場景:服務器F針對訪問終端需要添加白名單操作,由到終端數量較多,所以用了一台代理服務器 P,在服務F中添加 服務器P IP地址的白名單,所有終端訪問服務器P
由於我已經安裝過 Nginx 所以只需要添加模塊的配置,這里先說明 stream 四層代理的實現方式,(僅滿足項目需要配置,其它配置項可百度參考相應的說明)
切換到安裝目錄下
[root@localhost nginx-1.12.2]# pwd /usr/local/iron/nginx-1.12.2 [root@localhost nginx-1.12.2]# [root@localhost nginx-1.12.2]# ./configure --prefix=/usr/local/nginx --with-http_stub_status_module --with-http_ssl_module --with-stream --with-stream_ssl_preread_module --with-stream_ssl_module [root@localhost nginx-1.12.2]# make [root@localhost sbin]# cp /usr/local/nginx/sbin/nginx /usr/local/nginx/sbin/nginx-no-strem [root@localhost sbin]# cp /usr/local/iron/nginx-1.12.2/objs/nginx /usr/local/nginx/sbin/nginx cp:是否覆蓋"/usr/local/nginx/sbin/nginx"? y [root@localhost sbin]# ./nginx -V nginx version: nginx/1.12.2 built by gcc 4.8.5 20150623 (Red Hat 4.8.5-36) (GCC) built with OpenSSL 1.0.2k-fips 26 Jan 2017 TLS SNI support enabled configure arguments: --prefix=/usr/local/nginx --with-http_stub_status_module --with-http_ssl_module --with-stream --with-stream_ssl_preread_module --with-stream_ssl_module [root@localhost sbin]#
nginx.config
worker_processes 1; events { worker_connections 1024; } stream { map $ssl_preread_server_name $name { default backend; # backend.example.com backend2; } upstream backend { server ironfo.com:443; # server 192.168.0.4:12345; } #upstream backend2 { # server 192.168.0.1:12345; # server 192.168.0.2:12345; #} server { listen 8080; proxy_pass $name; ssl_preread on; } }
[root@localhost sbin]# /usr/local/nginx/sbin/nginx -s reload 重新加載配置文件
此時訪問網站會提示不安全的連接
配置 hosts 文件(由於項目的特殊性,常不會這樣的操作,沒必要這么繞一圈)
192.168.1.1 為Nginx 服務器的IP
重新瀏覽器,可正常訪問