1024问

nginx正向代理http和https的实现步骤

Tesia ·
更新时间:2024-09-20
· 862 次阅读

目录

配置准备

nginx版本和正向代理https的模块的对应关系

配置nginx正向代理

解压nginx，解压模块并重命名

安装nginx

使用正向代理https的模块

配置正向代理

创建nginx用户，用来运行nginx

验证正向代理

配置准备

正向代理，指的是通过代理服务器 代理浏览器/客户端去重定向请求访问到目标服务器 的一种代理服务。
正向代理服务的特点是代理服务器 代理的对象是浏览器/客户端，也就是对于目标服务器 来说浏览器/客户端是隐藏的。

nginx默认支持正向代理http，不支持https

nginx官方并不支持直接转发https请求，nginx支持https需要ngx_http_proxy_connect_module模块。github上开源了模块 https://github.com/chobits/ngx_http_proxy_connect_module。不过维护的ngx_http_proxy_connect_module模块的补丁也是有nginx版本限制的（目前维护了1.4.x~1.19.x版本）
可以在REDEME.md的Select patch中查看nginx版本和模块的对应关系

nginx版本和正向代理https的模块的对应关系 nginx versionenable REWRITE phasepatch
1.4.x ~ 1.12.xNOproxy_connect.patch
1.4.x ~ 1.12.xYESproxy_connect_rewrite.patch
1.13.x ~ 1.14.xNOproxy_connect_1014.patch
1.13.x ~ 1.14.xYESproxy_connect_rewrite_1014.patch
1.15.2YESproxy_connect_rewrite_1015.patch
1.15.4 ~ 1.16.xYESproxy_connect_rewrite_101504.patch
1.17.x ~ 1.18.0YESproxy_connect_rewrite_1018.patch
1.19.x ~ 1.21.0YESproxy_connect_rewrite_1018.patch
1.21.1 ~ 1.22.0YESproxy_connect_rewrite_102101.patch
ls /root/ngx_http_proxy_connect_module/patch proxy_connect_1014.patch proxy_connect_rewrite_1015.patch proxy_connect.patch proxy_connect_rewrite_1018.patch proxy_connect_rewrite_1014.patch proxy_connect_rewrite_102101.patch proxy_connect_rewrite_101504.patch proxy_connect_rewrite.patch

github上开源了模块 https://github.com/chobits/ngx_http_proxy_connect_module

此处用的是nginx-1.17.6，对应proxy_connect_rewrite_1018.patch

配置nginx正向代理

下载后上传到服务器

ls ngx_http_proxy_connect_module-master.zip nginx-1.17.6.tar.gz 解压nginx，解压模块并重命名 tar xf nginx-1.17.6.tar.gz unzip ngx_http_proxy_connect_module-master.zip mv ngx_http_proxy_connect_module-master ngx_http_proxy_connect_module ls ngx_http_proxy_connect_module nginx-1.17.6 ngx_http_proxy_connect_module-master.zip nginx-1.17.6.tar.gz 安装nginx

安装源码编译工具包，nginx依赖包

yum -y install make gcc openssl openssl-devel pcre-devel zlib zlib-devel

进入nginx解压后的目录

cd nginx-1.17.6 ./configure make && make install 使用正向代理https的模块

查看nginx-1.17.6对应的https模块的具体位置

ls /root/ngx_http_proxy_connect_module/patch/proxy_connect_rewrite_1018.patch

导入模块，再次编译安装

patch -p1 < /root/ngx_http_proxy_connect_module/patch/proxy_connect_rewrite_1018.patch ./configure --add-module=/root/ngx_http_proxy_connect_module make && make install 配置正向代理

nginx默认安装在/usr/local/nginx/

cd /usr/local/nginx/

修改配置文件

vim conf/nginx.conf

在 #gzip on; 下添加配置

#正向代理转发http请求 server { #指定DNS服务器IP地址 resolver 114.114.114.114; #监听80端口，http默认端口80 listen 80; #服务器IP或域名 server_name localhost; #正向代理转发http请求 location / { proxy_pass http://$host$request_uri; proxy_set_header HOST $host; proxy_buffers 256 4k; proxy_max_temp_file_size 0k; proxy_connect_timeout 30; proxy_send_timeout 60; proxy_read_timeout 60; proxy_next_upstream error timeout invalid_header http_502; } } #正向代理转发https请求 server { #指定DNS服务器IP地址 resolver 114.114.114.114; #监听443端口，https默认端口443 listen 443; #正向代理转发https请求 proxy_connect; proxy_connect_allow 443 563; proxy_connect_connect_timeout 10s; proxy_connect_read_timeout 10s; proxy_connect_send_timeout 10s; location / { proxy_pass http://$host; proxy_set_header Host $host; } }

检查配置文件是否有错误sbin/nginx -t

创建nginx用户，用来运行nginx useradd nginx

启动服务

sbin/nginx 验证正向代理 curl -I http://www.baidu.com/ -v -x 127.0.0.1:80 curl -I https://www.baidu.com/ -v -x 127.0.0.1:443

验证正向代理http 200 ok

curl -I http://www.baidu.com/ -v -x 127.0.0.1:80 * About to connect() to proxy 127.0.0.1 port 80 (#0) *   Trying 127.0.0.1... * Connected to 127.0.0.1 (127.0.0.1) port 80 (#0) > HEAD http://www.baidu.com/ HTTP/1.1 > User-Agent: curl/7.29.0 > Host: www.baidu.com > Accept: */* > Proxy-Connection: Keep-Alive > < HTTP/1.1 200 OK HTTP/1.1 200 OK < Server: nginx/1.17.6 Server: nginx/1.17.6 < Date: Sun, 28 Aug 2022 02:05:33 GMT Date: Sun, 28 Aug 2022 02:05:33 GMT < Content-Type: text/html Content-Type: text/html < Content-Length: 277 Content-Length: 277 < Connection: keep-alive Connection: keep-alive < Accept-Ranges: bytes Accept-Ranges: bytes < Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform < Etag: "575e1f7c-115" Etag: "575e1f7c-115" < Last-Modified: Mon, 13 Jun 2016 02:50:36 GMT Last-Modified: Mon, 13 Jun 2016 02:50:36 GMT < Pragma: no-cache Pragma: no-cache < * Connection #0 to host 127.0.0.1 left intact

验证正向代理https 200 ok

curl -I https://www.baidu.com/ -v -x 127.0.0.1:443 * About to connect() to proxy 127.0.0.1 port 443 (#0) *   Trying 127.0.0.1... * Connected to 127.0.0.1 (127.0.0.1) port 443 (#0) * Establish HTTP proxy tunnel to www.baidu.com:443 > CONNECT www.baidu.com:443 HTTP/1.1 > Host: www.baidu.com:443 > User-Agent: curl/7.29.0 > Proxy-Connection: Keep-Alive > < HTTP/1.1 200 Connection Established HTTP/1.1 200 Connection Established < Proxy-agent: nginx Proxy-agent: nginx < * Proxy replied OK to CONNECT request * Initializing NSS with certpath: sql:/etc/pki/nssdb *   CAfile: /etc/pki/tls/certs/ca-bundle.crt   CApath: none * SSL connection using TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 * Server certificate: *       subject: CN=baidu.com,O="Beijing Baidu Netcom Science Technology Co., Ltd",OU=service operation department,L=beijing,ST=beijing,C=CN *       start date: 7月 05 05:16:02 2022 GMT *       expire date: 8月 06 05:16:01 2023 GMT *       common name: baidu.com *       issuer: CN=GlobalSign RSA OV SSL CA 2018,O=GlobalSign nv-sa,C=BE > HEAD / HTTP/1.1 > User-Agent: curl/7.29.0 > Host: www.baidu.com > Accept: */* > < HTTP/1.1 200 OK HTTP/1.1 200 OK < Accept-Ranges: bytes Accept-Ranges: bytes < Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform < Connection: keep-alive Connection: keep-alive < Content-Length: 277 Content-Length: 277 < Content-Type: text/html Content-Type: text/html < Date: Sun, 28 Aug 2022 02:05:50 GMT Date: Sun, 28 Aug 2022 02:05:50 GMT < Etag: "575e1f7c-115" Etag: "575e1f7c-115" < Last-Modified: Mon, 13 Jun 2016 02:50:36 GMT Last-Modified: Mon, 13 Jun 2016 02:50:36 GMT < Pragma: no-cache Pragma: no-cache < Server: bfe/1.0.8.18 Server: bfe/1.0.8.18 < * Connection #0 to host 127.0.0.1 left intact

到此这篇关于nginx正向代理http和https的实现步骤的文章就介绍到这了,更多相关nginx正向代理http和https内容请搜索软件开发网以前的文章或继续浏览下面的相关文章希望大家以后多多支持软件开发网！



https HTTP Nginx

1024 个赞
编辑 举报
需要 登录 后方可回复, 如果你还没有账号请 注册新账号
相关文章
CSS 边框
Harriet 2021-05-20
595
unix编程创建前缀固定的临时文件代码分享
Alicia 2021-04-20
678
CentOS 7.2配置Apache服务httpd（下）
Bena 2021-01-18
530
nginx正向代理http和https的实现步骤
Tesia 2023-07-21
862
nginx常用操作命令详解
Aggie 2023-07-21
724
Nginx+Tomcat反向代理与负载均衡的实现
Netany 2023-07-22
1239
nginx代理返回代码499问题分析与处理
Octavia 2023-07-22
1019
Nginx配置https过程中出现的问题与解决
Kohana 2023-07-22
1369
详解Nginx如何代理UDP连接
Olathe 2023-07-22
1861
nginx location指令(匹配顺序匹配冲突)实战示例详解
Nafisa 2023-07-22
1688
Docker中部署Nginx并挂载配置文件的实现
Sabah 2023-07-22
460
安装OpenResty(Nginx仓库)
Halima 2023-07-22
1346
强大的Web应⽤服务器OpenResty安装(Nginx仓库)
Rosalia 2023-07-22
362
nginx限制ip访问频率的实现示例
Rhea 2023-08-08
1403
Nginx负载均衡配置实例
Nora 2023-08-08
859
使用nginx.exe时闪退的原因和解决方法
Olivia 2023-08-08
694
nginx开启ws访问和4层负载的编译参数示例
Oria 2023-08-08
1871
linux如何查看nginx启动路径
Gilana 2023-08-08
72
详解如何在Nginx中设置文件上传大小限制
Lala 2023-08-08
940
HTTP全部标准响应状态码整理
Maleah 2023-08-08
424