内部资源公网访问反向代理+实施方案.doc

公司内部资源公网访问反向代理实施方案目 录1方案目标12操作步骤12.1编译pcre12.2编译NGINX22.3创建 Nginx 日志目录22.4创建 Nginx 配置文件22.5创建Nginx 配置启动脚本42.6给NGINX 启动脚本执行权限62.7把 nginx 加入到启动服务中62.8启动 Nginx63生成nginx认证文件64网关映射.9的9999端口75登录测试71 方案目标公司内部的WIKI，工时系统等等是公司的宝贵资料，不适合完全在互联网上公开，在.9服务器上安装nginx作反向代理，并实现用户认证登录。2 操作步骤2.1 编译pcrewget /soft/linux/nginx_php/pcre/pcre-8.01.tar.gztar zxvf pcre-8.01.tar.gzcd pcre-8.01/./configuremake & make installcd ./2.2 编译NGINXwget /soft/linux/nginx_php/nginx/nginx-0.8.34.tar.gztar zxvf nginx-0.8.34.tar.gzcd nginx-0.8.34/./configure -user=sharera-group=sharera -prefix=/usr/local/nginx -with-http_stub_status_module -with-http_ssl_modulemake & make installcd ./2.3 创建 Nginx 日志目录mkdir -p /home/sharera/logschmod +w /home/sharera/logschown -R sharera:sharera /home/sharera/logs2.4 创建 Nginx 配置文件cp /usr/local/nginx/conf/nginx.conf /usr/local/nginx/conf/nginx.conf.bakecho “” /usr/local/nginx/conf/nginx.confvi /usr/local/nginx/conf/nginx.conf输入：user sharera sharera;worker_processes 2;error_log /home/sharera/logs/nginx_error.log crit;pid /usr/local/nginx/logs/nginx.pid;#Specifies the value for maximum file descriptors that can be opened by this process.worker_rlimit_nofile 1024;eventsuse epoll;worker_connections 1024;httpinclude mime.types;default_type application/octet-stream;#charset gb2312;server_names_hash_bucket_size 128;client_header_buffer_size 32k;large_client_header_buffers 4 32k;client_max_body_size 8m;sendfile on;tcp_nopush on;keepalive_timeout 200;tcp_nodelay on;fastcgi_connect_timeout 300;fastcgi_send_timeout 300;fastcgi_read_timeout 300;fastcgi_buffer_size 64k;fastcgi_buffers 4 64k;fastcgi_busy_buffers_size 128k;fastcgi_temp_file_write_size 128k;gzip on;gzip_min_length 1k;gzip_buffers 4 16k;gzip_http_version 1.0;gzip_comp_level 2;gzip_types text/plain application/x-javascript text/css application/xml;gzip_vary on;#limit_zone crawler $binary_remote_addr 10m;serverlisten 80;server_name ;index index.html index.htm index.php;location .*.(gif|jpg|jpeg|png|bmp|swf)$expires 30d;proxy_pass 3:8401;location .*.(js|css)?$expires 1h;proxy_pass 3:8401;location / proxy_pass 3:8401;auth_basicWelcom To SHAEWEA;auth_basic_user_file /usr/local/nginx/conf/htpasswd;#auth_basic_user_file /etc/shadow;#proxy_redirect off;#proxy_set_header X-Real-IP $remote_addr;#proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;log_format access $remote_addr - $remote_user $time_local $request $status $body_bytes_sent $http_referer $http_user_agent $http_x_forwarded_for;access_log /home/sharera/logs/access.log access;2.5 创建Nginx 配置启动脚本vi /etc/init.d/nginx输入：#!/bin/sh# nginx - this script starts and stops the nginx daemin# chkconfig: - 85 15# description: Nginx is an HTTP(S) server, HTTP(S) reverse # proxy and IMAP/POP3 proxy server# processname: nginx# config: /usr/local/nginx/conf/nginx.conf# pidfile: /usr/local/nginx/logs/nginx.pid# Source function library. /etc/rc.d/init.d/functions# Source networking configuration. /etc/sysconfig/network# Check that networking is up. $NETWORKING = no & exit 0nginx=/usr/local/nginx/sbin/nginxprog=$(basename $nginx)NGINX_CONF_FILE=/usr/local/nginx/conf/nginx.conflockfile=/var/lock/subsys/nginxstart() -x $nginx | exit 5 -f $NGINX_CONF_FILE | exit 6echo -n $Starting $prog: # daemon $nginx -c $NGINX_CONF_FILEdaemon $nginxretval=$?echo $retval -eq 0 & touch $lockfilereturn $retvalstop() echo -n $Stopping $prog: killproc $prog -QUITretval=$?echo $retval -eq 0 & rm -f $lockfilereturn $retvalrestart() configtest | return $?stopstartreload() configtest | return $?echo -n $Reloading $prog: killproc $nginx -HUPRETVAL=$?echoforce_reload() restartconfigtest() $nginx -t -c $NGINX_CONF_FILErh_status() status $progrh_status_q() rh_status /dev/null 2&1case $1 instart)rh_status_q & exit 0$1;stop)rh_status_q | exit 0$1;restart|configtest)$1;reload)rh_status_q | exit 7$1;force-reload)force_reload;status)rh_status;condrestart|try-restart)rh_status_q | exit 0;*)echo $Usage: $0start|stop|status|restart|condrestart|try-restart|reload|force-reload|configtestexit 2esac2.6 给NGINX 启动脚本执行权限chmod +x /etc/init.d/nginx2.7 把 nginx 加入到启动服务中chkconfig -add nginx2.8 启动 Nginxservice nginx stop|start|restart|reload3 生成nginx认证文件cd /usr/local/nginx/conf/htpasswd -c htpasswd testvi /etc/shadow将公司所有用户的密码串复制到/usr/local/nginx/conf/htpasswd4 网关映射.9的8401端口iptables -I INPUT -i ppp+ -p tcp -m tcp -dport 8401 -j ACCEPTiptables -t nat -I PREROUTING -p tcp -m tcp dport 8401 -j DNAT -to-destination :8401iptables -t nat -I POSTROUTING -s 192.168.2