Squid正向代理实战

博客园 - 尹正杰

Categraf使用指南 window系统部署Claude Code实战 N9E集群部署 Ubuntu 24.04 LTS部署Codex实战 aiops运维平台从0到1部署实战 aiops平台环境部署 TKE集群LoadBalancer映射案例 k8s集群为每个节点分配不通的ippool实战 ansible剧本实现一键升级K8S集群的NVIDIA GPU驱动 vmagent采集etcd数据并写入victoriametrics集群 VictoriaMetrics集群部署实战 kubespray生产故障案例之kubelet启动参数案例 filebeat指定名称空间采集pod数据 Calico自定义Ipool实战 ansible剧本实现kibana的部署和卸载 ansible剧本应用案例集合2 ansible剧本实现磁盘格式化 Ansible急速入门实战篇 ansible快速入门篇 k8s集群管理 kubesray实战 kubespray实战案例 kubespray管理k8s的worker集群扩缩容 kubespray快速部署k8s集群实战 Kubeasz使用吐槽博客专题 Kubeasz基于ezctl实现etcd集群的管理实战 Kubeasz基于ezctl实现k8s集群一键升级 Calico启用纯BGP模式+RR实战案例 Calico 底层原理及IPIP（依赖BGP协议）)和vxlan（不依赖BGP）工作模式切换 kubeasz基于ezctl实现k8s集群的扩容和缩容

Squid正向代理实战

尹正杰 · 2026-06-29 · via 博客园 - 尹正杰

　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　作者：尹正杰

一.环境准备
- 1.背景说明
- 2.实验环境准备
二.Squid基于IP地址放行案例
三.基于源IP和目标域名限制
- 1.编写Squid规则
- 2.测试验证
四.限制基于源IP和多个目标IP的限制
五.基于源IP和多个目标IP及域名的配置

一.环境准备

1.背景说明

我们生产环境有2000台物理服务器不允许上外网，但是对于个别站点的确时需要去临时访问外网的，比如下载系统软件包之类的。


于是我就想到2016年用到的一个技术Squid，现在忘记的也差不多了。也是就是边学便用。顺便记个笔记。


关于Squid我就不多费口舌了，凡是能看这篇文章的，说明你根本就不是小白。

2.实验环境准备

我现在有一台服务器，故意没有配置网关，然后他就无法上网。

[root@master231 ~]# curl -I  https://www.baidu.com 
curl: (6) Could not resolve host: www.baidu.com
[root@master231 ~]# 
[root@master231 ~]# curl -I  https://www.cnblogs.com/yinzhengjie
curl: (6) Could not resolve host: www.cnblogs.com
[root@master231 ~]#

二.Squid基于IP地址放行案例

1.安装Squid

[root@ansible99 ~]# apt -y install squid

2.配置Squid

  1.修改配置文件
[root@ansible99 ~]# cat  /etc/squid/squid.conf
visible_hostname ansible99

# 监听端口
http_port 3128

# 缓存目录
cache_dir ufs /var/spool/squid 1024 16 256
cache_mem 256 MB

# 1. IP白名单：允许客户端网段 10.0.0.0/24、192.168.1.0/24
acl white_list src 10.0.0.0/24 192.168.1.0/24

# 2. 域名白名单：仅允许访问百度系域名
acl allow_site dstdomain .baidu.com

# 放行规则：IP在白名单 并且 访问百度域名，才允许代理
http_access allow white_list allow_site

# 其余全部拒绝
http_access deny all

# 日志
access_log /var/log/squid/access.log squid
cache_log /var/log/squid/cache.log
[root@ansible99 ~]# 


  2.解析语法是否正确
[root@ansible99 ~]# squid -k parse
2026/06/29 23:45:54| Processing Configuration File: /etc/squid/squid.conf (depth 0)
2026/06/29 23:45:54| Processing: visible_hostname ansible99
2026/06/29 23:45:54| Processing: http_port 3128
2026/06/29 23:45:54| Processing: cache_dir ufs /var/spool/squid 1024 16 256
2026/06/29 23:45:54| Processing: cache_mem 256 MB
2026/06/29 23:45:54| Processing: acl white_list src 10.0.0.0/24 192.168.1.0/24
2026/06/29 23:45:54| Processing: http_access allow white_list
2026/06/29 23:45:54| Processing: http_access deny all
2026/06/29 23:45:54| Processing: access_log /var/log/squid/access.log squid
2026/06/29 23:45:54| Processing: cache_log /var/log/squid/cache.log
[root@ansible99 ~]# 
[root@ansible99 ~]# 


  3.热加载配置
[root@ansible99 ~]# squid -k reconfigure
2026/06/29 23:46:22| Processing Configuration File: /etc/squid/squid.conf (depth 0)
2026/06/29 23:46:22| Current Directory is /root
[root@ansible99 ~]#

3.测试验证

[root@master231 ~]# curl -x http://10.0.0.99:3128 -I https://www.baidu.com
HTTP/1.1 200 Connection established

HTTP/1.1 200 OK
Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform
Content-Length: 0
Content-Type: text/html
Pragma: no-cache
Server: bfe
Date: Mon, 29 Jun 2026 15:46:53 GMT

[root@master231 ~]# 
[root@master231 ~]# curl -x http://10.0.0.99:3128 -I https://www.cnblogs.com/yinzhengjie
HTTP/1.1 200 Connection established

HTTP/2 200 
date: Mon, 29 Jun 2026 15:46:56 GMT
content-type: text/html; charset=utf-8
vary: Accept-Encoding
cache-control: no-cache, no-store
pragma: no-cache
set-cookie: .AspNetCore.Antiforgery.b8-pDmTq1XM=CfDJ8OBZrxGJLy5MvghieKIKXCzVBZqSBmHPSQhbIVLAw6xSiSnWg0FiQSBbwmyfrvbyplAqXz3R6EF4cV1-B6fWTFnyqSGghkzksK7JHEygMjAhsScIGHMl1n86VqCTSdhuYISXJTcSDj4QLhXzeRu_138; path=/; httponly
strict-transport-security: max-age=2592000; includeSubDomains; preload
x-frame-options: SAMEORIGIN

[root@master231 ~]#

三.基于源IP和目标域名限制

1.编写Squid规则

  1.编写二配置文件
[root@ansible99 ~]# cat  /etc/squid/squid.conf
visible_hostname ansible99

# 监听端口
http_port 3128

# 缓存目录
cache_dir ufs /var/spool/squid 1024 16 256
cache_mem 256 MB

# 1. IP白名单：允许客户端网段 10.0.0.0/24、192.168.1.0/24
acl white_list src 10.0.0.0/24 192.168.1.0/24

# 2. 域名白名单：仅允许访问百度系域名
acl allow_site dstdomain .baidu.com

# 放行规则：IP在白名单 并且 访问百度域名，才允许代理
http_access allow white_list allow_site

# 其余全部拒绝
http_access deny all

# 日志
access_log /var/log/squid/access.log squid
cache_log /var/log/squid/cache.log
[root@ansible99 ~]# 

  2.检查语法
[root@ansible99 ~]# squid -k parse
2026/06/29 23:50:34| Processing Configuration File: /etc/squid/squid.conf (depth 0)
2026/06/29 23:50:34| Processing: visible_hostname ansible99
2026/06/29 23:50:34| Processing: http_port 3128
2026/06/29 23:50:34| Processing: cache_dir ufs /var/spool/squid 1024 16 256
2026/06/29 23:50:34| Processing: cache_mem 256 MB
2026/06/29 23:50:34| Processing: acl white_list src 10.0.0.0/24 192.168.1.0/24
2026/06/29 23:50:34| Processing: acl allow_site dstdomain .baidu.com
2026/06/29 23:50:34| Processing: http_access allow white_list allow_site
2026/06/29 23:50:34| Processing: http_access deny all
2026/06/29 23:50:34| Processing: access_log /var/log/squid/access.log squid
2026/06/29 23:50:34| Processing: cache_log /var/log/squid/cache.log
[root@ansible99 ~]# 

  3.热加载配置
[root@ansible99 ~]# squid -k reconfigure
2026/06/29 23:50:38| Processing Configuration File: /etc/squid/squid.conf (depth 0)
2026/06/29 23:50:38| Current Directory is /root
[root@ansible99 ~]# 
[root@ansible99 ~]#

2.测试验证

[root@master231 ~]# curl -x http://10.0.0.99:3128 -I https://www.baidu.com
HTTP/1.1 200 Connection established

HTTP/1.1 200 OK
Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform
Content-Length: 0
Content-Type: text/html
Pragma: no-cache
Server: bfe
Date: Mon, 29 Jun 2026 15:51:42 GMT

[root@master231 ~]# 
[root@master231 ~]# curl -x http://10.0.0.99:3128 -I https://www.cnblogs.com/yinzhengjie
HTTP/1.1 403 Forbidden
Server: squid/6.14
Mime-Version: 1.0
Date: Mon, 29 Jun 2026 15:51:44 GMT
Content-Type: text/html;charset=utf-8
Content-Length: 3067
X-Squid-Error: ERR_ACCESS_DENIED 0
Vary: Accept-Language
Content-Language: en
Cache-Status: ansible99
Via: 1.1 ansible99 (squid/6.14)
Connection: keep-alive

curl: (56) CONNECT tunnel failed, response 403
[root@master231 ~]# 
[root@master231 ~]# 
[root@master231 ~]# curl -x http://10.0.0.99:3128 https://www.cnblogs.com/yinzhengjie
curl: (56) CONNECT tunnel failed, response 403
[root@master231 ~]#

四.限制基于源IP和多个目标IP的限制

1.测试百度的公网IP地址

[root@ansible99 ~]# ping baidu.com
PING baidu.com (110.242.74.102) 56(84) bytes of data.
64 bytes from 110.242.74.102: icmp_seq=1 ttl=128 time=56.4 ms
^C
--- baidu.com ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 56.439/56.439/56.439/0.000 ms
[root@ansible99 ~]# 
[root@ansible99 ~]# ping baidu.com
PING baidu.com (124.237.177.164) 56(84) bytes of data.
64 bytes from 124.237.177.164: icmp_seq=1 ttl=128 time=54.5 ms
^C
--- baidu.com ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 54.542/54.542/54.542/0.000 ms
[root@ansible99 ~]# 
[root@ansible99 ~]# 
[root@ansible99 ~]# ping baidu.com
PING baidu.com (111.63.65.247) 56(84) bytes of data.
64 bytes from 111.63.65.247: icmp_seq=1 ttl=128 time=47.0 ms
64 bytes from 111.63.65.247: icmp_seq=2 ttl=128 time=42.6 ms
^C
--- baidu.com ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1002ms
rtt min/avg/max/mdev = 42.575/44.766/46.958/2.191 ms
[root@ansible99 ~]# 

看到了3个有效的IP：
  - 110.242.74.102
  - 124.237.177.164
  - 111.63.65.247

2.编写Squid

  1.编写Squid配置文件
[root@ansible99 ~]# cat /etc/squid/squid.conf
visible_hostname ansible99
http_port 3128

cache_dir ufs /var/spool/squid 1024 16 256
cache_mem 256 MB

# 目标白名单：仅放行 111.63.65.247 和 110.242.74.102
acl allow_target dst 111.63.65.247 110.242.74.102

# 放行规则：只允许访问上面指定IP
http_access allow allow_target

# 其余所有目标全部拒绝
http_access deny all

access_log /var/log/squid/access.log squid
cache_log /var/log/squid/cache.log
[root@ansible99 ~]# 

  2.热加载配置
[root@ansible99 ~]# squid -k reconfigure
2026/06/30 00:02:56| Processing Configuration File: /etc/squid/squid.conf (depth 0)
2026/06/30 00:02:56| Current Directory is /root
[root@ansible99 ~]#

3.测试验证

[root@master231 ~]# curl -x http://10.0.0.99:3128 -I 111.63.65.247
HTTP/1.1 301 Moved Permanently
Location: https://www.baidu.com/
Date: Mon, 29 Jun 2026 16:00:17 GMT
Content-Type: text/plain; charset=utf-8
Cache-Status: ansible99;fwd=stale;detail=match
Via: 1.1 ansible99 (squid/6.14)
Connection: keep-alive

[root@master231 ~]# 
[root@master231 ~]# curl -x http://10.0.0.99:3128 -I 110.242.74.102
HTTP/1.1 301 Moved Permanently
Location: https://www.baidu.com/
Date: Mon, 29 Jun 2026 16:03:01 GMT
Content-Type: text/plain; charset=utf-8
Cache-Status: ansible99;detail=mismatch
Via: 1.1 ansible99 (squid/6.14)
Connection: keep-alive

[root@master231 ~]# 
[root@master231 ~]# curl -x http://10.0.0.99:3128 -I 124.237.177.164
HTTP/1.1 403 Forbidden
Server: squid/6.14
Mime-Version: 1.0
Date: Mon, 29 Jun 2026 16:00:53 GMT
Content-Type: text/html;charset=utf-8
Content-Length: 3063
X-Squid-Error: ERR_ACCESS_DENIED 0
Vary: Accept-Language
Content-Language: en
Cache-Status: ansible99
Via: 1.1 ansible99 (squid/6.14)
Connection: keep-alive

[root@master231 ~]#

五.基于源IP和多个目标IP及域名的配置

1.环境准备

[root@master231 ~]# curl -I https://www.cnblogs.com/yinzhengjie
curl: (6) Could not resolve host: www.cnblogs.com
[root@master231 ~]# 
[root@master231 ~]# curl -I https://cloud.tencent.com/
curl: (6) Could not resolve host: cloud.tencent.com
[root@master231 ~]# 
[root@master231 ~]# curl -I https://www.baidu.com
curl: (6) Could not resolve host: www.baidu.com
[root@master231 ~]# 
[root@master231 ~]# curl -I 111.63.65.247
curl: (7) Failed to connect to 111.63.65.247 port 80 after 0 ms: Couldn't connect to server
[root@master231 ~]# 
[root@master231 ~]# curl -I 110.242.74.102
curl: (7) Failed to connect to 110.242.74.102 port 80 after 0 ms: Couldn't connect to server
[root@master231 ~]# 
[root@master231 ~]# curl -I 124.237.177.164
curl: (7) Failed to connect to 124.237.177.164 port 80 after 0 ms: Couldn't connect to server
[root@master231 ~]# 
[root@master231 ~]#

2.编写配置文件

  1.编写配置文件
[root@ansible99 ~]# cat  /etc/squid/squid.conf
visible_hostname ansible99
http_port 3128

cache_dir ufs /var/spool/squid 1024 16 256
cache_mem 256 MB

acl allow_site dstdomain .baidu.com .tencent.com

# 目标白名单：仅放行 111.63.65.247 和 110.242.74.102
acl allow_target dst 111.63.65.247 110.242.74.102

# 放行规则：只允许访问上面指定IP
http_access allow allow_target 
http_access allow allow_site

# 其余所有目标全部拒绝
http_access deny all

access_log /var/log/squid/access.log squid
cache_log /var/log/squid/cache.log
[root@ansible99 ~]# 

温馨提示:
上面的配置也可以改写成如下格式，更加美观:
[root@ansible99 ~]# cat   /etc/squid/squid.conf
visible_hostname ansible99
http_port 3128

cache_dir ufs /var/spool/squid 1024 16 256
cache_mem 256 MB

# 放行规则：只允许访问".baidu.com"和".tencent.com"
acl allow_site dstdomain .baidu.com 
acl allow_site dstdomain .tencent.com

# 目标白名单：仅放行 111.63.65.247 和 110.242.74.102
acl allow_target dst 111.63.65.247
acl allow_target dst 110.242.74.102

# 放行规则：只允许访问上面指定IP
http_access allow allow_target 
http_access allow allow_site

# 其余所有目标全部拒绝
http_access deny all

access_log /var/log/squid/access.log squid
cache_log /var/log/squid/cache.log
[root@ansible99 ~]# 
[root@ansible99 ~]# 


  2.热加载配置
[root@ansible99 ~]# squid -k reconfigure
2026/06/30 00:23:16| Processing Configuration File: /etc/squid/squid.conf (depth 0)
2026/06/30 00:23:16| Current Directory is /root
[root@ansible99 ~]#

3.测试验证


[root@master231 ~]# curl -x http://10.0.0.99:3128 -I 111.63.65.247
HTTP/1.1 301 Moved Permanently
Location: https://www.baidu.com/
Date: Mon, 29 Jun 2026 17:08:41 GMT
Content-Type: text/plain; charset=utf-8
Cache-Status: ansible99;fwd=stale;detail=match
Via: 1.1 ansible99 (squid/6.14)
Connection: keep-alive

[root@master231 ~]# 
[root@master231 ~]# 
[root@master231 ~]# curl -x http://10.0.0.99:3128 -I 110.242.74.102
HTTP/1.1 301 Moved Permanently
Location: https://www.baidu.com/
Date: Mon, 29 Jun 2026 17:08:50 GMT
Content-Type: text/plain; charset=utf-8
Cache-Status: ansible99;fwd=stale;detail=match
Via: 1.1 ansible99 (squid/6.14)
Connection: keep-alive

[root@master231 ~]# 
[root@master231 ~]# curl -x http://10.0.0.99:3128 -I 124.237.177.164
HTTP/1.1 403 Forbidden
Server: squid/6.14
Mime-Version: 1.0
Date: Mon, 29 Jun 2026 17:09:02 GMT
Content-Type: text/html;charset=utf-8
Content-Length: 3063
X-Squid-Error: ERR_ACCESS_DENIED 0
Vary: Accept-Language
Content-Language: en
Cache-Status: ansible99
Via: 1.1 ansible99 (squid/6.14)
Connection: keep-alive

[root@master231 ~]# 
[root@master231 ~]# curl -x http://10.0.0.99:3128 -I https://www.baidu.com
HTTP/1.1 200 Connection established

HTTP/1.1 200 OK
Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform
Content-Length: 0
Content-Type: text/html
Pragma: no-cache
Server: bfe
Date: Mon, 29 Jun 2026 17:09:14 GMT

[root@master231 ~]# 
[root@master231 ~]# curl -x http://10.0.0.99:3128 -I https://cloud.tencent.com/
HTTP/1.1 200 Connection established

HTTP/2 200 
content-type: text/html
cache-control: no-cache
set-cookie: path=/
content-length: 29182
server: TencentEdgeOne
date: Mon, 29 Jun 2026 17:09:33 GMT
eo-log-uuid: 17541136634896359854

[root@master231 ~]# 
[root@master231 ~]# curl -x http://10.0.0.99:3128 -I https://www.cnblogs.com/yinzhengjie
HTTP/1.1 403 Forbidden
Server: squid/6.14
Mime-Version: 1.0
Date: Mon, 29 Jun 2026 17:09:43 GMT
Content-Type: text/html;charset=utf-8
Content-Length: 3067
X-Squid-Error: ERR_ACCESS_DENIED 0
Vary: Accept-Language
Content-Language: en
Cache-Status: ansible99
Via: 1.1 ansible99 (squid/6.14)
Connection: keep-alive

curl: (56) CONNECT tunnel failed, response 403
[root@master231 ~]# 
[root@master231 ~]# curl -x http://10.0.0.99:3128 -I https://www.nvidia.cn/
HTTP/1.1 403 Forbidden
Server: squid/6.14
Mime-Version: 1.0
Date: Mon, 29 Jun 2026 17:09:55 GMT
Content-Type: text/html;charset=utf-8
Content-Length: 3063
X-Squid-Error: ERR_ACCESS_DENIED 0
Vary: Accept-Language
Content-Language: en
Cache-Status: ansible99
Via: 1.1 ansible99 (squid/6.14)
Connection: keep-alive

curl: (56) CONNECT tunnel failed, response 403
[root@master231 ~]# 
[root@master231 ~]# curl -x http://10.0.0.99:3128 -I https://www.nvidia.com
HTTP/1.1 403 Forbidden
Server: squid/6.14
Mime-Version: 1.0
Date: Mon, 29 Jun 2026 17:09:59 GMT
Content-Type: text/html;charset=utf-8
Content-Length: 3065
X-Squid-Error: ERR_ACCESS_DENIED 0
Vary: Accept-Language
Content-Language: en
Cache-Status: ansible99
Via: 1.1 ansible99 (squid/6.14)
Connection: keep-alive

curl: (56) CONNECT tunnel failed, response 403
[root@master231 ~]#

此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。原文来自 — 版权归原作者所有。

推荐订阅源

博客园 - 尹正杰

一.环境准备

1.背景说明

2.实验环境准备

二.Squid基于IP地址放行案例

1.安装Squid

2.配置Squid

3.测试验证

三.基于源IP和目标域名限制

1.编写Squid规则

2.测试验证

四.限制基于源IP和多个目标IP的限制

1.测试百度的公网IP地址

2.编写Squid

3.测试验证

五.基于源IP和多个目标IP及域名的配置

1.环境准备

2.编写配置文件

3.测试验证