FREEBSD5.4+PF+SQUID Reverse Proxy actual combat notes

1, hardware configuration

HP NETSERVER pⅲ1000 Memory 256M Inter82559 network card two sheets

2. Zoning situation

FileSystem Size Used Avail Capacity mounted on

/DEV/DA0S1A 248M 54M 174M 24%/

Devfs 1.0K 1.0K 0B 100%/dev

/dev/da0s1f 4.8G 130M 4.3G 3%/home

/dev/da0s1d 248M 12K 228M 0%/tmp

/dev/da0s1g 4.8G 565M 3.9G 12%/usr

/dev/da0s1e 5.8G 410K 5.3G 0%/var

3. Installation of the system

With minimal installation

And the installation of SRC and ports (originally intended to use ports installation, but do not know how to do, unexpectedly can not CVS source code, of course, can not be installed through the ports, but only the use of the source code compiled)

4. Kernel compilation

There is no optimization for the kernel, here just to verify the feasibility of PF and squid combined with reverse proxy, in the actual production applications should be to the server kernel to do some degree of optimization.

Cd/usr/src/sys/i386/conf

CP GENERIC Cache

Edit Kernel cache Add the following options to the kernel

Device PF

Device Pflog

Device Pfsync

Options ALTQ

Options ALTQ_CBQ

Compiling the kernel

/usr/sbin/config Cache

Cd.. /config/cache

Make depend

Make

Make install

This completes the kernel

Reboot

5, let the system automatically load PF

Edit/etc/rc.conf

Usbd_enable= "NO"

Defaultrouter= "218.4.xxx.xxx"

Hostname= "Cache.aaa.com"

ifconfig_fxp0= "inet 218.4.xxx.xxx netmask 255.255.255.248"

ifconfig_fxp1= "inet 192.168.2.10 netmask 255.255.255.0"

Gateway_enable= "YES"

Inetd_enable= "YES"

Pf_enable= "YES"

Pf_rules= "/etc/pf.conf"

Pf_flags= ""

Pflog_enable= "YES"

Pflog_logfile= "/var/log/pflog"

Sshd_enable= "YES"

6, turn on IP forwarding

Add the following content to the/etc/sysctl.conf

Net.inet.ip.forwarding=1

7, the realization of sharing the Internet, the simplest PF settings

wan_if= "Fxp0"

lan_if= "FXP1"

inter_net= "192.168.2.0/24"

Web_server= "192.168.2.3"

Ftp_server= "192.168.2.3"

Scrub in all

Nat on $wan _if from $inter _net to any-> fxp0

RDR on FXP1 proto TCP from $lan _if to any port-> $lan _if Port 80