Squid正向代理实战

博客园 - 尹正杰

aiops运维平台从0到1部署实战 aiops平台环境部署 TKE集群LoadBalancer映射案例 k8s集群为每个节点分配不通的ippool实战 ansible剧本实现一键升级K8S集群的NVIDIA GPU驱动 vmagent采集etcd数据并写入victoriametrics集群 VictoriaMetrics集群部署实战 kubespray生产故障案例之kubelet启动参数案例 filebeat指定名称空间采集pod数据 Calico自定义Ipool实战 ansible剧本实现kibana的部署和卸载 ansible剧本应用案例集合2 ansible剧本实现磁盘格式化 Ansible急速入门实战篇 ansible快速入门篇 k8s集群管理 kubesray实战 kubespray实战案例 kubespray管理k8s的worker集群扩缩容 kubespray快速部署k8s集群实战 Kubeasz使用吐槽博客专题 Kubeasz基于ezctl实现etcd集群的管理实战 Kubeasz基于ezctl实现k8s集群一键升级 Calico启用纯BGP模式+RR实战案例 Calico 底层原理及IPIP（依赖BGP协议）)和vxlan（不依赖BGP）工作模式切换 kubeasz基于ezctl实现k8s集群的扩容和缩容 kubeasz快速部署K8S集群实战 Ubuntu 24.04.04 LTS版本系统优化 Ubuntu Server 24.04.04 LTS部署指南 windows极速部署Openclaw实战篇 K8S的StatefulSet控制器应用案例之MySQL主从同步实战 k8s底层基于不同运行时集成harbor企业级私有仓库实战二进制K8S集群附加组件部署及CNI网络插件切换实战二进制部署K8S 1.35.0+最新版实战案例 etcd高可用集群部署及K8S周期性备份数据实战基于Docker实现《若依》服务业务容器化实战篇 k8s集群基于Flannel网络插件部署凡人修仙传 k8s集群基于Calico网络插件部署凡人修仙传 ElasticSEearch 9.X环境部署 K8S Vertical Pod Autoscaler(VPA)实战案例 Prometheus监控自定义程序指标

Squid正向代理实战

尹正杰 · 2026-06-29 · via 博客园 - 尹正杰

　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　作者：尹正杰

一.环境准备
- 1.背景说明
- 2.实验环境准备
二.Squid基于IP地址放行案例
三.基于源IP和目标域名限制
- 1.编写Squid规则
- 2.测试验证
四.限制基于源IP和多个目标IP的限制
五.基于源IP和多个目标IP及域名的配置

一.环境准备

1.背景说明

我们生产环境有2000台物理服务器不允许上外网，但是对于个别站点的确时需要去临时访问外网的，比如下载系统软件包之类的。


于是我就想到2016年用到的一个技术Squid，现在忘记的也差不多了。也是就是边学便用。顺便记个笔记。


关于Squid我就不多费口舌了，凡是能看这篇文章的，说明你根本就不是小白。

2.实验环境准备

我现在有一台服务器，故意没有配置网关，然后他就无法上网。

[root@master231 ~]# curl -I  https://www.baidu.com 
curl: (6) Could not resolve host: www.baidu.com
[root@master231 ~]# 
[root@master231 ~]# curl -I  https://www.cnblogs.com/yinzhengjie
curl: (6) Could not resolve host: www.cnblogs.com
[root@master231 ~]#

二.Squid基于IP地址放行案例

1.安装Squid

[root@ansible99 ~]# apt -y install squid

2.配置Squid

  1.修改配置文件
[root@ansible99 ~]# cat  /etc/squid/squid.conf
visible_hostname ansible99

# 监听端口
http_port 3128

# 缓存目录
cache_dir ufs /var/spool/squid 1024 16 256
cache_mem 256 MB

# 1. IP白名单：允许客户端网段 10.0.0.0/24、192.168.1.0/24
acl white_list src 10.0.0.0/24 192.168.1.0/24

# 2. 域名白名单：仅允许访问百度系域名
acl allow_site dstdomain .baidu.com

# 放行规则：IP在白名单 并且 访问百度域名，才允许代理
http_access allow white_list allow_site

# 其余全部拒绝
http_access deny all

# 日志
access_log /var/log/squid/access.log squid
cache_log /var/log/squid/cache.log
[root@ansible99 ~]# 


  2.解析语法是否正确
[root@ansible99 ~]# squid -k parse
2026/06/29 23:45:54| Processing Configuration File: /etc/squid/squid.conf (depth 0)
2026/06/29 23:45:54| Processing: visible_hostname ansible99
2026/06/29 23:45:54| Processing: http_port 3128
2026/06/29 23:45:54| Processing: cache_dir ufs /var/spool/squid 1024 16 256
2026/06/29 23:45:54| Processing: cache_mem 256 MB
2026/06/29 23:45:54| Processing: acl white_list src 10.0.0.0/24 192.168.1.0/24
2026/06/29 23:45:54| Processing: http_access allow white_list
2026/06/29 23:45:54| Processing: http_access deny all
2026/06/29 23:45:54| Processing: access_log /var/log/squid/access.log squid
2026/06/29 23:45:54| Processing: cache_log /var/log/squid/cache.log
[root@ansible99 ~]# 
[root@ansible99 ~]# 


  3.热加载配置
[root@ansible99 ~]# squid -k reconfigure
2026/06/29 23:46:22| Processing Configuration File: /etc/squid/squid.conf (depth 0)
2026/06/29 23:46:22| Current Directory is /root
[root@ansible99 ~]#

3.测试验证

[root@master231 ~]# curl -x http://10.0.0.99:3128 -I https://www.baidu.com
HTTP/1.1 200 Connection established

HTTP/1.1 200 OK
Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform
Content-Length: 0
Content-Type: text/html
Pragma: no-cache
Server: bfe
Date: Mon, 29 Jun 2026 15:46:53 GMT

[root@master231 ~]# 
[root@master231 ~]# curl -x http://10.0.0.99:3128 -I https://www.cnblogs.com/yinzhengjie
HTTP/1.1 200 Connection established

HTTP/2 200 
date: Mon, 29 Jun 2026 15:46:56 GMT
content-type: text/html; charset=utf-8
vary: Accept-Encoding
cache-control: no-cache, no-store
pragma: no-cache
set-cookie: .AspNetCore.Antiforgery.b8-pDmTq1XM=CfDJ8OBZrxGJLy5MvghieKIKXCzVBZqSBmHPSQhbIVLAw6xSiSnWg0FiQSBbwmyfrvbyplAqXz3R6EF4cV1-B6fWTFnyqSGghkzksK7JHEygMjAhsScIGHMl1n86VqCTSdhuYISXJTcSDj4QLhXzeRu_138; path=/; httponly
strict-transport-security: max-age=2592000; includeSubDomains; preload
x-frame-options: SAMEORIGIN

[root@master231 ~]#

三.基于源IP和目标域名限制

1.编写Squid规则

  1.编写二配置文件
[root@ansible99 ~]# cat  /etc/squid/squid.conf
visible_hostname ansible99

# 监听端口
http_port 3128

# 缓存目录
cache_dir ufs /var/spool/squid 1024 16 256
cache_mem 256 MB

# 1. IP白名单：允许客户端网段 10.0.0.0/24、192.168.1.0/24
acl white_list src 10.0.0.0/24 192.168.1.0/24

# 2. 域名白名单：仅允许访问百度系域名
acl allow_site dstdomain .baidu.com

# 放行规则：IP在白名单 并且 访问百度域名，才允许代理
http_access allow white_list allow_site

# 其余全部拒绝
http_access deny all

# 日志
access_log /var/log/squid/access.log squid
cache_log /var/log/squid/cache.log
[root@ansible99 ~]# 

  2.检查语法
[root@ansible99 ~]# squid -k parse
2026/06/29 23:50:34| Processing Configuration File: /etc/squid/squid.conf (depth 0)
2026/06/29 23:50:34| Processing: visible_hostname ansible99
2026/06/29 23:50:34| Processing: http_port 3128
2026/06/29 23:50:34| Processing: cache_dir ufs /var/spool/squid 1024 16 256
2026/06/29 23:50:34| Processing: cache_mem 256 MB
2026/06/29 23:50:34| Processing: acl white_list src 10.0.0.0/24 192.168.1.0/24
2026/06/29 23:50:34| Processing: acl allow_site dstdomain .baidu.com
2026/06/29 23:50:34| Processing: http_access allow white_list allow_site
2026/06/29 23:50:34| Processing: http_access deny all
2026/06/29 23:50:34| Processing: access_log /var/log/squid/access.log squid
2026/06/29 23:50:34| Processing: cache_log /var/log/squid/cache.log
[root@ansible99 ~]# 

  3.热加载配置
[root@ansible99 ~]# squid -k reconfigure
2026/06/29 23:50:38| Processing Configuration File: /etc/squid/squid.conf (depth 0)
2026/06/29 23:50:38| Current Directory is /root
[root@ansible99 ~]# 
[root@ansible99 ~]#

2.测试验证

[root@master231 ~]# curl -x http://10.0.0.99:3128 -I https://www.baidu.com
HTTP/1.1 200 Connection established

HTTP/1.1 200 OK
Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform
Content-Length: 0
Content-Type: text/html
Pragma: no-cache
Server: bfe
Date: Mon, 29 Jun 2026 15:51:42 GMT

[root@master231 ~]# 
[root@master231 ~]# curl -x http://10.0.0.99:3128 -I https://www.cnblogs.com/yinzhengjie
HTTP/1.1 403 Forbidden
Server: squid/6.14
Mime-Version: 1.0
Date: Mon, 29 Jun 2026 15:51:44 GMT
Content-Type: text/html;charset=utf-8
Content-Length: 3067
X-Squid-Error: ERR_ACCESS_DENIED 0
Vary: Accept-Language
Content-Language: en
Cache-Status: ansible99
Via: 1.1 ansible99 (squid/6.14)
Connection: keep-alive

curl: (56) CONNECT tunnel failed, response 403
[root@master231 ~]# 
[root@master231 ~]# 
[root@master231 ~]# curl -x http://10.0.0.99:3128 https://www.cnblogs.com/yinzhengjie
curl: (56) CONNECT tunnel failed, response 403
[root@master231 ~]#

四.限制基于源IP和多个目标IP的限制

1.测试百度的公网IP地址

[root@ansible99 ~]# ping baidu.com
PING baidu.com (110.242.74.102) 56(84) bytes of data.
64 bytes from 110.242.74.102: icmp_seq=1 ttl=128 time=56.4 ms
^C
--- baidu.com ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 56.439/56.439/56.439/0.000 ms
[root@ansible99 ~]# 
[root@ansible99 ~]# ping baidu.com
PING baidu.com (124.237.177.164) 56(84) bytes of data.
64 bytes from 124.237.177.164: icmp_seq=1 ttl=128 time=54.5 ms
^C
--- baidu.com ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 54.542/54.542/54.542/0.000 ms
[root@ansible99 ~]# 
[root@ansible99 ~]# 
[root@ansible99 ~]# ping baidu.com
PING baidu.com (111.63.65.247) 56(84) bytes of data.
64 bytes from 111.63.65.247: icmp_seq=1 ttl=128 time=47.0 ms
64 bytes from 111.63.65.247: icmp_seq=2 ttl=128 time=42.6 ms
^C
--- baidu.com ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1002ms
rtt min/avg/max/mdev = 42.575/44.766/46.958/2.191 ms
[root@ansible99 ~]# 

看到了3个有效的IP：
  - 110.242.74.102
  - 124.237.177.164
  - 111.63.65.247

2.编写Squid

  1.编写Squid配置文件
[root@ansible99 ~]# cat /etc/squid/squid.conf
visible_hostname ansible99
http_port 3128

cache_dir ufs /var/spool/squid 1024 16 256
cache_mem 256 MB

# 目标白名单：仅放行 111.63.65.247 和 110.242.74.102
acl allow_target dst 111.63.65.247 110.242.74.102

# 放行规则：只允许访问上面指定IP
http_access allow allow_target

# 其余所有目标全部拒绝
http_access deny all

access_log /var/log/squid/access.log squid
cache_log /var/log/squid/cache.log
[root@ansible99 ~]# 

  2.热加载配置
[root@ansible99 ~]# squid -k reconfigure
2026/06/30 00:02:56| Processing Configuration File: /etc/squid/squid.conf (depth 0)
2026/06/30 00:02:56| Current Directory is /root
[root@ansible99 ~]#

3.测试验证

[root@master231 ~]# curl -x http://10.0.0.99:3128 -I 111.63.65.247
HTTP/1.1 301 Moved Permanently
Location: https://www.baidu.com/
Date: Mon, 29 Jun 2026 16:00:17 GMT
Content-Type: text/plain; charset=utf-8
Cache-Status: ansible99;fwd=stale;detail=match
Via: 1.1 ansible99 (squid/6.14)
Connection: keep-alive

[root@master231 ~]# 
[root@master231 ~]# curl -x http://10.0.0.99:3128 -I 110.242.74.102
HTTP/1.1 301 Moved Permanently
Location: https://www.baidu.com/
Date: Mon, 29 Jun 2026 16:03:01 GMT
Content-Type: text/plain; charset=utf-8
Cache-Status: ansible99;detail=mismatch
Via: 1.1 ansible99 (squid/6.14)
Connection: keep-alive

[root@master231 ~]# 
[root@master231 ~]# curl -x http://10.0.0.99:3128 -I 124.237.177.164
HTTP/1.1 403 Forbidden
Server: squid/6.14
Mime-Version: 1.0
Date: Mon, 29 Jun 2026 16:00:53 GMT
Content-Type: text/html;charset=utf-8
Content-Length: 3063
X-Squid-Error: ERR_ACCESS_DENIED 0
Vary: Accept-Language
Content-Language: en
Cache-Status: ansible99
Via: 1.1 ansible99 (squid/6.14)
Connection: keep-alive

[root@master231 ~]#

五.基于源IP和多个目标IP及域名的配置

1.环境准备

[root@master231 ~]# curl -I https://www.cnblogs.com/yinzhengjie
curl: (6) Could not resolve host: www.cnblogs.com
[root@master231 ~]# 
[root@master231 ~]# curl -I https://cloud.tencent.com/
curl: (6) Could not resolve host: cloud.tencent.com
[root@master231 ~]# 
[root@master231 ~]# curl -I https://www.baidu.com
curl: (6) Could not resolve host: www.baidu.com
[root@master231 ~]# 
[root@master231 ~]# curl -I 111.63.65.247
curl: (7) Failed to connect to 111.63.65.247 port 80 after 0 ms: Couldn't connect to server
[root@master231 ~]# 
[root@master231 ~]# curl -I 110.242.74.102
curl: (7) Failed to connect to 110.242.74.102 port 80 after 0 ms: Couldn't connect to server
[root@master231 ~]# 
[root@master231 ~]# curl -I 124.237.177.164
curl: (7) Failed to connect to 124.237.177.164 port 80 after 0 ms: Couldn't connect to server
[root@master231 ~]# 
[root@master231 ~]#

2.编写配置文件

  1.编写配置文件
[root@ansible99 ~]# cat  /etc/squid/squid.conf
visible_hostname ansible99
http_port 3128

cache_dir ufs /var/spool/squid 1024 16 256
cache_mem 256 MB

acl allow_site dstdomain .baidu.com .tencent.com

# 目标白名单：仅放行 111.63.65.247 和 110.242.74.102
acl allow_target dst 111.63.65.247 110.242.74.102

# 放行规则：只允许访问上面指定IP
http_access allow allow_target 
http_access allow allow_site

# 其余所有目标全部拒绝
http_access deny all

access_log /var/log/squid/access.log squid
cache_log /var/log/squid/cache.log
[root@ansible99 ~]# 

温馨提示:
上面的配置也可以改写成如下格式，更加美观:
[root@ansible99 ~]# cat   /etc/squid/squid.conf
visible_hostname ansible99
http_port 3128

cache_dir ufs /var/spool/squid 1024 16 256
cache_mem 256 MB

# 放行规则：只允许访问".baidu.com"和".tencent.com"
acl allow_site dstdomain .baidu.com 
acl allow_site dstdomain .tencent.com

# 目标白名单：仅放行 111.63.65.247 和 110.242.74.102
acl allow_target dst 111.63.65.247
acl allow_target dst 110.242.74.102

# 放行规则：只允许访问上面指定IP
http_access allow allow_target 
http_access allow allow_site

# 其余所有目标全部拒绝
http_access deny all

access_log /var/log/squid/access.log squid
cache_log /var/log/squid/cache.log
[root@ansible99 ~]# 
[root@ansible99 ~]# 


  2.热加载配置
[root@ansible99 ~]# squid -k reconfigure
2026/06/30 00:23:16| Processing Configuration File: /etc/squid/squid.conf (depth 0)
2026/06/30 00:23:16| Current Directory is /root
[root@ansible99 ~]#

3.测试验证


[root@master231 ~]# curl -x http://10.0.0.99:3128 -I 111.63.65.247
HTTP/1.1 301 Moved Permanently
Location: https://www.baidu.com/
Date: Mon, 29 Jun 2026 17:08:41 GMT
Content-Type: text/plain; charset=utf-8
Cache-Status: ansible99;fwd=stale;detail=match
Via: 1.1 ansible99 (squid/6.14)
Connection: keep-alive

[root@master231 ~]# 
[root@master231 ~]# 
[root@master231 ~]# curl -x http://10.0.0.99:3128 -I 110.242.74.102
HTTP/1.1 301 Moved Permanently
Location: https://www.baidu.com/
Date: Mon, 29 Jun 2026 17:08:50 GMT
Content-Type: text/plain; charset=utf-8
Cache-Status: ansible99;fwd=stale;detail=match
Via: 1.1 ansible99 (squid/6.14)
Connection: keep-alive

[root@master231 ~]# 
[root@master231 ~]# curl -x http://10.0.0.99:3128 -I 124.237.177.164
HTTP/1.1 403 Forbidden
Server: squid/6.14
Mime-Version: 1.0
Date: Mon, 29 Jun 2026 17:09:02 GMT
Content-Type: text/html;charset=utf-8
Content-Length: 3063
X-Squid-Error: ERR_ACCESS_DENIED 0
Vary: Accept-Language
Content-Language: en
Cache-Status: ansible99
Via: 1.1 ansible99 (squid/6.14)
Connection: keep-alive

[root@master231 ~]# 
[root@master231 ~]# curl -x http://10.0.0.99:3128 -I https://www.baidu.com
HTTP/1.1 200 Connection established

HTTP/1.1 200 OK
Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform
Content-Length: 0
Content-Type: text/html
Pragma: no-cache
Server: bfe
Date: Mon, 29 Jun 2026 17:09:14 GMT

[root@master231 ~]# 
[root@master231 ~]# curl -x http://10.0.0.99:3128 -I https://cloud.tencent.com/
HTTP/1.1 200 Connection established

HTTP/2 200 
content-type: text/html
cache-control: no-cache
set-cookie: path=/
content-length: 29182
server: TencentEdgeOne
date: Mon, 29 Jun 2026 17:09:33 GMT
eo-log-uuid: 17541136634896359854

[root@master231 ~]# 
[root@master231 ~]# curl -x http://10.0.0.99:3128 -I https://www.cnblogs.com/yinzhengjie
HTTP/1.1 403 Forbidden
Server: squid/6.14
Mime-Version: 1.0
Date: Mon, 29 Jun 2026 17:09:43 GMT
Content-Type: text/html;charset=utf-8
Content-Length: 3067
X-Squid-Error: ERR_ACCESS_DENIED 0
Vary: Accept-Language
Content-Language: en
Cache-Status: ansible99
Via: 1.1 ansible99 (squid/6.14)
Connection: keep-alive

curl: (56) CONNECT tunnel failed, response 403
[root@master231 ~]# 
[root@master231 ~]# curl -x http://10.0.0.99:3128 -I https://www.nvidia.cn/
HTTP/1.1 403 Forbidden
Server: squid/6.14
Mime-Version: 1.0
Date: Mon, 29 Jun 2026 17:09:55 GMT
Content-Type: text/html;charset=utf-8
Content-Length: 3063
X-Squid-Error: ERR_ACCESS_DENIED 0
Vary: Accept-Language
Content-Language: en
Cache-Status: ansible99
Via: 1.1 ansible99 (squid/6.14)
Connection: keep-alive

curl: (56) CONNECT tunnel failed, response 403
[root@master231 ~]# 
[root@master231 ~]# curl -x http://10.0.0.99:3128 -I https://www.nvidia.com
HTTP/1.1 403 Forbidden
Server: squid/6.14
Mime-Version: 1.0
Date: Mon, 29 Jun 2026 17:09:59 GMT
Content-Type: text/html;charset=utf-8
Content-Length: 3065
X-Squid-Error: ERR_ACCESS_DENIED 0
Vary: Accept-Language
Content-Language: en
Cache-Status: ansible99
Via: 1.1 ansible99 (squid/6.14)
Connection: keep-alive

curl: (56) CONNECT tunnel failed, response 403
[root@master231 ~]#

此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。原文来自 — 版权归原作者所有。

推荐订阅源

博客园 - 尹正杰

一.环境准备

1.背景说明

2.实验环境准备

二.Squid基于IP地址放行案例

1.安装Squid

2.配置Squid

3.测试验证

三.基于源IP和目标域名限制

1.编写Squid规则

2.测试验证

四.限制基于源IP和多个目标IP的限制

1.测试百度的公网IP地址

2.编写Squid

3.测试验证

五.基于源IP和多个目标IP及域名的配置

1.环境准备

2.编写配置文件

3.测试验证