|
|
发表于 2003-5-22 01:22:20
|
显示全部楼层
squid代理服务器二(GPL)
通过上一节的设置，我想你已经能够用代理上网，聊天，下软件了这一节我们一起学习一些稍微深入的东西。
@@@@@多重代理(不知道这个说法对不对)
squid支持多重代理。
cache_peer 用法详解
# TAG: cache_peer
# To specify other caches in a hierarchy, use the format:
#
# cache_peer hostname type http_port icp_port
#
# For example,
#
# # proxy icp
# # hostname type port port options
# # -------------------- -------- ----- ----- -----------
# cache_peer parent.foo.net parent 3128 3130 [proxy-only]
# cache_peer sib1.foo.net sibling 3128 3130 [proxy-only]
# cache_peer sib2.foo.net sibling 3128 3130 [proxy-only]
#
# type: either 'parent', 'sibling', or 'multicast'.
#
# proxy_port: The port number where the cache listens for proxy
# requests.
#
# icp_port: Used for querying neighbor caches about
# objects. To have a non-ICP neighbor
# specify '7' for the ICP port and make sure the
# neighbor machine has the UDP echo port
# enabled in its /etc/inetd.conf file.
#
# options: proxy-only
# weight=n
# ttl=n
# no-query
# default
# round-robin
# multicast-responder
# closest-only
# no-digest
# no-netdb-exchange
# no-delay
# login=user:password
# connect-timeout=nn
# digest-url=url
# allow-miss
#
# use 'proxy-only' to specify that objects fetched
# from this cache should not be saved locally.
#
# use 'weight=n' to specify a weighted parent.
# The weight must be an integer. The default weight
# is 1, larger weights are favored more.
#
# use 'ttl=n' to specify a IP multicast TTL to use
# when sending an ICP queries to this address.
# Only useful when sending to a multicast group.
# Because we don't accept ICP replies from random
# hosts, you must configure other group members as
# peers with the 'multicast-responder' option below.
#
# use 'no-query' to NOT send ICP queries to this
# neighbor.
#
# use 'default' if this is a parent cache which can
# be used as a "last-resort." You should probably
# only use 'default' in situations where you cannot
# use ICP with your parent cache(s).
#
# use 'round-robin' to define a set of parents which
# should be used in a round-robin fashion in the
# absence of any ICP queries.
#
# 'multicast-responder' indicates that the named peer
# is a member of a multicast group. ICP queries will
# not be sent directly to the peer, but ICP replies
# will be accepted from it.
#
# 'closest-only' indicates that, for ICP_OP_MISS
# replies, we'll only forward CLOSEST_PARENT_MISSes
# and never FIRST_PARENT_MISSes.
#
# use 'no-digest' to NOT request cache digests from
# this neighbor.
#
# 'no-netdb-exchange' disables requesting ICMP
# RTT database (NetDB) from the neighbor.
#
# use 'no-delay' to prevent access to this neighbor
# from influencing the delay pools.
#
# use 'login=user:password' if this is a personal/workgroup
# proxy and your parent requires proxy authentication.
#
# use 'connect-timeout=nn' to specify a peer
# specific connect timeout (also see the
# peer_connect_timeout directive)
#
# use 'digest-url=url' to tell Squid to fetch the cache
# digest (if digests are enabled) for this host from
# the specified URL rather than the Squid default
# location.
#
# use 'allow-miss' to disable Squid's use of only-if-cached
# when forwarding requests to siblings. This is primarily
# useful when icp_hit_stale is used by the sibling. To
# extensive use of this option may result in forwarding
# loops, and you should avoid having two-way peerings
# with this option. (for example to deny peer usage on
# requests from peer by denying cache_peer_access if the
# source is a peer)
#
# NOTE: non-ICP neighbors must be specified as 'parent'.
#
#Default:
# none
cache_peer 61.139.106.2 parent 8000 3130 no-query no-netdb-exchange proxy-only
cache_peer 202.109.78.22 parent 3128 3130 no-query no-netdb-exchange proxy-only
cache_peer 202.105.138.19 parent 8080 3130 no-query no-netdb-exchange proxy-only
cache_peer 61.129.70.224 parent 80 3130 no-query no-netdb-exchange proxy-only
cache_peer 61.145.230.14 parent 8080 3130 no-query no-netdb-exchange proxy-only
cache_peer 61.145.231.69 parent 80 3130 no-query no-netdb-exchange proxy-only
----------------------------------------------------------------------
我们最常用的就是parent 类型 参数多为:no-query no-netdb-exchange proxy-only 即不需要向parent发出icp查询，不和parent交换管理信息，直接从parent cache取数据送到客户，而不在本地缓存~！~(提高速度)
还有一个参数不常用：round-robin，并行从个个parent取数据，如果你的parent都很近而且快，那么可以用这个参数，我没有用，因为个个parent速度不一样
反倒速度慢了。(最后不要滥用parent，因为受管制的)
-----------------------------------------------------------------------
直接访问某些站点
-----------------------------------------------------------------------
acl name dst value
acl name dstdomain value
always_direct allow name
比如校园服务器，离我们很近，但是用了parent代理后肯定慢，这个时候我们可以利用这个权限管理使客户直接访问她们,而不通过代理。
acl camp dstdomain xx.edu.cn
acl vod dst 192.168.2.5
always_direct allow camp
always_dirent allow vod
---------------------------------------------------------------------------
url过滤
------------------------------------------------------------------------
acl name url_regex url1 url2 ...
http_access deny name
这个主要是过滤不良信息。比如黄色，反动。。。。。
acl ho url_regex ^http://www.pku.edu.cn$ //这里是正则表达式
http_access deny ho
---------------------------------------------------------------------
访问时间限制
----------------------------------------------------------------------
这个要配合其他规则使用
acl name time day-abbrevs h1:m1-h2:m2
http_access allow name
acl outnet src 210.41.115.0/255.255.255.0
acl ok_outnet time MTWHF 00:00-24:00
http_access allow ok_outnet outnet
http_access deny ok_outnet
即：允许outnet这个域在星期一到星期五都能访问
注意：http_access allow ok_outnet outnet
时间 域
时间是英语星期的第一个字母
------------------------------------------------------------------------
拒绝缓冲某些数据
-------------------------------------------------------------------
no_cache deny name
比如：
acl yellow url_regex ^http://xxx.168.com$
no_cache deny yellow
拒绝缓冲这个网站的数据！
------------------------------------------------------------------------
别人能使用我作为parent》》？？？？？？
--------------------------------------------------------------------
icp_port 3130 //最好不要改
icp_access allow|deny aclName
比如不允许
acl allno src 0.0.0.0./0.0.0.0
icp_access deny allno
---------------------------------------------------------------------
注意：acl 定义的name是全局的
也就是说不能重复定义一个name
比如：
acl kkk src 210.41.112.0/24
acl kkk url_regex ^sex$
这样就使kkk重复定义，不行的哟！
---------------------------------------------------------------------
小弟用到的差不多就这些~！~如有错误，请指教和交流~！~
最后写上第三篇，squid规划~！~ |
|
IP卡
狗仔卡
提升卡
置顶卡
沉默卡
喧嚣卡
变色卡
显身卡
发表于 2003-5-22 08:39:45