001

dryu999

　　有时服务器需临时开通下上网下载文件，又不想去防火墙开通权限，合理可以上网的服务器用作代理。
　　一、服务器端搭建
　　1.过程命令行：
　　  yum -y install squid
　　  chkconfig --level 35 squid on
　　  cat /etc/squid/squid.conf
　　  squid -z
　　  vim /etc/squid/squid.conf
　　  squid -z
　　  /etc/init.d/squid start
　　  systemctl start squid
　　2.Squid.conf  文件内容：（基本不需要修改，重点关注下红色字体部分就可以使用。)
　　#
　　# Recommended minimum configuration:
　　#
　　

　　# Example rule allowing access from your local networks.
　　# Adapt to list your (internal) IP networks from where browsing
　　# should be allowed
　　acl localnet src 10.0.0.0/8     # RFC1918 possible internal network
　　acl localnet src 172.16.0.0/12  # RFC1918 possible internal network
　　acl localnet src 192.168.0.0/16 # RFC1918 possible internal network
　　acl localnet src fc00::/7       # RFC 4193 local private network range
　　acl localnet src fe80::/10      # RFC 4291 link-local (directly plugged) machines
　　

　　acl SSL_ports port 443
　　acl Safe_ports port 80          # http
　　acl Safe_ports port 21          # ftp
　　acl Safe_ports port 443         # https
　　acl Safe_ports port 70          # gopher
　　acl Safe_ports port 210         # wais
　　acl Safe_ports port 1025-65535  # unregistered ports
　　acl Safe_ports port 280         # http-mgmt
　　acl Safe_ports port 488         # gss-http
　　acl Safe_ports port 591         # filemaker
　　acl Safe_ports port 777         # multiling http
　　acl CONNECT method CONNECT
　　

　　#
　　# Recommended minimum Access Permission configuration:
　　#
　　# Deny requests to certain unsafe ports
　　http_access deny !Safe_ports
　　

　　# Deny CONNECT to other than secure SSL ports
　　http_access deny CONNECT !SSL_ports
　　

　　# Only allow cachemgr access from localhost
　　http_access allow localhost manager
　　http_access deny manager
　　

　　# We strongly recommend the following be uncommented to protect innocent
　　# web applications running on the proxy server who think the only
　　# one who can access services on "localhost" is a local user
　　#http_access deny to_localhost
　　

　　#
　　# INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS
　　#
　　

　　# Example rule allowing access from your local networks.
　　# Adapt localnet in the ACL section to list your (internal) IP networks
　　# from where browsing should be allowed
　　http_access allow localnet
　　http_access allow localhost
　　

　　# And finally deny all other access to this proxy
　　http_access deny all
　　

　　# Squid normally listens to port 3128
　　http_port 3128
　　cache_mem 64 MB
　　maximum_object_size 4 MB
　　cache_dir ufs /var/spool/squid 100 16 256
　　access_log /var/log/squid/access.log
　　acl localnet src 192.168.1.0/24
　　http_access allow localnet
　　http_access deny all
　　visible_hostname squid.david.dev
　　# Uncomment and adjust the following to add a disk cache directory.
　　#cache_dir ufs /var/spool/squid 100 16 256
　　

　　# Leave coredumps in the first cache dir
　　coredump_dir /var/spool/squid
　　

　　#
　　# Add any of your own refresh_pattern entries above these.
　　#
　　refresh_pattern ^ftp:           1440    20%     10080
　　refresh_pattern ^gopher:        1440    0%      1440
　　refresh_pattern -i (/cgi-bin/|\?) 0     0%      0
　　refresh_pattern .               0       20%     4320
　　二、客户端使用：
　　1、Linux:
应用代理：exporthttp_proxy=ServerIP:3128(服务端配置文件中指定的端口）或：exporthttps_proxy=ServerIP:3128
取消代理：unsethttp_proxy或：unsethttps_proxy
　　2、Windows
　　IE中 Interne选项-连接-局域网设置， 填入服务器侧地址及端口