设为首页收藏本站

简体中文 繁體中文 English 日本語 Deutsch 한국 사람 بالعربية TÜRKÇE português คนไทย

切换到窄版

 找回密码
 立即注册

QQ登录

只需一步，快速开始

搜索
恩山无线论坛»论坛 › 无线设备软件相关板块 › OPENWRT专版 › 如果在 openwrt 上架设一个缓存服务器
广告投放联系QQ68610888
返回列表 发新帖
查看: 6909|回复: 2

如果在 openwrt 上架设一个缓存服务器

[复制链接]
发表于 2015-4-22 20:53 | 显示全部楼层 |阅读模式
请问有意义吗?
我的恩山、我的无线 The best wifi forum is right here.
回复

使用道具 举报

发表于 2015-4-23 09:20 | 显示全部楼层
你的目的和用途是什么？
我的恩山、我的无线 The best wifi forum is right here.
回复

使用道具 举报

 楼主| 发表于 2019-6-12 21:53 | 显示全部楼层
本帖最后由 loveqianool 于 2019-6-12 22:16 编辑

闲着没事还是照网上教程搭了个，使用体验就是经常无缘无故的卡一会儿，这里发一下过程吧。
  1. opkg update && opkg install libustream-openssl ca-bundle ca-certificates luci-app-squid
复制代码
#现在安装的 squid 版本是 3.5.27
#创建缓存目录
  1. mkdir /mnt/squid/cache
复制代码
#设置权限
  1. chmod 777 /mnt/squid
复制代码
#初始化缓存目录
  1. squid -z
复制代码

#自签证书, z.der 需要客户端导入，以便代理 https
  1. openssl req -new -newkey rsa:2048 -sha256 -days 365 -nodes -x509 -extensions v3_ca -keyout z.pem -out z.pem
复制代码
  1. openssl x509 -in z.pem -outform DER -out z.der
复制代码
  1. openssl dhparam -dsaparam -out z.dh 2048
复制代码

#编辑 /etc/config/squid 取消所有注释
  1. config squid 'squid'
  2.         option config_file '/etc/squid/squid.conf'
  3.         option http_port '3128'
  4.         option coredump_dir '/tmp/squid'
  5.         option visible_hostname 'OpenWrt'
  6.         option mime_table '/etc/squid/mime.conf'
  7.         option http_port_options 'intercept'
  8.         option ssldb '/mnt/squid/ssldb'
  9.         option ssldb_options '-M 32MB'
复制代码

#编辑 /etc/squid/squid.conf 或者在 luci 界面 - 服务 - squid - 高级设置 中填入以下配置
  1. #设置路由 ip 及端口和自签证书位置
  2. http_port 192.168.1.233:3131 ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=10MB cert=/etc/squid/z.pem capath=/etc/ssl/certs/ cipher=EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:HIGH:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS tls-dh=prime256v1:/etc/squid/z.dh options=NO_SSLv2,NO_SSLv3,SINGLE_DH_USE,SINGLE_ECDH_USE

  4. http_port 127.0.0.1:3129 intercept ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=10MB cert=/etc/squid/z.pem capath=/etc/ssl/certs/ cipher=EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:HIGH:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS tls-dh=prime256v1:/etc/squid/z.dh options=NO_SSLv2,NO_SSLv3,SINGLE_DH_USE,SINGLE_ECDH_USE

  6. https_port 127.0.0.1:3130 intercept ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=10MB cert=/etc/squid/z.pem capath=/etc/ssl/certs/ cipher=EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:HIGH:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS tls-dh=prime256v1:/etc/squid/z.dh options=NO_SSLv2,NO_SSLv3,SINGLE_DH_USE,SINGLE_ECDH_USE

  8. icp_port 0
  9. digest_generation off
  10. dns_v4_first on
  11. pid_filename /var/run/squid.pid
  12. #cache_effective_user squid
  13. #cache_effective_group proxy
  14. #error_default_language zh-cn
  15. icon_directory /usr/share/squid/icons
  16. #visible_hostname z_Squid
  17. cache_mgr <a href="mailto:z@qq.com">z@qq.com</a>
  18. logfile_daemon /dev/null
  19. access_log /var/squid/access.log
  20. cache_log /var/squid/cache.log
  21. cache_store_log none
  22. netdb_filename /var/squid/netdb.state
  23. #sslcrtd_program /usr/lib/squid/ssl_crtd -s /mnt/squid/squid_ssldb -M 10MB -b 2048
  24. sslcrtd_children 5
  25. sslproxy_capath /etc/ssl/certs/
  26. sslproxy_options NO_SSLv2,NO_SSLv3,SINGLE_DH_USE,SINGLE_ECDH_USE
  27. sslproxy_cipher EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:HIGH:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS
  28. sslproxy_cert_error allow all
  29. sslproxy_flags DONT_VERIFY_PEER
  30. sslproxy_cert_adapt setValidAfter all
  31. sslproxy_cert_adapt setValidBefore all

  33. logfile_rotate 2
  34. debug_options rotate=2
  35. shutdown_lifetime 3 seconds
  36. # Allow local network(s) on interface(s)
  37. #设置连接网段
  38. acl localnet src  192.168.0.0/16
  39. forwarded_for delete
  40. #via off
  41. uri_whitespace strip
  42. #设置 dns 服务器
  43. dns_nameservers 192.168.1.233

  45. #设置内存缓存大小 1G
  46. cache_mem 1024 MB
  47. maximum_object_size_in_memory 4096 KB
  48. #memory_replacement_policy heap GDSF
  49. #cache_replacement_policy heap LFUDA
  50. minimum_object_size 0 KB
  51. maximum_object_size 16 MB
  52. #设置磁盘缓存大小 10G
  53. cache_dir aufs /mnt/squid/cache 10240 16 256
  54. offline_mode off
  55. cache_swap_low 90
  56. cache_swap_high 95
  57. cache allow all

  59. refresh_pattern -i (\.|-)(ico(.*)?|pn[pg]|(g|t)iff?|jpe?g(2|3|4)?|psd|c(d|b)r|cad|bmp|img)(\?.*)?$ 21600 100% 43200 override-expire override-lastmod reload-into-ims ignore-reload ignore-no-cache ignore-no-store ignore-private ignore-auth
  60. refresh_pattern -i (\.|-)(webm|(x-)?swf|mp(eg)?(3|4)|mpe?g(av)?|(x-)?f(l|4)v|divx?|rmvb?|mov|trp|ts|avi|m38u|wmv|wmp|m4v|mkv|asf|dv|vob|3gp?2?)(\?.*)?$ 21600 100% 43200 override-expire override-lastmod reload-into-ims ignore-reload ignore-no-cache ignore-no-store ignore-private ignore-auth

  62. refresh_pattern -i (\.|-)(xml|js|jsp|txt|css)(\?.*)?$ 360 40% 1440 override-expire override-lastmod reload-into-ims ignore-reload ignore-no-cache ignore-no-store ignore-private ignore-auth
  63. refresh_pattern -i .index.(html|htm)$ 0 40% 1440

  65. # Add any of your own refresh_pattern entries above these.
  66. refresh_pattern ^ftp:    1440  20%  10080
  67. refresh_pattern ^gopher:  1440  0%  1440
  68. refresh_pattern -i (/cgi-bin/|\?) 0  0%  0
  69. refresh_pattern .    0  20%  4320

  71. #Remote proxies

  73. # Setup some default acls
  74. # ACLs all, manager, localhost, and to_localhost are predefined.
  75. acl allsrc src all
  76. acl safeports port 21 70 80 210 280 443 488 563 591 631 777 901  3128 3129 1025-65535
  77. acl sslports port 443 563  

  79. acl purge method PURGE
  80. acl connect method CONNECT

  82. # Define protocols used for redirects
  83. acl HTTP proto HTTP
  84. acl HTTPS proto HTTPS

  86. # SslBump Peek and Splice
  87. # <a href="http://wiki.squid-cache.org/Features/SslPeekAndSplice" target="_blank">http://wiki.squid-cache.org/Features/SslPeekAndSplice</a>
  88. # <a href="http://wiki.squid-cache.org/ConfigExamples/Intercept/SslBumpExplicit" target="_blank">http://wiki.squid-cache.org/Conf ... ept/SslBumpExplicit</a>
  89. # Match against the current step during ssl_bump evaluation [fast]
  90. # Never matches and should not be used outside the ssl_bump context.
  91. #
  92. # At each SslBump step, Squid evaluates ssl_bump directives to find
  93. # the next bumping action (e.g., peek or splice). Valid SslBump step
  94. # values and the corresponding ssl_bump evaluation moments are:
  95. #   SslBump1: After getting TCP-level and HTTP CONNECT info.
  96. #   SslBump2: After getting TLS Client Hello info.
  97. #   SslBump3: After getting TLS Server Hello info.
  98. # These ACLs exist even when 'SSL/MITM Mode' is set to 'Custom' so that
  99. # they can be used there for custom configuration.
  100. acl step1 at_step SslBump1
  101. acl step2 at_step SslBump2
  102. acl step3 at_step SslBump3
  103. http_access allow manager localhost

  105. http_access deny manager
  106. http_access allow purge localhost
  107. http_access deny purge
  108. http_access deny !safeports
  109. http_access deny CONNECT !sslports

  111. # Always allow localhost connections
  112. http_access allow localhost

  114. quick_abort_min -1 KB
  115. quick_abort_max 0 KB
  116. request_body_max_size 0 KB
  117. delay_pools 1
  118. delay_class 1 2
  119. delay_parameters 1 -1/-1 -1/-1
  120. delay_initial_bucket_level 100
  121. delay_access 1 allow allsrc

  123. # Reverse Proxy settings

  125. # Custom options before auth

  127. ssl_bump peek step1
  128. ssl_bump bump all
  129. # Setup allowed ACLs
  130. # Allow local network(s) on interface(s)
  131. http_access allow localnet
  132. # Default block all to be sure
  133. http_access deny allsrc

  135. #上面有中文注释的都要改一下。
复制代码
# 检查配置，没有报错就启动。
  1. squid -k parse
复制代码
  1. /etc/init.d/squid restart
复制代码
# 客户端设置代理后，以下命令查看经过 squid 的链接
  1. tail -f /var/squid/access.log
复制代码
# 以下命令查看命中缓存的连接
  1. tail -f /var/squid/access.log | grep HIT
复制代码

使用这个代理访问 https 网站有安全风险，好像是说所有 https 网站都不加密了？我也不懂，反正不要使用代理访问银行网站之类的。
我的恩山、我的无线 The best wifi forum is right here.
回复

使用道具 举报

返回列表 发新帖
高级模式
B Color Image Link Quote Code Smilies
您需要登录后才可以回帖 登录 | 立即注册

本版积分规则

有疑问请添加管理员QQ86788181|手机版|小黑屋|Archiver|恩山无线论坛(常州市恩山计算机开发有限公司版权所有) ( 苏ICP备05084872号 )

GMT+8, 2024-4-18 20:33

Powered by Discuz! X3.5

© 2001-2024 Discuz! Team.

| 江苏省互联网有害信息举报中心 举报信箱：js12377 | @jischina.com.cn 举报电话：025-88802724 本站不良内容举报信箱：68610888@qq.com 举报电话：0519-86695797

快速回复 返回顶部 返回列表