CentOS如何配置Nginx反向代理

一、反向代理及演示环境描述

1、反向代理

在计算机网络中，反向代理是一种代理服务器，代表客户端从一个或多个服务器检索资源。然后将这些资源返回给客户机，就像它们源自Web服务器本身一样。与正向代理相反，正向代理是与其关联的客户端联系任何服务器的中介，反向代理是任何客户端与其关联的服务器进行联系的中介。

有关正向代理可参考：基于CentOS 7配置Nginx正向代理

2、本演示中的几个服务器

二、常规反向代理配置

1、后端服务器配置(Apache)

后端Apache服务器主机名及IP

#hostnamecentos7-web.example.com#more/etc/redhat-releaseCentOSLinuxrelease7.2.1511(Core)#ipaddr|grepinet|grepglobalinet172.24.8.128/24brd172.24.8.255scopeglobaleno16777728#systemctlstarthttpd.service#echo"Thisisahttpdtestpage.">/var/www/html/index.html#curlhttp://localhostThisisahttpdtestpage.

2、前端Nginx反向代理服务器配置

前端Nginx服务器主机名及IP

#hostnamecentos7-router#more/etc/redhat-releaseCentOSLinuxrelease7.2.1511(Core)#ipaddr|grepinet|grepglobalinet172.24.8.254/24brd172.24.8.255scopeglobaleno16777728inet192.168.1.175/24brd192.168.1.255scopeglobaldynamiceno33554960

Nginx版本

#nginx-Vnginxversion:nginx/1.10.2

添加一个新的配置文件用作反向代理

#vim/etc/nginx/conf.d/reverse_proxy.confserver{listen8090;server_namelocalhost;location/{proxy_passhttp://172.24.8.128;###反向代理核心指令proxy_buffers2564k;proxy_max_temp_file_size0;proxy_connect_timeout30;proxy_cache_valid20030210m;proxy_cache_valid3011h;proxy_cache_validany1m;}}#systemctlreloadnginx#ss-nltp|grepnginx|grep8090LISTEN0128*:8090*:*users:(("nginx",pid=78023,fd=8),("nginx",pid=78021,fd=8))#curlhttp://localhost:8090##基于本地测试Thisisahttpdtestpage.

查看Apache服务器日志

#more/var/log/httpd/access_log##请求IP地址为172.24.8.254，当从其他机器请求时也是172.24.8.254这个IP172.24.8.254--[30/Oct/2017:14:02:38+0800]"GET/HTTP/1.0"20027"-""curl/7.29.0"

3、反向代理服务器及后端服务器日志格式设置

为Nginx服务器添加proxy_set_header指令，修改后如下

#grepproxy_set_header-B2/etc/nginx/conf.d/reverse_proxy.conflocation/{proxy_passhttp://172.24.8.128;proxy_set_headerX-Real-IP$remote_addr;}#systemctlreloadnginx.service

后端服务器Apache日志格式设置

#vim/etc/http/conf/httpd.conf#LogFormat"%h%l%u%t\"%r\"%>s%b\"%{Referer}i\"\"%{User-Agent}i\""combined#注释此行，添加下一行LogFormat"%{X-Real-IP}i%l%u%t\"%r\"%>s%b\"%{Referer}i\"\"%{User-Agent}i\""combined#关键描述{X-Real-IP}i#ipaddr|grepinet|grepglobal#从1.132主机访问inet192.168.1.244/24brd192.168.1.255scopeglobaleth0#curlhttp://192.168.1.175:8090#从1.244主机访问Thisisahttpdtestpage#再次查看apache访问日志，如下，不再是代理服务器IP地址，此时显示为1.244192.168.1.244--[30/Oct/2017:15:49:07+0800]"GET/HTTP/1.0"20027"-""curl/7.19.7(x86_64-redhat-linux-gnu)libcurl/7.19.7NSS/3.14.0.0zlib/1.2.3libidn/1.18libssh3/1.4.2"

三、基于目录匹配反向代理

后端服务器采用Nginx的配置

#more/etc/redhat-release##os平台及ip地址CentOSrelease6.7(Final)#ipaddr|grepeth0|grepglobalinet192.168.1.132/24brd192.168.1.255scopeglobaleth0#nginx-v##nginx版本nginxversion:nginx/1.10.2#mkdir-pv/usr/share/nginx/html/images##创建图片目录mkdir:createddirectory`/usr/share/nginx/html/images'#cp/usr/share/backgrounds/nature/*.jpg/usr/share/nginx/html/images/.##复制图片文件#cp/etc/nginx/conf.d/default.conf/etc/nginx/conf.d/default.conf.bk#vim/etc/nginx/conf.d/default.conf##此处直接修改缺省配置文件server{listen80default_server;listen[::]:80default_server;server_name_;root/usr/share/nginx/html;#Loadconfigurationfilesforthedefaultserverblock.include/etc/nginx/default.d/*.conf;location/{}location/images{alias/usr/share/nginx/html/images;##此处配置了别名}error_page404/404.html;location=/40x.html{}error_page500502503504/50x.html;location=/50x.html{}}#/etc/init.d/nginxreloadReloadingnginx:[OK]

前端Nginx配置

#vim/etc/nginx/conf.d/reverse_proxy.confserver{listen8090;server_namelocalhost;location/{proxy_passhttp://172.24.8.128;proxy_set_headerX-Real-IP$remote_addr;}location/images{##将images目录下的文件代理至192.168.1.132proxy_passhttp://192.168.1.132;proxy_set_headerX-Real-IP$remote_addr;}}#systemctlreloadnginx

验证代理情况，在ip为192.168.1.244测试对images目录下的jpg文件请求

#ipaddr|grepinet|grepglobalinet192.168.1.244/24brd192.168.1.255scopeglobaleth0#curl-Ihttp://192.168.1.175:8090/images/Garden.jpgHTTP/1.1200OKServer:nginx/1.12.2Date:Tue,31Oct201701:48:18GMTContent-Type:image/jpegContent-Length:264831Connection:keep-aliveLast-Modified:Mon,30Oct201708:21:28GMTETag:"59f6e108-40a7f"Accept-Ranges:bytes

四、基于特定文件类型的反向代理配置

php服务器端配置(ip 192.168.1.132)

#ss-nltp|grepphpLISTEN0128192.168.1.132:9000*:*users:(("php-fpm",7147,8),("php-fpm",7148,0),("php-fpm",7149,0))#mkdir-pv/data###存放php代码#echo"/data192.168.1.0/24(rw)">/etc/exports#/etc/init.d/rpcbindstart#/etc/init.d/nfslockstart#/etc/init.d/nfsstart#echo"">/data/index.php

Nginx代理端配置(ip 192.168.1.175)

#mkdir/data#mount-tnfs192.168.1.132:/data/data#ls/dataindex.php#vim/etc/nginx/conf.d/reverse_proxy.confserver{listen8090;server_namelocalhost;location/{proxy_passhttp://172.24.8.128;proxy_set_headerX-Real-IP$remote_addr;}location/images{proxy_passhttp://192.168.1.132;proxy_set_headerX-Real-IP$remote_addr;}location~\.php${root/data;fastcgi_pass192.168.1.132:9000;fastcgi_indexindex.php;fastcgi_paramSCRIPT_FILENAME/scripts$fastcgi_script_name;includefastcgi_params;}}#systemctlrestartnginx

测试反向代理至php

[root@ydq05~]#ipaddr|grepinet|grepglobalinet192.168.1.244/24brd192.168.1.255scopeglobaleth0[root@ydq05~]#curl-Ihttp://192.168.1.175:8090/index.phpHTTP/1.1200OKServer:nginx/1.12.2Date:Tue,31Oct201703:22:59GMTContent-Type:text/html;charset=UTF-8Connection:keep-aliveX-Powered-By:PHP/5.6.0

五、基于upstream 配置反向代理至tomcat

Nginx upstream指令也可以将请求代理到后端服务器 如下示例，结合upstream指令演示将其代理到tomcat

#vim/etc/nginx/conf.d/tomcat.confupstreamapp{serverlocalhost:8080;keepalive32;}server{listen80;server_namelocalhost;location/{proxy_set_headerHost$host;proxy_set_headerx-for$remote_addr;proxy_set_headerx-server$host;proxy_set_headerx-agent$http_user_agent;proxy_passhttp://app;}}[root@node132conf.d]#ss-nltp|grepjavaLISTEN01::ffff:127.0.0.1:8005:::*users:(("java",39559,45))LISTEN0100:::8009:::*users:(("java",39559,43))LISTEN0100:::8080:::*users:(("java",39559,42))tomcat版本[root@node132conf.d]#/usr/local/tomcat/bin/catalina.shversionUsingCATALINA_BASE:/usr/local/tomcatUsingCATALINA_HOME:/usr/local/tomcat....Serverversion:ApacheTomcat/7.0.69Serverbuilt:Apr11201607:57:09UTCServernumber:7.0.69.0OSName:LinuxOSVersion:2.6.32-573.el6.x86_64Architecture:amd64JVMVersion:1.7.0_79-b15JVMVendor:OracleCorporation验证结果#curlhttp://localhost......

六、proxy模块指令描述

proxy模块的可用配置指令非常多，它们分别用于定义proxy模块工作时的诸多属性，如连接超时时长、代理时使用http协议版本等。下面对常用的指令做一个简单说明。

proxy_read_timeout    在连接断开之前两次从接收upstream server接收读操作的最大间隔时长；

如下面的一个示例：

proxy_redirectoff;proxy_set_headerHost$host;proxy_set_headerX-Real-IP$remote_addr;proxy_set_headerX-Forwarded-For$proxy_add_x_forwarded_for;client_max_body_size10m;client_body_buffer_size128k;proxy_connect_timeout30;proxy_send_timeout15;proxy_read_timeout15;