squid配置
1. 什么是squid
squid可以做代理也可以做缓存
squid缓存不仅可以节省宝贵的带宽资源，也可以大大降低服务器的I/O.
squid不仅可以做正向代理，又可以做反向代理。
正向代理，squid后面是客户端，客户端上网要通过Squid去上；反向代理，squid后面是服务器，服务器返回给用户数据需要走squid.
正向代理用在企业的办公环境中，员工上网需要通过squid代理来上网，这样可以节省网络带宽资源。而反向代理用来搭建网站静态项(图片、html、流媒体、js、css等)的缓存服务器，它用于网站架构中。
2. 搭建squid正向代理
[ ~]# yum install -y squid
[ ~]# squid -v //查看版本以及编译参数
Squid Cache: Version 3.1.10*****************************
[ ~]# > /etc/squid/squid.conf
[ ~]# vi /etc/squid/squid.confhttp_port 3128
acl manager proto cache_object
acl localhost src 127.0.0.1/32 ::1
acl to_localhost dst 127.0.0.0/8 0.0.0.0/32 ::1
acl localnet src 10.0.0.0/8 # RFC1918 possible internal network
acl localnet src 172.16.0.0/12 # RFC1918 possible internal network
acl localnet src 192.168.0.0/16 # RFC1918 possible internal network
acl SSL_ports port 443
acl Safe_ports port 80 8080 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 # https
acl CONNECT method CONNECT
http_access allow manager localhost
http_access deny manager
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localnet
http_access allow localhost
http_access allow all
cache_dir aufs /data/cache 1024 16 256
cache_mem 128 MB
hierarchy_stoplist cgi-bin ?
coredump_dir /var/spool/squid
refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
refresh_pattern \.(jpg|png|gif|mp3|xml) 1440 50% 2880 ignore-reload
refresh_pattern . 0 20% 4320
[ ~]# mkdir /data/cache //创建缓存目录
[ ~]# chown -R squid:squid /data/cache //更改权限[ ~]# squid -z //初始化缓存目录，该步骤可以省略[ ~]# /etc/init.d/squid start
正在启动 squid： [确定][ ~]# squid -kcheck //检测squid配置文件是否正确
2015/05/27 01:52:29| WARNING: Could not determine this machines public hostname. Please configure one or set 'visible_hostname'.2015/05/27 01:52:30| WARNING: Could not determine this machines public hostname. Please configure one or set 'visible_hostname'.[ ~]# vi /etc/squid/squid.conf //在配置文件添加visible_hostname aminglinux.com[ ~]# squid -kcheck[ ~]# squid -krec[ ~]# service squid restart停止 squid：................ [确定]
正在启动 squid：. [确定]
[ mnt]# curl -x192.168.1.222:3128 -I
HTTP/1.0 200 OKServer: squid/3.4.1Date: Tue, 26 May 2015 12:33:09 GMTContent-Type: text/html; charset=GB2312Vary: Accept-EncodingVary: Accept-EncodingExpires: Tue, 26 May 2015 12:34:09 GMTCache-Control: max-age=60Vary: Accept-EncodingVary: Accept-EncodingX-Cache: HIT from tianjin.qq.comX-Cache: MISS from aminglinux.comX-Cache-Lookup: MISS from aminglinux.com:3128Via: 1.0 aminglinux.com (squid/3.1.10)Connection: keep-alive限制不能访问某些域名：
[ ~]# vi /etc/squid/squid.conf //在squid配置文件内添加如下内容
acl http proto HTTP
acl bad_domain dstdomain .taobao.com .jd.com
http_access deny http bad_domain
[ ~]# squid -kche
[ ~]# squid -krec[ mnt]# curl -x192.168.1.222:3128 -I
HTTP/1.0 403 ForbiddenServer: squid/3.1.10Mime-Version: 1.0Date: Tue, 26 May 2015 18:08:11 GMTContent-Type: text/htmlContent-Length: 3264X-Squid-Error: ERR_ACCESS_DENIED 0Vary: Accept-LanguageContent-Language: enX-Cache: MISS from aminglinux.comX-Cache-Lookup: NONE from aminglinux.com:3128Via: 1.0 aminglinux.com (squid/3.1.10)Connection: keep-alive[ mnt]# curl -x192.168.1.222:3128 -I
HTTP/1.0 200 OKServer: nginxDate: Tue, 26 May 2015 12:40:52 GMTContent-Type: text/htmlVary: Accept-EncodingX-Powered-By: PHP/5.3.28X-Cache: MISS from aminglinux.comX-Cache-Lookup: MISS from aminglinux.com:3128Via: 1.0 aminglinux.com (squid/3.1.10)Connection: keep-alive在浏览器上进行测试：
3. 搭建squid反向代理
[ ~]# vi /etc/squid/squid.conf
http_port 3128 改为 http_port 80 accel vhost vport
增加如下内容：
cache_peer 123.125.119.147 parent 80 0 originserver name=a
cache_peer 61.135.169.125 parent 80 0 originserver name=b
cache_peer_domain a www.qq.com
cache_peer_domain b www.baidu.com
之前增加的域名白/黑名单相关配置去掉
[ ~]# squid -kche
[ ~]# squid -krec[ ~]# service squid restart停止 squid：................ [确定]正在启动 squid：. [确定][ mnt]# curl -x192.168.1.222:80 -I
HTTP/1.0 200 OKServer: squid/3.4.1Date: Tue, 26 May 2015 13:00:45 GMTContent-Type: text/html; charset=GB2312Vary: Accept-EncodingVary: Accept-EncodingExpires: Tue, 26 May 2015 13:01:45 GMTCache-Control: max-age=60Vary: Accept-EncodingVary: Accept-EncodingX-Cache: HIT from tianjin.qq.comX-Cache: MISS from aminglinux.comX-Cache-Lookup: MISS from aminglinux.com:80Via: 1.0 aminglinux.com (squid/3.1.10)Connection: keep-alive[ mnt]# curl -x192.168.1.222:80 -IHTTP/1.0 503 Service UnavailableServer: squid/3.1.10Mime-Version: 1.0Date: Tue, 26 May 2015 18:29:06 GMTContent-Type: text/htmlContent-Length: 3455X-Squid-Error: ERR_CANNOT_FORWARD 0Vary: Accept-LanguageContent-Language: enX-Cache: MISS from aminglinux.comX-Cache-Lookup: MISS from aminglinux.com:80Via: 1.0 aminglinux.com (squid/3.1.10)Connection: keep-alive