nginx正向代理http和https的实现步骤

对国足恨铁不成钢

配置准备

正向代理，指的是通过代理服务器 代理浏览器/客户端去重定向请求访问到目标服务器 的一种代理服务。
正向代理服务的特点是代理服务器 代理的对象是浏览器/客户端，也就是对于目标服务器 来说浏览器/客户端是隐藏的。
nginx默认支持正向代理http，不支持https
nginx官方并不支持直接转发https请求，nginx支持https需要ngx_http_proxy_connect_module模块。github上开源了模块 https://github.com/chobits/ngx_http_proxy_connect_module。不过维护的ngx_http_proxy_connect_module模块的补丁也是有nginx版本限制的（目前维护了1.4.x~1.19.x版本）
可以在REDEME.md的Select patch中查看nginx版本和模块的对应关系

nginx版本和正向代理https的模块的对应关系

nginx versionenable REWRITE phasepatch1.4.x ~ 1.12.xNOproxy_connect.patch1.4.x ~ 1.12.xYESproxy_connect_rewrite.patch1.13.x ~ 1.14.xNOproxy_connect_1014.patch1.13.x ~ 1.14.xYESproxy_connect_rewrite_1014.patch1.15.2YESproxy_connect_rewrite_1015.patch1.15.4 ~ 1.16.xYESproxy_connect_rewrite_101504.patch1.17.x ~ 1.18.0YESproxy_connect_rewrite_1018.patch1.19.x ~ 1.21.0YESproxy_connect_rewrite_1018.patch1.21.1 ~ 1.22.0YESproxy_connect_rewrite_102101.patch

1. ls /root/ngx_http_proxy_connect_module/patch
   
2. proxy_connect_1014.patch            proxy_connect_rewrite_1015.patch
   
3. proxy_connect.patch                 proxy_connect_rewrite_1018.patch
   
4. proxy_connect_rewrite_1014.patch    proxy_connect_rewrite_102101.patch
   
5. proxy_connect_rewrite_101504.patch  proxy_connect_rewrite.patch

复制代码

github上开源了模块 https://github.com/chobits/ngx_http_proxy_connect_module

此处用的是nginx-1.17.6，对应proxy_connect_rewrite_1018.patch

配置nginx正向代理

下载后上传到服务器

1. ls
   
2. ngx_http_proxy_connect_module-master.zip    nginx-1.17.6.tar.gz

复制代码

解压nginx，解压模块并重命名

1. tar xf nginx-1.17.6.tar.gz
   
2. unzip ngx_http_proxy_connect_module-master.zip
   
3. mv ngx_http_proxy_connect_module-master ngx_http_proxy_connect_module
   
4. ls
   
5. ngx_http_proxy_connect_module    nginx-1.17.6         ngx_http_proxy_connect_module-master.zip
   
6. nginx-1.17.6.tar.gz

复制代码

安装nginx

安装源码编译工具包，nginx依赖包

1. yum -y install make gcc openssl openssl-devel pcre-devel zlib zlib-devel

复制代码

进入nginx解压后的目录

1. cd nginx-1.17.6
   
2. ./configure
   
3. make && make install

复制代码

使用正向代理https的模块

查看nginx-1.17.6对应的https模块的具体位置

1. ls /root/ngx_http_proxy_connect_module/patch/proxy_connect_rewrite_1018.patch

复制代码

导入模块，再次编译安装

1. patch -p1 < /root/ngx_http_proxy_connect_module/patch/proxy_connect_rewrite_1018.patch
   
2. ./configure --add-module=/root/ngx_http_proxy_connect_module
   
3. make && make install

复制代码

配置正向代理

nginx默认安装在/usr/local/nginx/

1. cd /usr/local/nginx/

复制代码

修改配置文件

1. vim conf/nginx.conf   

复制代码

在 #gzip on; 下添加配置

1. #正向代理转发http请求
   
2. server {
   
3.     #指定DNS服务器IP地址
   
4.     resolver 114.114.114.114;
   
5.     #监听80端口，http默认端口80
   
6.     listen 80;
   
7.     #服务器IP或域名
   
8.         server_name  localhost;
   
9.     #正向代理转发http请求
   
10.     location / {
    
11.         proxy_pass                 http://$host$request_uri;
    
12.         proxy_set_header           HOST $host;
    
13.         proxy_buffers              256 4k;
    
14.         proxy_max_temp_file_size   0k;
    
15.         proxy_connect_timeout      30;
    
16.         proxy_send_timeout         60;
    
17.         proxy_read_timeout         60;
    
18.         proxy_next_upstream error  timeout invalid_header http_502;
    
19.     }
    
20. }
    
21. #正向代理转发https请求
    
22. server {
    
23.     #指定DNS服务器IP地址
    
24.     resolver 114.114.114.114;
    
25.     #监听443端口，https默认端口443
    
26.     listen 443;
    
27.    #正向代理转发https请求
    
28.    proxy_connect;
    
29.    proxy_connect_allow            443 563;
    
30.    proxy_connect_connect_timeout  10s;
    
31.    proxy_connect_read_timeout     10s;
    
32.    proxy_connect_send_timeout     10s;
    
33.    location / {
    
34.         proxy_pass http://$host;
    
35.         proxy_set_header Host $host;
    
36.    }
    
37. }

复制代码

检查配置文件是否有错误sbin/nginx -t

创建nginx用户，用来运行nginx

1. useradd nginx

复制代码

启动服务

1. sbin/nginx

复制代码

验证正向代理

1. curl -I http://www.baidu.com/ -v -x 127.0.0.1:80
   
2. curl -I https://www.baidu.com/ -v -x 127.0.0.1:443

复制代码

验证正向代理http 200 ok

1. curl -I http://www.baidu.com/ -v -x 127.0.0.1:80
   
2. * About to connect() to proxy 127.0.0.1 port 80 (#0)
   
3. *   Trying 127.0.0.1...
   
4. * Connected to 127.0.0.1 (127.0.0.1) port 80 (#0)
   
5. > HEAD http://www.baidu.com/ HTTP/1.1
   
6. > User-Agent: curl/7.29.0
   
7. > Host: www.baidu.com
   
8. > Accept: */*
   
9. > Proxy-Connection: Keep-Alive
   
10. >
    
11. < HTTP/1.1 200 OK
    
12. HTTP/1.1 200 OK
    
13. < Server: nginx/1.17.6
    
14. Server: nginx/1.17.6
    
15. < Date: Sun, 28 Aug 2022 02:05:33 GMT
    
16. Date: Sun, 28 Aug 2022 02:05:33 GMT
    
17. < Content-Type: text/html
    
18. Content-Type: text/html
    
19. < Content-Length: 277
    
20. Content-Length: 277
    
21. < Connection: keep-alive
    
22. Connection: keep-alive
    
23. < Accept-Ranges: bytes
    
24. Accept-Ranges: bytes
    
25. < Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform
    
26. Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform
    
27. < Etag: "575e1f7c-115"
    
28. Etag: "575e1f7c-115"
    
29. < Last-Modified: Mon, 13 Jun 2016 02:50:36 GMT
    
30. Last-Modified: Mon, 13 Jun 2016 02:50:36 GMT
    
31. < Pragma: no-cache
    
32. Pragma: no-cache
    
33. <
    
34. * Connection #0 to host 127.0.0.1 left intact

复制代码

验证正向代理https 200 ok

1. curl -I https://www.baidu.com/ -v -x 127.0.0.1:443
   
2. * About to connect() to proxy 127.0.0.1 port 443 (#0)
   
3. *   Trying 127.0.0.1...
   
4. * Connected to 127.0.0.1 (127.0.0.1) port 443 (#0)
   
5. * Establish HTTP proxy tunnel to www.baidu.com:443
   
6. > CONNECT www.baidu.com:443 HTTP/1.1
   
7. > Host: www.baidu.com:443
   
8. > User-Agent: curl/7.29.0
   
9. > Proxy-Connection: Keep-Alive
   
10. >
    
11. < HTTP/1.1 200 Connection Established
    
12. HTTP/1.1 200 Connection Established
    
13. < Proxy-agent: nginx
    
14. Proxy-agent: nginx
    
15. <
    
16. * Proxy replied OK to CONNECT request
    
17. * Initializing NSS with certpath: sql:/etc/pki/nssdb
    
18. *   CAfile: /etc/pki/tls/certs/ca-bundle.crt
    
19.   CApath: none
    
20. * SSL connection using TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
    
21. * Server certificate:
    
22. *       subject: CN=baidu.com,O="Beijing Baidu Netcom Science Technology Co., Ltd",OU=service operation department,L=beijing,ST=beijing,C=CN
    
23. *       start date: 7月 05 05:16:02 2022 GMT
    
24. *       expire date: 8月 06 05:16:01 2023 GMT
    
25. *       common name: baidu.com
    
26. *       issuer: CN=GlobalSign RSA OV SSL CA 2018,O=GlobalSign nv-sa,C=BE
    
27. > HEAD / HTTP/1.1
    
28. > User-Agent: curl/7.29.0
    
29. > Host: www.baidu.com
    
30. > Accept: */*
    
31. >
    
32. < HTTP/1.1 200 OK
    
33. HTTP/1.1 200 OK
    
34. < Accept-Ranges: bytes
    
35. Accept-Ranges: bytes
    
36. < Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform
    
37. Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform
    
38. < Connection: keep-alive
    
39. Connection: keep-alive
    
40. < Content-Length: 277
    
41. Content-Length: 277
    
42. < Content-Type: text/html
    
43. Content-Type: text/html
    
44. < Date: Sun, 28 Aug 2022 02:05:50 GMT
    
45. Date: Sun, 28 Aug 2022 02:05:50 GMT
    
46. < Etag: "575e1f7c-115"
    
47. Etag: "575e1f7c-115"
    
48. < Last-Modified: Mon, 13 Jun 2016 02:50:36 GMT
    
49. Last-Modified: Mon, 13 Jun 2016 02:50:36 GMT
    
50. < Pragma: no-cache
    
51. Pragma: no-cache
    
52. < Server: bfe/1.0.8.18
    
53. Server: bfe/1.0.8.18
    
54. <
    
55. * Connection #0 to host 127.0.0.1 left intact

复制代码

到此这篇关于nginx正向代理http和https的实现步骤的文章就介绍到这了,更多相关nginx正向代理http和https内容请搜索脚本之家以前的文章或继续浏览下面的相关文章希望大家以后多多支持脚本之家！

来源:https://www.jb51.net/server/2915732k2.htm
免责声明：由于采集信息均来自互联网，如果侵犯了您的权益，请联系我们【E-Mail:cb@itdo.tech】 我们会及时删除侵权内容，谢谢合作！