V2EX = way to explore
V2EX 是一个关于分享和探索的地方
现在注册
已注册用户请  登录
z888888cn
V2EX  ›  Squid

Squid 配置了 cache_peer ,为啥不生效?

  •  
  •   z888888cn · 2020-01-12 21:12:46 +08:00 · 3478 次点击
    这是一个创建于 1536 天前的主题,其中的信息可能已经有所发展或是发生改变。

    配置如下:

    # Squid normally listens to port 3128
    always_direct allow all
    ssl_bump bump all
    sslproxy_cert_error allow all
    http_port 3128 ssl-bump cert=/etc/squid/squid.pem key=/etc/squid/squid.pem generate-host-certificates=on options=NO_SSLv2
    #http_port 3128
    
    cache_peer 127.0.0.1 parent 10809 0 no-query
    never_direct allow all
    

    我测试了一下,它并没有通过 127.0.0.1:10809 上网?但是让我改成如下时,却生效了。

    http_port 3128
    
    cache_peer 127.0.0.1 parent 10809 0 no-query
    never_direct allow all
    

    这是为什么?

    完整配置

    #
    # Recommended minimum configuration:
    #
    
    # Example rule allowing access from your local networks.
    # Adapt to list your (internal) IP networks from where browsing
    # should be allowed
    acl localnet src 10.0.0.0/8	# RFC1918 possible internal network
    acl localnet src 172.16.0.0/12	# RFC1918 possible internal network
    acl localnet src 192.168.0.0/16	# RFC1918 possible internal network
    acl localnet src fc00::/7       # RFC 4193 local private network range
    acl localnet src fe80::/10      # RFC 4291 link-local (directly plugged) machines
    
    acl SSL_ports port 443
    acl Safe_ports port 80		# http
    acl Safe_ports port 21		# ftp
    acl Safe_ports port 443		# https
    acl Safe_ports port 70		# gopher
    acl Safe_ports port 210		# wais
    acl Safe_ports port 1025-65535	# unregistered ports
    acl Safe_ports port 280		# http-mgmt
    acl Safe_ports port 488		# gss-http
    acl Safe_ports port 591		# filemaker
    acl Safe_ports port 777		# multiling http
    acl CONNECT method CONNECT
    
    #
    # Recommended minimum Access Permission configuration:
    #
    # Deny requests to certain unsafe ports
    http_access deny !Safe_ports
    
    # Deny CONNECT to other than secure SSL ports
    http_access deny CONNECT !SSL_ports
    
    # Only allow cachemgr access from localhost
    http_access allow localhost manager
    http_access deny manager
    
    # We strongly recommend the following be uncommented to protect innocent
    # web applications running on the proxy server who think the only
    # one who can access services on "localhost" is a local user
    #http_access deny to_localhost
    
    #
    # INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS
    #
    
    # Example rule allowing access from your local networks.
    # Adapt localnet in the ACL section to list your (internal) IP networks
    # from where browsing should be allowed
    http_access allow localnet
    http_access allow localhost
    
    # And finally deny all other access to this proxy
    http_access deny all
    
    # Squid normally listens to port 3128
    always_direct allow all
    ssl_bump bump all
    sslproxy_cert_error allow all
    http_port 3128 ssl-bump cert=/etc/squid/squid.pem key=/etc/squid/squid.pem generate-host-certificates=on options=NO_SSLv2
    #http_port 3128
    
    cache_peer 127.0.0.1 parent 10809 0 no-query
    never_direct allow all
    
    # Uncomment and adjust the following to add a disk cache directory.
    cache_dir ufs /var/cache/squid 100 16 256
    
    # Leave coredumps in the first cache dir
    coredump_dir /var/cache/squid
    
    #
    # Add any of your own refresh_pattern entries above these.
    #
    refresh_pattern ^ftp:		1440	20%	10080
    refresh_pattern ^gopher:	1440	0%	1440
    refresh_pattern -i (/cgi-bin/|\?) 0	0%	0
    refresh_pattern .		0	20%	4320
    
    dns_nameservers 8.8.8.8
    
    3 条回复    2020-01-14 07:48:12 +08:00
    foam
        1
    foam  
       2020-01-13 23:29:29 +08:00
    你的 cert 和 key 怎么是同一个文件
    ericFork
        2
    ericFork  
       2020-01-13 23:31:47 +08:00
    `squid -k check` 看看先?以及 cache.log 里有没有报错
    z888888cn
        3
    z888888cn  
    OP
       2020-01-14 07:48:12 +08:00
    @ericFork @foam 我在老外 Squid 论坛发帖子了,暂时不支持,要等到 v5 版本。

    原贴: http://squid-web-proxy-cache.1019090.n4.nabble.com/Squid-configuration-cache-peer-does-not-take-effect-td4688860.html

    @foam 为啥是同一个文件,因为 cert 和 key 是合在一起的,官方教程就是这样的,至于为啥我也不知道。
    关于   ·   帮助文档   ·   博客   ·   API   ·   FAQ   ·   我们的愿景   ·   实用小工具   ·   3381 人在线   最高记录 6543   ·     Select Language
    创意工作者们的社区
    World is powered by solitude
    VERSION: 3.9.8.5 · 32ms · UTC 11:19 · PVG 19:19 · LAX 04:19 · JFK 07:19
    Developed with CodeLauncher
    ♥ Do have faith in what you're doing.