配置文件如下
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
|
# 监听127.0.0.1:8080
http_port 127.0.0.1:8080 accel allow-direct
acl manager proto cache_object
http_access allow manager
# 对日志文件和pid文件位置进行设置
# cache_store_log none
# cache_access_log /var/log/squid/access.log
# cache_log /var/log/squid/cache.log
# pid_filename /var/run/squid.pid
# 取消对代理阵列的支持
icp_port 8080
# 允许所有流量
http_access allow all
# 关闭该项，这样就可以显示用户的整个请求内容
strip_query_terms off
# 64M内存缓存，2G硬盘做缓存，可自行调整
cache_mem 512 MB
cache_swap_low 90
cache_swap_high 95
cache_dir ufs
/var/spool/squid
10000 16 256
#10G 磁盘缓存 目录下分16个级别，每隔级别分256个目录
# swap 性能微调
half_closed_clients off
maximum_object_size 65536 KB
minimum_object_size 0 KB
# 设置内存中最大可缓存的最大文件大小
maximum_object_size_in_memory 512 KB
# 内存和硬盘cache的替换策略
memory_replacement_policy lru
cache_replacement_policy lru
# http1.0的vary信息里带有过期时间的话，squid还是不能缓存住。打开此选项提高缓存命中率
vary_ignore_expire on
# 合并回源，多个回源流量变成一个回源,这个在大文件时,也比较有用。
collapsed_forwarding on
# 一些优化参数
refresh_pattern ^
ftp
: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern (cgi-bin|\?) 0 0% 0
refresh_pattern \.(jpg|png|gif|mp3|xml|html|htm|css|js) 1440 80% 2880 ignore-reload
refresh_pattern ^
/forum/viewthread
.php 1440 1000% 1440 ignore-reload
refresh_pattern . 0 20% 4320
refresh_pattern -i .html 1440 90% 129600 reload-into-ims
refresh_pattern -i .shtml 1440 90% 129600 reload-into-ims
refresh_pattern -i .hml 1440 90% 129600 reload-into-ims
refresh_pattern -i .gif 1440 90% 129600 reload-into-ims
refresh_pattern -i .swf 1440 90% 129600 reload-into-ims
refresh_pattern -i .jpg 1440 90% 129600 reload-into-ims
refresh_pattern -i .png 1440 90% 129600 reload-into-ims
refresh_pattern -i .bmp 1440 90% 129600 reload-into-ims
refresh_pattern -i .js 1440 90% 129600 reload-into-ims
refresh_pattern -i .css$ 1440 90% 2880 reload-into-ims
refresh_pattern -i .doc$ 1440 50% 2880 ignore-reload
refresh_pattern -i .ppt$ 1440 50% 2880 ignore-reload
refresh_pattern -i .xls$ 1440 50% 2880 ignore-reload
refresh_pattern -i .pdf$ 1440 50% 2880 ignore-reload
refresh_pattern -i .rar$ 1440 50% 2880 ignore-reload
refresh_pattern -i .zip$ 1440 50% 2880 ignore-reload
refresh_pattern -i .txt$ 1440 50% 2880 ignore-reload
# 禁止代理识别
via off
forwarded_for off
request_header_access From deny all
request_header_access Server deny all
request_header_access WWW-Authenticate deny all
request_header_access Link deny all
request_header_access Cache-Control deny all
request_header_access Proxy-Connection deny all
request_header_access X-Cache deny all
request_header_access X-Cache-Lookup deny all
request_header_access Via deny all
request_header_access X-Forwarded-For deny all
request_header_access Pragma deny all
request_header_access Keep-Alive deny all
|
系统内核优化
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
|
net.ipv6.conf.all.accept_ra = 2
net.core.default_qdisc = fq
net.ipv4.tcp_congestion_control = bbr
net.ipv4.ip_forward = 0
net.ipv4.conf.default.rp_filter = 1
net.ipv4.conf.default.accept_source_route = 0
kernel.sysrq = 0
kernel.core_uses_pid = 1
net.ipv4.tcp_syncookies = 1
kernel.msgmnb = 65536
kernel.msgmax = 65536
kernel.shmmax = 68719476736
kernel.shmall = 4294967296
net.ipv4.tcp_max_tw_buckets = 10000
net.ipv4.tcp_sack = 1
net.ipv4.tcp_window_scaling = 1
net.ipv4.tcp_rmem = 4096 87380 4194304
net.ipv4.tcp_wmem = 4096 16384 4194304
net.core.wmem_default = 8388608
net.core.rmem_default = 8388608
net.core.rmem_max = 16777216
net.core.wmem_max = 16777216
net.core.netdev_max_backlog = 262144
net.core.somaxconn = 262144
net.ipv4.tcp_max_orphans = 3276800
net.ipv4.tcp_max_syn_backlog = 262144
net.ipv4.tcp_timestamps = 0
net.ipv4.tcp_synack_retries = 1
net.ipv4.tcp_syn_retries = 1
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_mem = 94500000 915000000 927000000
net.ipv4.tcp_fin_timeout = 1
net.ipv4.tcp_keepalive_time = 15
net.ipv4.ip_local_port_range = 1024 65535
|
最后配置流量转发
|
1
|
iptables -t nat -I PREROUTING -i ens3 -s ip1
/32
-p tcp --dport 80 -j REDIRECT --to-port 8080
|
意思是把本地ens3 网口的请求流量转发到本地8080 端口上，squid 监听的是本地8080
也可以这样写
|
1
2
3
|
# 将 对于 80、443 端口的访问 重定向到 3128 端口 </P><P>
iptables -t nat -A PREROUTING -i eth1 -p tcp -s 192.168.0.0
/24
--dport 80 -j DNAT --to 192.168.0.1:3128
iptables -t nat -A PREROUTING -i eth1 -p tcp -s 192.168.0.0
/24
--dport 443 -j DNAT --to 192.168.0.1:3128
|
最后这个没试过，慎用
本文转自wks9751CTO博客，原文链接：http://blog.51cto.com/wks97/2051048 ，如需转载请自行联系原作者
