配置要点总结
1. 关键配置说明
- 认证机制: 使用basic认证，用户名/密码验证
- 多IP出口: 通过tcp_outgoing_address实现不同IP出口
- 高匿名: 隐藏X-Forwarded-For、From、Via头信息
- 端口: 默认使用3128端口
2. 需要修改的部分
多IP配置部分需要根据实际情况修改：
# 根据您的实际内网IP修改（不是弹性公网IP）
acl ip10 myip 172.27.0.10
acl ip11 myip 172.27.0.11
# ... 继续添加直到20个IP
tcp_outgoing_address 172.27.0.10 ip10
tcp_outgoing_address 172.27.0.11 ip11
# ... 对应的出口配置
3. 完整优化配置建议
# 创建完整的配置文件 cat > /etc/squid/squid.conf << 'EOF' # # Squid代理配置 - 多IP出口版本 # # 基础设置 http_port 3128 visible_hostname squid-proxy cache_dir ufs /var/spool/squid 100 16 256 maximum_object_size 256 MB # 访问控制 acl localnet src 10.0.0.0/8 acl localnet src 172.16.0.0/12 acl localnet src 192.168.0.0/16 acl SSL_ports port 443 acl Safe_ports port 80 acl Safe_ports port 443 acl Safe_ports port 21 acl Safe_ports port 1025-65535 acl CONNECT method CONNECT # 注释掉默认的拒绝规则 #http_access deny !Safe_ports #http_access deny CONNECT !SSL_ports # 用户认证 auth_param basic program /usr/lib64/squid/basic_ncsa_auth /etc/squid3/passwords auth_param basic realm Squid代理服务器 auth_param basic children 5 auth_param basic credentialsttl 2 hours acl authenticated proxy_auth REQUIRED http_access allow authenticated # 高匿名配置 request_header_access X-Forwarded-For deny all request_header_access From deny all request_header_access Via deny all request_header_access Referer deny all forwarded_for delete # 多IP出口配置 - 根据实际IP修改 acl ip1 myip 172.27.0.10 acl ip2 myip 172.27.0.11 acl ip3 myip 172.27.0.12 # ... 添加更多IP tcp_outgoing_address 172.27.0.10 ip1 tcp_outgoing_address 172.27.0.11 ip2 tcp_outgoing_address 172.27.0.12 ip3 # ... 添加更多出口IP映射 # 最后拒绝所有其他访问 http_access deny all # 刷新模式 refresh_pattern ^ftp: 1440 20% 10080 refresh_pattern ^gopher: 1440 0% 1440 refresh_pattern -i (/cgi-bin/|\?) 0 0% 0 refresh_pattern . 0 20% 4320 EOF
4. 系统优化配置
# 修改系统文件描述符限制 echo "squid soft nofile 65536" >> /etc/security/limits.conf echo "squid hard nofile 65536" >> /etc/security/limits.conf # 优化内核参数 cat >> /etc/sysctl.conf << 'EOF' net.ipv4.ip_local_port_range = 1024 65535 net.ipv4.tcp_tw_reuse = 1 net.ipv4.tcp_fin_timeout = 30 net.core.somaxconn = 65536 EOF sysctl -p
5. 验证配置
# 检查配置文件语法 squid -k parse # 初始化缓存目录 squid -z # 启动服务 systemctl start squid systemctl enable squid # 查看状态 systemctl status squid # 测试代理连接 curl -x http://liangchen:liangchen@localhost:3128 http://httpbin.org/ip
6. 添加更多用户
# 添加新用户 htpasswd -b /etc/squid3/passwords username2 password2 htpasswd -b /etc/squid3/passwords username3 password3 # 重启squid生效 systemctl restart squid
7. 监控和维护
# 查看日志 tail -f /var/log/squid/access.log tail -f /var/log/squid/cache.log # 统计连接数 netstat -an | grep :3128 | wc -l # 清空缓存 squid -k shutdown rm -rf /var/spool/squid/* squid -z systemctl start squid
这个配置为您提供了一个完整的高匿名多IP代理服务器解决方案。记得根据您的实际网络环境修改IP地址配置。