当前位置： 首页 > article >正文

Ubuntu20.04上搭建nginx正向代理提供上网服务

article 2025/3/13 19:15:28

背景：公司很多电脑因软件管控问题不得不禁止设备上网，现需搭建上网代理服务器提供给这些用户使用。

操作系统：ubuntu20.04

工具：nginx-1.25.4

1、下载nginx安装包及依赖

由于nginx默认只持支持转发http协议，所以如果要支持https，还需要增加功能模块ngx_http_proxy_connect_module，所以只能使用源码编译安装

nginx安装包下载地址：Index of /download/，本次下载版本为1.25.4

所需模块下载地址：GitHub - chobits/ngx_http_proxy_connect_module: A forward proxy module for CONNECT request handling

进入github后下载zip包即可

2、将安装包及模块包上传到服务器

执行命令：

tar xf nginx-1.25.4.tar.gz

unzip  ngx_http_proxy_connect_module-master.zip

mv ngx_http_proxy_connect_module-master ngx_http_proxy_connect_module

3、安装模块

cd nginx-1.25.4/

patch -p1 < /opt/ngx_http_proxy_connect_module-master/patch/proxy_connect_rewrite_102101.patch

注意：不同版本的nginx对应不同的patch文件，如下：

因本人下载的1.25.4版本，所以使用102101.patch文件

4、编译安装nginx

root@wms:/opt# ./configure --add-module=/opt/ngx_http_proxy_connect_module --prefix=/etc/nginx
root@wms:/opt# make && make install

5、修改nginx配置文件

注释原server内容，如80端口及location等，做之前先备份一下nginx.conf

如下是修改后的配置文件：

#user  nobody;
worker_processes  1;

#error_log  logs/error.log;
#error_log  logs/error.log  notice;
#error_log  logs/error.log  info;

#pid        logs/nginx.pid;


events {
    worker_connections  1024;
}


http {
    include       mime.types;
    default_type  application/octet-stream;

    #log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
    #                  '$status $body_bytes_sent "$http_referer" '
    #                  '"$http_user_agent" "$http_x_forwarded_for"';

    #access_log  logs/access.log  main;

    sendfile        on;
    #tcp_nopush     on;

    #keepalive_timeout  0;
    keepalive_timeout  65;

    #gzip  on;

#    server {
#        listen       80;
#        server_name  localhost;

        #charset koi8-r;

        #access_log  logs/host.access.log  main;

#        location / {
#            root   html;
#            index  index.html index.htm;
#        }

        #error_page  404              /404.html;

        # redirect server error pages to the static page /50x.html
        #
#        error_page   500 502 503 504  /50x.html;
#        location = /50x.html {
#            root   html;
server {
    listen 8080;  # Nginx 监听端口，客户端需要将代理服务器设置为 http://<nginx_ip>:8080
#    server_name _;  # 泛指所有域名和IP请求

    # DNS 解析器，用于解析客户端请求中的目标域名
    resolver 114.114.114.114 valid=300s;
    resolver_timeout 5s;

    #以下5行为新增模块后，为支持Https而增加的内容
    proxy_connect;
    proxy_connect_allow all;  # 允许代理所有主机
    proxy_connect_connect_timeout 10s;  # 连接到目标服务器的超时时间
    proxy_connect_read_timeout 10s;     # 读取目标服务器响应的超时时间
    proxy_connect_send_timeout 10s;     # 发送请求给目标服务器的超时时间


    # HTTP 请求代理配置
    location / {
        proxy_pass http://$http_host$request_uri;  # 代理请求并转发给客户端请求的目标服务器
        proxy_set_header Host $host;               # 将原始请求中的 Host 保留，传递给目标服务器
        proxy_set_header X-Real-IP $remote_addr;   # 设置客户端真实 IP，传递给目标服务器
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;  # 记录客户端 IP 和代理链信息
        proxy_set_header X-Forwarded-Proto $scheme; # 传递请求协议（HTTP）

        # 设置超时配置
        proxy_connect_timeout 10s;   # 连接到目标服务器的超时时间
        proxy_read_timeout 60s;      # 读取目标服务器响应的超时时间
        proxy_send_timeout 60s;      # 向目标服务器发送请求的超时时间

        # 关闭缓存，实时转发请求和响应
        proxy_buffering off;
    }

    # 自定义错误页面，捕获代理失败的情况
    error_page 500 502 503 504 /50x.html;
    location = /50x.html {
        root /usr/share/nginx/html;  # 错误页面存储位置
    }
}
        }

        # proxy the PHP scripts to Apache listening on 127.0.0.1:80
        #
        #location ~ \.php$ {
        #    proxy_pass   http://127.0.0.1;
        #}

        # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
        #
        #location ~ \.php$ {
        #    root           html;
        #    fastcgi_pass   127.0.0.1:9000;
        #    fastcgi_index  index.php;
        #    fastcgi_param  SCRIPT_FILENAME  /scripts$fastcgi_script_name;
        #    include        fastcgi_params;
        #}

        # deny access to .htaccess files, if Apache's document root
        # concurs with nginx's one
        #
        #location ~ /\.ht {
        #    deny  all;
        #}
#    }


    # another virtual host using mix of IP-, name-, and port-based configuration
    #
    #server {
    #    listen       8000;
    #    listen       somename:8080;
    #    server_name  somename  alias  another.alias;

    #    location / {
    #        root   html;
    #        index  index.html index.htm;
    #    }
    #}


    # HTTPS server
    #
    #server {
    #    listen       443 ssl;
    #    server_name  localhost;

    #    ssl_certificate      cert.pem;
    #    ssl_certificate_key  cert.key;

    #    ssl_session_cache    shared:SSL:1m;
    #    ssl_session_timeout  5m;

    #    ssl_ciphers  HIGH:!aNULL:!MD5;
    #    ssl_prefer_server_ciphers  on;

    #    location / {
    #        root   html;
    #        index  index.html index.htm;
    #    }
    #}

#}

配置完成后可通过命令检查nginx

6、启动nginx

root@wms:/etc/nginx/sbin# ./nginx -t
nginx: the configuration file /etc/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/conf/nginx.conf test is successful
root@wms:/etc/nginx/sbin# ./nginx
检查端口8080存在：
root@wms:/etc/nginx/sbin# netstat -lntup
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 127.0.0.1:6010          0.0.0.0:*               LISTEN      75234/sshd: root@pt
tcp        0      0 127.0.0.53:53           0.0.0.0:*               LISTEN      1458/systemd-resolv
tcp        0      0 127.0.0.1:631           0.0.0.0:*               LISTEN      60662/cupsd
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      1635/sshd: /usr/sbi
tcp        0      0 0.0.0.0:8080            0.0.0.0:*               LISTEN      74457/nginx: master
tcp6       0      0 :::22                   :::*                    LISTEN      1635/sshd: /usr/sbi

7、验证代理是否生效

1、验证http
root@wms:/etc/nginx/sbin# curl http://www.baidu.com -v -x 127.0.0.1:8080
*   Trying 127.0.0.1:8080...
* TCP_NODELAY set
* Connected to 127.0.0.1 (127.0.0.1) port 8080 (#0)
> GET http://www.baidu.com/ HTTP/1.1
> Host: www.baidu.com
> User-Agent: curl/7.68.0
> Accept: */*
> Proxy-Connection: Keep-Alive
>
* Mark bundle as not supporting multiuse
< HTTP/1.1 200 OK
< Server: nginx/1.25.4
< Date: Wed, 12 Feb 2025 07:29:05 GMT
< Content-Type: text/html
< Content-Length: 2381
< Connection: keep-alive
< Accept-Ranges: bytes
< Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform
< Etag: "588604dc-94d"
< Last-Modified: Mon, 23 Jan 2017 13:27:56 GMT
< Pragma: no-cache
< Set-Cookie: BDORZ=27315; max-age=86400; domain=.baidu.com; path=/
<
<!DOCTYPE html>
<!--STATUS OK--><html> <head><meta http-equiv=content-type content=text/html;charset=utf-8><meta http-equiv=X-UA-Compatible content=IE=Edge><meta content=always name=referrer><link rel=stylesheet type=text/css href=http://s1.bdstatic.com/r/www/cache/bdorz/baidu.min.css><title>百度一下，你就知道</title></head> <body link=#0000cc> <div id=wrapper> <div id=head> <div class=head_wrapper> <div class=s_form> <div class=s_form_wrapper> <div id=lg> <img hidefocus=true src=//www.baidu.com/img/bd_logo1.png width=270 height=129> </div> <form id=form name=f action=//www.baidu.com/s class=fm> <input type=hidden name=bdorz_come value=1> <input type=hidden name=ie value=utf-8> <input type=hidden name=f value=8> <input type=hidden name=rsv_bp value=1> <input type=hidden name=rsv_idx value=1> <input type=hidden name=tn value=baidu><span class="bg s_ipt_wr"><input id=kw name=wd class=s_ipt value maxlength=255 autocomplete=off autofocus></span><span class="bg s_btn_wr"><input type=submit id=su value=百度一下 class="bg s_btn"></span> </form> </div> </div> <div id=u1> <a href=http://news.baidu.com name=tj_trnews class=mnav>新闻</a> <a href=http://www.hao123.com name=tj_trhao123 class=mnav>hao123</a> <a href=http://map.baidu.com name=tj_trmap class=mnav>地图</a> <a href=http://v.baidu.com name=tj_trvideo class=mnav>视频</a> <a href=http://tieba.baidu.com name=tj_trtieba class=mnav>贴吧</a> <noscript> <a href=http://www.baidu.com/bdorz/login.gif?login&amp;tpl=mn&amp;u=http%3A%2F%2Fwww.baidu.com%2f%3fbdorz_come%3d1 name=tj_login class=lb>登录</a> </noscript> <script>document.write('<a href="http://www.baidu.com/bdorz/login.gif?login&tpl=mn&u='+ encodeURIComponent(window.location.href+ (window.location.search === "" ? "?" : "&")+ "bdorz_come=1")+ '" name="tj_login" class="lb">登录</a>');</script> <a href=//www.baidu.com/more/ name=tj_briicon class=bri style="display: block;">更多产品</a> </div> </div> </div> <div id=ftCon> <div id=ftConw> <p id=lh> <a href=http://home.baidu.com>关于百度</a> <a href=http://ir.baidu.com>About Baidu</a> </p> <p id=cp>&copy;2017&nbsp;Baidu&nbsp;<a href=http://www.baidu.com/duty/>使用百度前必读</a>&nbsp; <a href=http://jianyi.baidu.com/ class=cp-feedback>意见反馈</a>&nbsp;京ICP证030173号&nbsp; <img src=//www.baidu.com/img/gs.gif> </p> </div> </div> </div> </body> </html>
* Connection #0 to host 127.0.0.1 left intact

2、验证https
root@wms:/etc/nginx/conf# curl https://www.baidu.com -v -x 127.0.0.1:8080
*   Trying 127.0.0.1:8080...
* TCP_NODELAY set
* Connected to 127.0.0.1 (127.0.0.1) port 8080 (#0)
* allocate connect buffer!
* Establish HTTP proxy tunnel to www.baidu.com:443
> CONNECT www.baidu.com:443 HTTP/1.1
> Host: www.baidu.com:443
> User-Agent: curl/7.68.0
> Proxy-Connection: Keep-Alive
>
< HTTP/1.1 200 Connection Established
< Proxy-agent: nginx
<
* Proxy replied 200 to CONNECT request
* CONNECT phase completed!
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/certs/ca-certificates.crt
  CApath: /etc/ssl/certs
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* CONNECT phase completed!
* CONNECT phase completed!
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.2 (OUT), TLS handshake, Finished (20):
* TLSv1.2 (IN), TLS handshake, Finished (20):
* SSL connection using TLSv1.2 / ECDHE-RSA-AES128-GCM-SHA256
* ALPN, server accepted to use http/1.1
* Server certificate:
*  subject: C=CN; ST=beijing; L=beijing; O=Beijing Baidu Netcom Science Technology Co., Ltd; CN=baidu.com
*  start date: Jul  8 01:41:02 2024 GMT
*  expire date: Aug  9 01:41:01 2025 GMT
*  subjectAltName: host "www.baidu.com" matched cert's "*.baidu.com"
*  issuer: C=BE; O=GlobalSign nv-sa; CN=GlobalSign RSA OV SSL CA 2018
*  SSL certificate verify ok.
> GET / HTTP/1.1
> Host: www.baidu.com
> User-Agent: curl/7.68.0
> Accept: */*
>
* Mark bundle as not supporting multiuse
< HTTP/1.1 200 OK
< Accept-Ranges: bytes
< Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform
< Connection: keep-alive
< Content-Length: 2443
< Content-Type: text/html
< Date: Wed, 12 Feb 2025 07:40:38 GMT
< Etag: "58860401-98b"
< Last-Modified: Mon, 23 Jan 2017 13:24:17 GMT
< Pragma: no-cache
< Server: bfe/1.0.8.18
< Set-Cookie: BDORZ=27315; max-age=86400; domain=.baidu.com; path=/
<
<!DOCTYPE html>
<!--STATUS OK--><html> <head><meta http-equiv=content-type content=text/html;charset=utf-8><meta http-equiv=X-UA-Compatible content=IE=Edge><meta content=always name=referrer><link rel=stylesheet type=text/css href=https://ss1.bdstatic.com/5eN1bjq8AAUYm2zgoY3K/r/www/cache/bdorz/baidu.min.css><title>百度一下，你就知道</title></head> <body link=#0000cc> <div id=wrapper> <div id=head> <div class=head_wrapper> <div class=s_form> <div class=s_form_wrapper> <div id=lg> <img hidefocus=true src=//www.baidu.com/img/bd_logo1.png width=270 height=129> </div> <form id=form name=f action=//www.baidu.com/s class=fm> <input type=hidden name=bdorz_come value=1> <input type=hidden name=ie value=utf-8> <input type=hidden name=f value=8> <input type=hidden name=rsv_bp value=1> <input type=hidden name=rsv_idx value=1> <input type=hidden name=tn value=baidu><span class="bg s_ipt_wr"><input id=kw name=wd class=s_ipt value maxlength=255 autocomplete=off autofocus=autofocus></span><span class="bg s_btn_wr"><input type=submit id=su value=百度一下 class="bg s_btn" autofocus></span> </form> </div> </div> <div id=u1> <a href=http://news.baidu.com name=tj_trnews class=mnav>新闻</a> <a href=https://www.hao123.com name=tj_trhao123 class=mnav>hao123</a> <a href=http://map.baidu.com name=tj_trmap class=mnav>地图</a> <a href=http://v.baidu.com name=tj_trvideo class=mnav>视频</a> <a href=http://tieba.baidu.com name=tj_trtieba class=mnav>贴吧</a> <noscript> <a href=http://www.baidu.com/bdorz/login.gif?login&amp;tpl=mn&amp;u=http%3A%2F%2Fwww.baidu.com%2f%3fbdorz_come%3d1 name=tj_login class=lb>登录</a> </noscript> <script>document.write('<a href="http://www.baidu.com/bdorz/login.gif?login&tpl=mn&u='+ encodeURIComponent(window.location.href+ (window.location.search === "" ? "?" : "&")+ "bdorz_come=1")+ '" name="tj_login" class="lb">登录</a>');
                </script> <a href=//www.baidu.com/more/ name=tj_briicon class=bri style="display: block;">更多产品</a> </div> </div> </div> <div id=ftCon> <div id=ftConw> <p id=lh> <a href=http://home.baidu.com>关于百度</a> <a href=http://ir.baidu.com>About Baidu</a> </p> <p id=cp>&copy;2017&nbsp;Baidu&nbsp;<a href=http://www.baidu.com/duty/>使用百度前必读</a>&nbsp; <a href=http://jianyi.baidu.com/ class=cp-feedback>意见反馈</a>&nbsp;京ICP证030173号&nbsp; <img src=//www.baidu.com/img/gs.gif> </p> </div> </div> </div> </body> </html>
* Connection #0 to host 127.0.0.1 left intact

8、本地计算机配置代理

设置好后，可查看代理服务器上的访问日志来确认代理是否生效

参考文章：

NGINX的日常使用之如何编译安装并且配置正向代理_重新编译nginx支持代理-CSDN博客

在服务器上（ubuntu）在使用nginx搭建正向代理访问网页_ubuntu nginx 正向代理-CSDN博客


http://www.kler.cn/a/545262.html

相关文章：

  • rdian是一个结构体，pdian=^Rdian，list泛型做什么用？
  • Android 消息总站 设计思路
  • 修改RAGFlow在docker desktop中的容器名
  • 《刚刚问世》系列初窥篇-Java+Playwright自动化测试-22- 操作鼠标拖拽 - 下篇（详细教程）
  • QT:Button
  • 布隆过滤器（简单介绍）
  • Pro Git --(Windows)总结
  • DeepSeek整理PDF文档以思维导图方式展示
  • TOML介绍
  • Spring Boot（8）深入理解 @Autowired 注解：使用场景与实战示例
  • QML使用ChartView绘制饼状图
  • 从 0 到 1 搭建个人博客：技术选型与实现全解析
  • Java 大视界 -- 边缘计算与 Java 大数据协同发展的前景与挑战（85）
  • Spring Boot 配置JPA数据库主从读写分离失败及解决办法
  • mapbox 从入门到精通 - 目录
  • 股指期货和etf期权哪个更好交易？
  • SSE与Websocket详解，SSE实现对话框流式输出
  • fastadmin 接口请求提示跨域
  • vscode快捷键——MAC
  • 126，【2】攻防世界unseping