高速INTERNET代理服务器解决方案

    本文在FREEBSD系统上，利用大家熟知的SQUID代理软件配合RAMDISK技术和DNS CACHE服务器搭建了一个高速代理服务器。基于RAM的目录池(有时也叫做RAMDISK)可以显著的改善应用程序的性能，特别是对那些I/O比较剧烈的程序更是如此。因为在基于RAM的目录池中的所有I/O操作实际上都是在RAM中完成的。这个在FREEBSD上是很容易实现的。初步使用这个高速代理服务器发现访问网站速度的确有了质的飞跃。SQUID负责代理WWW，其他网络服务使用PF的NAT实现，并在PF中设置了SQUID透明代理（端口转发）。

    服务器断电或关机后squid缓存的内容会随即消失，不过做为代理服务器不会经常关机的，这个应该是不什么问题。现在整理一下具体操作过程，有兴趣的朋友不妨一试。

    1. 首先安装SQUID

    1.0 利用ports 安装squid

    # cd /usr/ports/www/squid
    # vi Makefile

    加入下面的编译参数

--disable-ident-lookups
--disable-internal-dns
--enable-pf-transparent
--enable-default-err-language=Simplify_Chinese
--disable-hostname-checks

    # make install clean

    1.1 配置squid服务

# vi /usr/local/etc/squid/squid.conf
===========+===========+===========+===========
http_port 127.0.0.1:3128                        //squid服务器监听地址和端口
cache_mem 56 MB                                //squid内存使用大小控制
cache_swap_low 80                        //cache目录空间使用控制
cache_swap_high 90                        //cache目录空间使用控制
maximum_object_size_in_memory 32 KB//内存中最大可以cache多大的文件
cache_dir ufs /usr/local/squid/cache 200 16 256        //磁盘上cache目录大小设置
cache_access_log none                        //为了提高性能关掉了日志
cache_log none
cache_store_log none
emulate_httpd_log on                        //启用http日志格式
dns_children 15                                //查询DNS服务器的线程数量
acl our_networks src 192.168.0.0/16                       //定义LAN网段
http_access allow our_networks                //允许通过定义的网段
http_access deny all                        //其他网段DENY掉

http_reply_access allow all                        //允许应答其他常用的一些请求
icp_access allow all                                //允许应答其他常用的一些请求
miss_access allow all                        //允许应答其他常用的一些请求

cache_mgr llzqq@126.com        //squid管理员联系方法
visible_hostname llzqq.3322.org                //squid主机名称
httpd_accel_port 80                                //web主机端口 
httpd_accel_single_host off                        //要是想用反向代理而且仅有一个主机开启此项
httpd_accel_with_proxy on                        //是否代理本地web主机
httpd_accel_host virtual                        //允许host_header,这是http1.1和透明代理要求的
httpd_accel_uses_host_header on                //允许host_header,这是http1.1和透明代理要求的
error_directory /usr/local/etc/squid/errors/Simplify_Chinese//以何种语言显示错误
ie_refresh on                                //兼容老版本的IE浏览器

    1.2 手动建立高速缓存

    # mdmfs -M -s 204m -O time -o noatime -p 0700 -v 2 -w squid:squid md0 \
/usr/local/squid/cache

-M 代表创建一个malloc型,默认是swap
-O是优化，可选为time和space
-o为mount选项
-p是挂载点权限
-v是UFS版本（1、2）
-w是owner和group
md0是设备名
/usr/local/squid/cache是挂载点
注意，不用先创建md0, mdmfs会自己创建

    详细参数说明在这里：http://www.freebsd.org/cgi/man.cgi?query=mdmfs&sektion=8

    1.3 创建cache目录

    # squid -z

    1.4 定制squid启动教本

    # vi /usr/local/etc/rc.d/squid.sh

#!/bin/sh
# llzqq@126.com
case "$1" in
start)
if [ ! /usr/local/squid/cache/00 ]; then
/usr/local/sbin/squid -D
echo "squid start successful"
else
/usr/local/sbin/squid –z
sleep 5
/usr/local/sbin/squid -D
fi
;;
stop)
/usr/local/sbin/squid -k kill
;;
reload)
/usr/local/sbin/squid -k reconfigure
;;
*)
echo "use: start|stop|reload"
;;
esac
exit 0

# chmod 555 /usr/local/etc/rc.d/squid.sh

    1.5 设置开机自动挂载高速缓存

    # vi /etc/fstab
    在文件最后加入下面这行
    /dev/md0    /usr/local/squid/cache  mfs     rw,-s204m       2       0

    2. 安装DNS CAHCE服务器

    2.0 利用ports安装bind

# cd /usr/ports/dns/bind9
# make install clean
# vi /etc/namedb/named.conf

acl "trust-lan" { 127.0.0.1/8; 192.168.0.0/16;};
options {
                directory "/etc/namedb";
pid-file "/var/run/named/pid";
version "0.0.0";
recursion yes;
allow-recursion {
"trust-lan";
};
auth-nxdomain no;
listen-on       { 192.168.0.20; 192.168.1.10; 127.0.0.1; };
forwarders {
202.99.160.68;
202.99.168.8;};
};
logging {
        channel warning
        { file "/var/log/named/dns_warnings" versions 3 size 1240k;
        severity warning;
        print-category yes;
        print-severity yes;
        print-time yes;
        };
        channel general_dns
        { file "/var/log/named/dns_logs" versions 3 size 1240k;
        severity info;
        print-category yes;
        print-severity yes;
        print-time yes;
        };
        category default { warning; };
        category queries { general_dns; };
};
zone "." {
        type hint;
        file "named.root";
};

    zone "0.0.127.IN-ADDR.ARPA" {
        type master;
        file "localhost.rev";
    };

# cd /etc/namedb
# rm named.root
# wget ftp://ftp.internic.org/domain/named.root

    2.2 创建日志文件

# mkdir /var/log/named/
# touch /var/log/named/dns_warnings
# touch /var/log/named/dns_logs
# chown bind:wheel /var/log/named/*

    2.3 生成localhost.rev

# cd /etc/namedb
# chmod 755 make-localhost 
# ./make-localhost

    2.4 生成rndc-key

# cd /usr/local/etc
# /usr/local/sbin/rndc-confgen > rndc.conf

把rndc.conf中：
# Use with the following in named.conf, adjusting the allow list as needed:
后面以的部分加到/etc/namedb/named.conf中并去掉注释

    2.5 运行测试

# /usr/local/sbin/named -gc /etc/namedb/named.conf
23-Jan-2006 21:03:03.224 starting BIND 9.3.2 -gc /etc/namedb/named.conf
23-Jan-2006 21:03:03.229 loading configuration from '/etc/namedb/named.conf'
23-Jan-2006 21:03:03.230 no IPv6 interfaces found
23-Jan-2006 21:03:03.230 listening on IPv4 interface rl0, 192.168.0.20#53
23-Jan-2006 21:03:03.230 listening on IPv4 interface rl1, 192.168.1.10#53
23-Jan-2006 21:03:03.231 listening on IPv4 interface lo0, 127.0.0.1#53
23-Jan-2006 21:03:03.235 command channel listening on 127.0.0.1#953
23-Jan-2006 21:03:03.235 ignoring config file logging statement due to -g option
23-Jan-2006 21:03:03.254 zone 0.0.127.IN-ADDR.ARPA/IN: loaded serial 20051219
23-Jan-2006 21:03:03.254 running

    2.6 状态检查

# rndc status
number of zones: 1
debug level: 0
xfers running: 0
xfers deferred: 0
soa queries in progress: 0
query logging is OFF
recursive clients: 0/1000
tcp clients: 0/100
server is up and running

    2.7 建立启动脚本

    # vi /usr/local/etc/rc.d/named.sh

#!/bin/sh
# Start and Stop BIND Service on FreeBSD
# LLZQQ@126.COM
#
. /etc/rc.subr
name="named"
start_cmd="start"
stop_cmd="stop"

start()
{
        if [ "$named_enable" = "YES" ]; then
        /usr/local/sbin/named -u bind -c /etc/namedb/named.conf &
        echo "named started"
        fi
}

stop()
{
        pkill named
        echo "named stoped"
}

load_rc_config $name
run_rc_command "$1"

    # chmod 555 /usr/local/etc/rc.d/named.sh

    3. 防火墙设置

    # vi /etc/pf.conf

ext_if = "{ fxp0 }"
int_if = "{ rl0, rl1 }"
int_net = "{ 192.168.0.0/16 }"
loop = "lo0"
noroute = "{ 127.0.0.1/8, 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8, 255.255.255.255/32 }"
ports = "{ 20, 21, 22, 25, 53, 80, 110 }"
squid = "{127.0.0.1}"

set block-policy return
set optimization aggressive
set loginterface fxp0
set skip on lo0

scrub in all
nat on $ext_if from $int_net to any -> $ext_if

### squid transparent
rdr on $int_if proto tcp from any to any port 80 -> $squid port 3128

antispoof for $ext_if inet

block all
block return
block in quick on $ext_if os NMAP
block in quick on $ext_if from $noroute to any
block out quick on $ext_if from any to $noroute

pass quick on $loop all
pass quick on $int_if all
pass in on $ext_if proto {tcp,udp} from any to any port $ports keep state
pass in quick proto tcp from any to any port 55000 >< 56000 keep state
pass out on $ext_if all keep state

    4. 其他一些网络的设置

# vi /etc/rc.conf
hostname="llzqq.3322.org"
defaultrouter="61.211.x.x"
ifconfig_rl0="inet 192.168.0.20 netmask 255.255.255.0"
ifconfig_rl1="inet 192.168.1.10 netmask 255.255.255.0"
ifconfig_fxp0="inet 61.211.x.x netmask 255.255.255.224"
named_enable="YES"
pf_enable="YES"                                        # Set to YES to enable packet filter (pf)
pf_rules="/etc/pf.conf"                        # rules definition file for pf
pf_program="/sbin/pfctl"                # where the pfctl program lives
pf_flags=""                                                # additional flags for pfctl
pflog_enable="YES"                                # Set to YES to enable packet filter logging
pflog_logfile="/var/log/pflog"        # where pflogd should store the logfile
pflog_program="/sbin/pflogd"        # where the pflogd program lives
pflog_flags=""

# vi /etc/resolv.conf
nameserver 211.98.2.4
nameserver 202.99.168.8
nameserver 202.99.160.68

# vi /etc/sysctl.conf
net.inet.ip.forwarding=1
net.inet.ip.check_interface=1
net.inet.tcp.blackhole=2
net.inet.udp.blackhole=1
net.inet.tcp.recvspace=65535
net.inet.tcp.sendspace=65535

# vi /boot/loader.conf
kern.maxfiles="65536"

    客户端设置网关和DNS的IP地址为这台SQUID代理服务器的IP地址。