1、反向代理
在打算机网络中，反向代理是一种代理做事器，代表客户端从一个或多个做事器检索资源。然后将这些资源返回给客户机，就像它们源自Web做事器本身一样。与正向代理相反，正向代理是与其关联的客户端联系任何做事器的中介，反向代理是任何客户端与其关联的做事器进行联系的中介。
有关正向代理可参考：基于CentOS 7配置Nginx正向代理
2、本演示中的几个做事器
二、常规反向代理配置
1、后端做事器配置(Apache)
后端Apache做事器主机名及IP
# hostnamecentos7-web.example.com# more /etc/redhat-releaseCentOS Linux release 7.2.1511 (Core)# ip addr|grep inet|grep globalinet 172.24.8.128/24 brd 172.24.8.255 scope global eno16777728# systemctl start httpd.service# echo \公众This is a httpd test page.\"大众>/var/www/html/index.html# curl http://localhostThis is a httpd test page.
2、前端Nginx反向代理做事器配置
前端Nginx做事器主机名及IP
# hostnamecentos7-router# more /etc/redhat-releaseCentOS Linux release 7.2.1511 (Core)# ip addr |grep inet|grep globalinet 172.24.8.254/24 brd 172.24.8.255 scope global eno16777728inet 192.168.1.175/24 brd 192.168.1.255 scope global dynamic eno33554960
Nginx版本
# nginx -Vnginx version: nginx/1.10.2
添加一个新的配置文件用作反向代理
# vim /etc/nginx/conf.d/reverse_proxy.confserver {listen 8090;server_name localhost;location / {proxy_pass http://172.24.8.128; ###反向代理核心指令proxy_buffers 256 4k;proxy_max_temp_file_size 0;proxy_connect_timeout 30;proxy_cache_valid 200 302 10m;proxy_cache_valid 301 1h;proxy_cache_valid any 1m;}}# systemctl reload nginx# ss -nltp|grep nginx|grep 8090LISTEN 0 128 :8090 : users:((\"大众nginx\公众,pid=78023,fd=8),(\"大众nginx\公众,pid=78021,fd=8))# curl http://localhost:8090 ##基于本地测试This is a httpd test page.
查看Apache做事器日志
# more /var/log/httpd/access_log ##要求IP地址为172.24.8.254，当从其他机器要求时也是172.24.8.254这个IP172.24.8.254 - - [30/Oct/2017:14:02:38 +0800] \公众GET / HTTP/1.0\"大众 200 27 \公众-\公众 \"大众curl/7.29.0\"大众
3、反向代理做事器及后端做事器日志格式设置
为Nginx做事器添加proxy_set_header指令，修正后如下
# grep proxy_set_header -B2 /etc/nginx/conf.d/reverse_proxy.conflocation / {proxy_pass http://172.24.8.128;proxy_set_header X-Real-IP $remote_addr;}# systemctl reload nginx.service
后端做事器Apache日志格式设置
# vim /etc/http/conf/httpd.conf# LogFormat \"大众%h %l %u %t \\"大众%r\\公众 %>s %b \\"大众%{Referer}i\\"大众 \\公众%{User-Agent}i\\公众\"大众 combined #注释此行，添加下一行LogFormat \"大众%{X-Real-IP}i %l %u %t \\"大众%r\\"大众 %>s %b \\"大众%{Referer}i\\公众 \\"大众%{User-Agent}i\\公众\"大众 combined #关键描述 {X-Real-IP}i# ip addr|grep inet|grep global #从1.132主机访问inet 192.168.1.244/24 brd 192.168.1.255 scope global eth0# curl http://192.168.1.175:8090 #从1.244主机访问This is a httpd test page#再次查看apache访问日志，如下，不再是代理做事器IP地址，此时显示为1.244192.168.1.244 - - [30/Oct/2017:15:49:07 +0800] \"大众GET / HTTP/1.0\"大众 200 27 \"大众-\"大众 \公众curl/7.19.7 (x86_64-redhat-linux-gnu)libcurl/7.19.7 NSS/3.14.0.0 zlib/1.2.3 libidn/1.18 libssh2/1.4.2\公众
二、基于目录匹配反向代理
后端做事器采取Nginx的配置
# more /etc/redhat-release ##os平台及ip地址CentOS release 6.7 (Final)# ip addr|grep eth0|grep globalinet 192.168.1.132/24 brd 192.168.1.255 scope global eth0# nginx -v ##nginx版本nginx version: nginx/1.10.2# mkdir -pv /usr/share/nginx/html/images ##创建图片目录mkdir: created directory `/usr/share/nginx/html/images'# cp /usr/share/backgrounds/nature/.jpg /usr/share/nginx/html/images/. ##复制图片文件# cp /etc/nginx/conf.d/default.conf /etc/nginx/conf.d/default.conf.bk# vim /etc/nginx/conf.d/default.conf ##此处直接修正缺省配置文件server {listen 80 default_server;listen [::]:80 default_server;server_name _;root /usr/share/nginx/html;# Load configuration files for the default server block.include /etc/nginx/default.d/.conf;location / {}location /images {alias /usr/share/nginx/html/images; ##此处配置了别名}error_page 404 /404.html;location = /40x.html {}error_page 500 502 503 504 /50x.html;location = /50x.html {}}# /etc/init.d/nginx reloadReloading nginx: [ OK ]
前端Nginx配置
# vim /etc/nginx/conf.d/reverse_proxy.confserver {listen 8090;server_name localhost;location / {proxy_pass http://172.24.8.128;proxy_set_header X-Real-IP $remote_addr;}location /images { ##将images目录下的文件代理至192.168.1.132proxy_pass http://192.168.1.132;proxy_set_header X-Real-IP $remote_addr;}}# systemctl reload nginx
验证代理情形，在ip为192.168.1.244测试对images目录下的jpg文件要求
# ip addr|grep inet|grep globalinet 192.168.1.244/24 brd 192.168.1.255 scope global eth0# curl -I http://192.168.1.175:8090/images/Garden.jpgHTTP/1.1 200 OKServer: nginx/1.12.2Date: Tue, 31 Oct 2017 01:48:18 GMTContent-Type: image/jpegContent-Length: 264831Connection: keep-aliveLast-Modified: Mon, 30 Oct 2017 08:21:28 GMTETag: \公众59f6e108-40a7f\"大众Accept-Ranges: bytes
三、基于特定文件类型的反向代理配置
php做事器端配置(ip 192.168.1.132)
# ss -nltp|grep phpLISTEN 0 128 192.168.1.132:9000 : users:((\"大众php-fpm\公众,7147,8),(\"大众php-fpm\"大众,7148,0),(\"大众php-fpm\"大众,7149,0))# mkdir -pv /data ###存放php代码# echo \公众/data 192.168.1.0/24(rw)\公众 >/etc/exports# /etc/init.d/rpcbind start# /etc/init.d/nfslock start# /etc/init.d/nfs start# echo \公众< ?php phpinfo();?>\"大众 > /data/index.php
Nginx代理端配置(ip 192.168.1.175)
# mkdir /data# mount -t nfs 192.168.1.132:/data /data# ls /dataindex.php# vim /etc/nginx/conf.d/reverse_proxy.confserver {listen 8090;server_name localhost;location / {proxy_pass http://172.24.8.128;proxy_set_header X-Real-IP $remote_addr;}location /images {proxy_pass http://192.168.1.132;proxy_set_header X-Real-IP $remote_addr;}location ~ \.php$ {root /data;fastcgi_pass 192.168.1.132:9000;fastcgi_index index.php;fastcgi_param SCRIPT_FILENAME /scripts$fastcgi_script_name;include fastcgi_params;}}# systemctl restart nginx
测试反向代理至php
[root@ydq05 ~]# ip addr|grep inet|grep globalinet 192.168.1.244/24 brd 192.168.1.255 scope global eth0[root@ydq05 ~]# curl -I http://192.168.1.175:8090/index.phpHTTP/1.1 200 OKServer: nginx/1.12.2Date: Tue, 31 Oct 2017 03:22:59 GMTContent-Type: text/html; charset=UTF-8Connection: keep-aliveX-Powered-By: PHP/5.6.0
四、基于upstream 配置反向代理至tomcat
Nginx upstream指令也可以将要求代理到后端做事器 如下示例，结合upstream指令演示将其代理到tomcat
# vim /etc/nginx/conf.d/tomcat.confupstream app {server localhost:8080;keepalive 32;}server {listen 80;server_name localhost;location / {proxy_set_header Host $host;proxy_set_header x-for $remote_addr;proxy_set_header x-server $host;proxy_set_header x-agent $http_user_agent;proxy_pass http://app;}}[root@node132 conf.d]# ss -nltp|grep javaLISTEN 0 1 ::ffff:127.0.0.1:8005 ::: users:((\"大众java\"大众,39559,45))LISTEN 0 100 :::8009 ::: users:((\"大众java\"大众,39559,43))LISTEN 0 100 :::8080 ::: users:((\公众java\"大众,39559,42))tomcat版本[root@node132 conf.d]# /usr/local/tomcat/bin/catalina.sh versionUsing CATALINA_BASE: /usr/local/tomcatUsing CATALINA_HOME: /usr/local/tomcat....Server version: Apache Tomcat/7.0.69Server built: Apr 11 2016 07:57:09 UTCServer number: 7.0.69.0OS Name: LinuxOS Version: 2.6.32-573.el6.x86_64Architecture: amd64JVM Version: 1.7.0_79-b15JVM Vendor: Oracle Corporation验证结果# curl http://localhost< !DOCTYPE html>......
五、proxy模块指令描述
proxy模块的可用配置指令非常多，它们分别用于定义proxy模块事情时的诸多属性，如连接超时时长、代理时利用http协议版本等。下面对常用的指令做一个大略解释。
proxy_connect_timeout nginx将一个要求发送至upstream server之前等待的最大时长；
proxy_cookie_domain 将upstream server通过Set-Cookie首部设定的domain属性修正为指定的值，其值可以为一个字符串、正则表达式的模式或一个引用的变量；
proxy_cookie_path 将upstream server通过Set-Cookie首部设定的path属性修正为指定的值，其值可以为一个字符串、正则表达式的模式或一个引用的变量；
proxy_hide_header 设定发送给客户真个报文中须要隐蔽的首部；
proxy_pass 指定将要求代理至upstream server的URL路径；
proxy_set_header 将发送至upsream server的报文的某首部进行重写；
proxy_redirect 重写location并刷新从upstream server收到的报文的首部；
proxy_send_timeout 在连接断开之前两次发送至upstream server的写操作的最大间隔时长；
proxy_read_timeout 在连接断开之前两次从吸收upstream server吸收读操作的最大间隔时长；
如下面的一个示例：
proxy_redirect off;proxy_set_header Host $host;proxy_set_header X-Real-IP $remote_addr;proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;client_max_body_size 10m;client_body_buffer_size 128k;proxy_connect_timeout 30;proxy_send_timeout 15;proxy_read_timeout 15;
