Proxy Server
17. 犖犖園犖犖犖犖犖犖迦牽犖犢犖 Transparent Proxy (犖犖)
2. 犢犖犖犢犖迦犖迦牽犖犖犖犖犖 Proxy Server (Squid) 犢犖犖犖犖犖犖園 Transparent Proxy
犖犖о権犖犖迦牽犢犖犖÷元犖犖迦犖犢犖犖犖朽犖犖∇弦犢犖犢犖犖ワ犖犖犖犖犖
httpd_accel_port 80
httpd_accel_host virtual
httpd_accel_with_proxy on
httpd_accel_uses_host_header on
犖犖÷顕犖∇犖犖犖 犢犖犖犖犖犖朽犖朽 gateway 犢犖¥犢犖 Linux Server 犢犖犖犖犖迦犢犖犖 Router 犖犖園犖о犖
犖犢犖犖犖犖÷元犖犖迦牽犖犖犖犖犖 Router 犖犖園犖犖ワ犖迦硯犖犖犖∇犖犖о犖犖園 Packet 犖犖朽犢犖犖 http 犢犖ム鍵犖÷元
犖犖迦牽犖犖園犖犖園犢犖 Redirect 犢犖犖∇険犖 Proxy Server 犢犖犖犖犖園
18. 犖犖犖犖о牽犖犖巌犖迦牽犖犖迦犖犖犖迦牽犖犢犖 Transparent Proxy
犖犖迦牽犖犢犖 Transparent Proxy 犖犖犖犖÷元犖犖迦牽犢犖犢犖犖犖 DNS 犢犖犖犖園犢犖犖犖劇犖犖 Client 犖犖о権 (犖犖園犖 犢 犖犖朽
犖犖迦牽犢犖犖犖迦 Proxy Server 犢犖犖犖犢犖迦見犖犖犖犖 Server 犢犖犖犢犖¥犖犖犖犖犢犖迦見犖犖犖犖 DNS Server
犢犖犖犖園犢犖犖犖劇犖犖 Client 犖犢犢犖)
犖犖迦犖犖犖劇犖犖 Client 犖犖朽 DNS Server 犢犖犖∇険犖犢犖犖犖劇賢犖犖迦権犖犖迦権犖犖犖 犖犖萎犖犖犖÷元犖犖迦牽犖犢犖 Outbound
NAT 犖犖о権
犢犖犖犖犖犖朽犖朽犖犖犖犖迦牽犢犖 Client 犖犖迦検犖迦牽犖犢犖犖犖犖巌犖迦牽犖犖劇犖 犢 犖犖朽犖犖犖犢犖犖犖劇賢犖犖迦犢犖о犖犖犖о牽犖犖萎犢犖
Outbound NAT + Transparent Proxy
犖犖迦牽犖犢犖 Outbound NAT + Transparent Proxy 犖犖 Proxy 犢犖犖巌 down 犖犢犢犖¥犖犖迦検犖迦牽犖犢犖
犖犖迦犢犖о犖犢犖犢犖犖犖迦鍵犖犖項犖犖園犖犖園犖犖о権犖犢犖迦肩犖園犖 iptables 犢犖犖∇犖¥犖犖犢犖犖э犖 squid 犖犢犖迦犢犖迦犖迦犖犖∇弦
犖犖犖劇賢犢犖¥
19. 犖犖迦牽犖犖犖о犖犖犖犖犖迦牽犢犖犖犖迦 Proxy Server
犖犖迦検犖迦牽犖犖犖犖о犖犖犖犖犖迦牽犢犖犖犖迦 Squid Proxy 犢犖犖犖朽 cache_access_log
犖犖犖 Squid 犖犖謹犖犖犖 Default 犖犖萎賢犖∇弦犖犖朽 /var/log/squid/access.log 犢犖犖
犢犖犖ワ犖犖朽犢犖犢犖犖犖犖÷弦犖 web site 犖犖朽 client 犖o犖犖犖犖
犢犖犖∇犖迦牽犖犖犖о犖犖犖犢犖犢犖犖犢犖迦肩犖園犖 tail 犖犖園犖犖朽
tail f /var/log/squid/access.log
犢犖ム鍵犢犖犖犢犖迦犖犖犖犖犖朽犖犖萎検犖 log file 犖犖朽 2 犢犖犖ワ犖犖劇賢
/var/log/squid/cache.log 犢犖犢犖犖犖犖÷弦犖ム犖園犖о犖犢犖犖朽犖∇硯犖犖園 your caches
behavior
/var/log/squid/store.log //show which objects are ejected from the
cache, and which objects are saved and for how long
21. 犖犖о顕犖÷見犖÷顕犖∇犖迦犢犖犖ワ access.log
TCP_MISS : 犖犖犖÷弦犖ム犖犖犢犖о犖犢犖犖犖犖朽犖∇険犖犢犖¥犖÷元犢犖 cache 犖犖犢犖犖犖犖朽犖犖犖犢犖 GET
犖犖犖÷弦犖ム犖迦 Web Site 犖犖ム顕犖∇犖迦
SINGLE_PAREN : 犖犢犖迦献犖園犖÷元犖犖迦牽犖犖犖犖犖÷弦犖ム犖犖∇険犖 Parent Proxy
TCP_CLIENT_REFRESH_MIS
TCP_IMS_HIT : Proxy 犖犖犖犖犖園犢犖犖犖犖犖÷弦犖ム犖犖¥ 犖犖迦検犖朽犖迦牽
refresh 犖犖犖÷弦犖ム犖朽 client 犖犖園硯 Proxy 犖犖萎犢犖
犖犖迦牽犢犖犖ム犖犖犖÷弦犖ム犖犖¥犖犖迦犢犖о犖犢犖犖犖犖園犖犖
TCP_MEM_HIT
TCP_HIT : 犖÷元犖犖犖÷弦犖ム犖犖犢犖о犖犢犖犖犖犖朽犢犖 cache 犖犖犢犖犖犖犖朽犢犖¥犖犖犖犢犖
犖犖迦硯犖犢犖犖ム犖犖犖劇賢 GET 犖犖犖÷弦犖ム犖迦犢犖о犖犖犖ム顕犖∇犖迦
22. 犖犖迦牽犖犢犖 Access Control Lists 犖犖 Squid
You can limit users' ability to browse the Internet with access control
lists (ACLs).
Each ACL line defines a particular type of activity, such as an access
time or source network, they are then linked to an http_access
statement that tells Squid whether or not to deny or allow traffic that
matches the ACL.
Squid matches each Web access request it receives by checking the
http_access list from top to bottom. If it finds a match, it enforces
the allow or deny statement and stops reading further.
23. The final http_access statement denies everything, so it is best to place
new http_access statements above it
The very last http_access statement in the squid.conf file denies all access.
You therefore have to add your specific permit statements above this line.
In the courses examples, I've suggested that you place your statements at
the top of the http_access list for the sake of manageability, but you can
put them anywhere in the section above that last line.
Squid has a minimum required set of ACL statements in the
ACCESS_CONTROL section of the squid.conf file. It is best to put new
customized entries right after this list to make the file easier to read.
犖犖迦牽犖犢犖 Access Control Lists 犖犖 Squid (犖犖)
28. Restricting Web Access By Time
You can create access control lists with time parameters. For
example, you can allow only business hour access from the home
network.
# Add this to the bottom of the ACL section of squid.conf
acl home_network src 192.168.1.0/24
acl business_hours time M T W H F 9:00-17:00
# Add this at the top of the http_access section of squid.conf
http_access allow home_network business_hours
29. Restricting Web Access By Time (Cont.)
Or, you can allow morning access only:
# Add this to the bottom of the ACL section of squid.conf
acl mornings time 08:00-12:00
# Add this at the top of the http_access section of squid.conf
http_access allow mornings
31. 犖犖迦牽犖犖o犖迦 web page 犢犖犖劇犖犢犖犖犢犖犖劇賢犖犖犢犖迦見犖犖園 web 犖犖犖犖犖迦検
犖犖o犖迦犖犖犖犖о顕犖÷犖犖劇賢犖犢犖犖犖項犢犖犖 HTML 犖犖迦 Editor 犖犖犖劇賢
犢犖犖犢犖犖犖÷肩犢犖迦見犖犖園犖犖o犖迦 Web page
犖犢犖迦犖犖ワ犖犖朽犖犖o犖迦犢犖犖犢犖犢犖犖犖園犢犖犖ワ犖犖朽
/etc/squid/errors/ERR_ACCESS_DENIED
34. 犖犖迦牽犖犢犖 Cache Peer
犢犖犖 parent
A parent cache can get documents from another cache
higher in the hierarchy or from the source, depending
whether it has more parent or neighbor caches in its level.
A parent cache should be used when there are no more
opportunities to get the document from a cache on the
same level.
犢犖犖 sibling
A neighbor (or sibling) cache is one that serves only
documents it already has.
35. 犖犖園硯犖犖犖迦犖犖迦牽犖犢犖 Cache Peer
犖犢犖迦犖犖犖о権犖犖迦牽犖犖犖犖犖犢犖犢犖犖ワ /etc/squid/squid.conf 犖犖謹犖犖÷元犖犖項犢犖犖犖犖園犖犖朽
cache_peer hostname type http_port icp_port 犢犖犖
cache_peer parent.foo.net parent 3128 3130 [proxy-only]
cache_peer sib1.foo.net sibling 3128 3130 [proxy-only]
cache_peer sib2.foo.net sibling 3128 3130 [proxy-only]
[proxy-only] : to specify that objects fecthed from this cache
should not be saved locally
犢犖犖犖劇犖犖犖犖朽犢犖犖 parent 犖犖犖劇賢 sibling 犖犖犖犖犖犖伍犖迦犢犖犖犢犖 cache_peer 犖犖о権
犖犖迦牽犢犖犖犖犖犖o犖 icp_port 犢犖犖 3130 (default) 犖犖迦犖¥犖犖犖伍犖迦犢犖犖犢犖迦見犖犖
icp_port 犢犖犖 0
37. Reverse Proxy Server (犖犖)
In reverse proxy mode, the proxy server functions more like a web server
with respect to the clients it services. Unlike internal clients, external clients
are not preconfigured to access the proxy server. Instead, the site URL
routes the client to the proxy as if it were a web server. Replicated content is
delivered from the proxy cache to the external client without exposing the
origin server or the private network residing safely behind the firewall.
Multiple reverse proxy servers can be used to balance the load on an over-
taxed web server in much the same way.
Reverse proxy servers are commonly used for secure web publishing.
Having a proxy server accepting and filling outside requests allows you to
keep your web server behind the firewall. You can then use the web server
as a protected web site, staging documents for testing before they are
published externally. When you are ready, you can publish selected content
to the reverse proxy server's cache.