Nginx 四七层代理,解决纯内网业务机器,调用第三方资源以及代理办公网远程直连内网 RDS 日常开发调试等场景问题

部署

这里规划 STREAM-172.17.129.1-sh 这台机器部署 OpenResty 做代理服务, 内网 IP 172.17.129.1 , 公网 IP 105.159.81.15 , 1M 公网带宽(带宽大小根据自己业务需求购买)

# wget https://s.xabcloud.com/file/ctl.sh
# chmod +x ctl.sh
# ./ctl.sh OPENRESTY

配置

user nobody;
worker_processes auto;
worker_cpu_affinity auto;
error_log logs/error.log;
pid logs/nginx.pid;
events{
        use epoll;
        worker_connections 65535;
}
stream{
        resolver 119.29.29.29 114.114.114.114;
        log_format proxy '[$status]  $session_time  $protocol  $upstream_addr  [$time_local]  $remote_addr';
        proxy_timeout 3200s;
        access_log logs/stream.log proxy;

        # 四层 HTTPS 访问代理
        server{
                listen 172.17.129.1:443;
                ssl_preread on;
                proxy_pass $ssl_preread_server_name:443;
        }
        
        # 四层 Redis 负载均衡
        upstream redis {
                server 172.17.129.225:6379;
                server 172.17.129.226:6379;
                server 172.17.129.227:6379;
        }
        server {
                listen 172.17.129.1:6379;
                proxy_pass redis;
        }

        # 四层代理测试环境 RDS,一般用来给开发人员本地办公网直连,方便日常测试
        server {
                listen 105.159.81.15:3306;
                proxy_pass xxx.mysql.rds.aliyuncs.com:3306;
                #proxy_pass 172.17.129.226:3306;
        }
}
http{
        include mime.types;
        default_type text/html;
        server_tokens off;
        sendfile on;
        client_header_buffer_size 64k;
        client_max_body_size 1000m;
        gzip on;
        gzip_comp_level 3;
        gzip_buffers 4 16k;
        gzip_min_length 1024;
        gzip_types text/xml text/css application/javascript;
        proxy_read_timeout 3200;
        proxy_send_timeout 3200;
        proxy_buffers 30 32k;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-For $remote_addr;
        proxy_set_header X-NginX-Proxy true;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "Upgrade";
        log_format main '[$status]  $request_time  $host$uri  [$http_user_agent]  [$time_local]  $remote_addr';
        access_log logs/access.log main;

        # 七层 HTTP 访问代理
        resolver 119.29.29.29 114.114.114.114;
        server{
                listen 80;
                location /{
                        proxy_set_header Host $host;
                        proxy_pass http://$host$request_uri;
                }
        }
}