mirror of
https://github.com/3proxy/3proxy.git
synced 2026-08-05 17:20:11 +08:00
make html formatting compatible with .md
Some checks failed
C/C++ CI Linux / ${{ matrix.target }} (ubuntu-24.04-arm) (push) Has been cancelled
C/C++ CI Linux / ${{ matrix.target }} (ubuntu-latest) (push) Has been cancelled
C/C++ CI MacOS / ${{ matrix.target }} (macos-15) (push) Has been cancelled
C/C++ CI Windows / ${{ matrix.target }} (windows-2022) (push) Has been cancelled
C/C++ CI cmake / ${{ matrix.target }} (macos-15) (push) Has been cancelled
C/C++ CI cmake / ${{ matrix.target }} (ubuntu-24.04-arm) (push) Has been cancelled
C/C++ CI cmake / ${{ matrix.target }} (ubuntu-latest) (push) Has been cancelled
C/C++ CI cmake / ${{ matrix.target }} (windows-2022) (push) Has been cancelled
C/C++ CI cmake / ubuntu-latest (wolfSSL) (push) Has been cancelled
Some checks failed
C/C++ CI Linux / ${{ matrix.target }} (ubuntu-24.04-arm) (push) Has been cancelled
C/C++ CI Linux / ${{ matrix.target }} (ubuntu-latest) (push) Has been cancelled
C/C++ CI MacOS / ${{ matrix.target }} (macos-15) (push) Has been cancelled
C/C++ CI Windows / ${{ matrix.target }} (windows-2022) (push) Has been cancelled
C/C++ CI cmake / ${{ matrix.target }} (macos-15) (push) Has been cancelled
C/C++ CI cmake / ${{ matrix.target }} (ubuntu-24.04-arm) (push) Has been cancelled
C/C++ CI cmake / ${{ matrix.target }} (ubuntu-latest) (push) Has been cancelled
C/C++ CI cmake / ${{ matrix.target }} (windows-2022) (push) Has been cancelled
C/C++ CI cmake / ubuntu-latest (wolfSSL) (push) Has been cancelled
This commit is contained in:
Vladimir Dubrovin
parent
05f83896bf
commit
0ae2754c1e
@ -1,2 +1,2 @@
|
||||
|
||||
<H2><A href="howtoe.html">See HowTo:</a></H2>
|
||||
<H2><A href="howtoe.html">See HowTo:</a></h2>
|
||||
@ -1,2 +1,2 @@
|
||||
|
||||
<H2><A href="howtoe.html">См. HowTo</a></H2>
|
||||
<H2><A href="howtoe.html">См. HowTo</a></h2>
|
||||
@ -123,7 +123,7 @@ persistent in <tt>/etc/sysctl.d/</tt>. Defaults given in parentheses are from a
|
||||
<p><b>File descriptors.</b> 3proxy needs 2 descriptors per connection (4 for FTP), plus
|
||||
one per service, plus temporary ones for name resolution and RADIUS.
|
||||
<pre>
|
||||
fs.nr_open = 1048576 # (1048576) upper bound for any process' RLIMIT_NOFILE
|
||||
fs.nr_open = 1048576 # (1048576) upper bound for any process' RLIMIT_NOFILE
|
||||
</pre>
|
||||
<tt>ulimit -n</tt> (RLIMIT_NOFILE) is the limit that actually applies and is commonly
|
||||
left at 1024; it must be raised for the 3proxy process itself, see "Setting ulimits"
|
||||
@ -134,9 +134,9 @@ changing.
|
||||
reached earlier with 3proxy than with event-driven servers. Each thread also consumes
|
||||
one or two mappings, so <tt>vm.max_map_count</tt> matters too.
|
||||
<pre>
|
||||
kernel.threads-max = 200000 # (~60000 on a 16G host, scales with RAM)
|
||||
kernel.pid_max = 4194304 # (4194304)
|
||||
vm.max_map_count = 1048576 # (1048576)
|
||||
kernel.threads-max = 200000 # (~60000 on a 16G host, scales with RAM)
|
||||
kernel.pid_max = 4194304 # (4194304)
|
||||
vm.max_map_count = 1048576 # (1048576)
|
||||
</pre>
|
||||
RLIMIT_NPROC (<tt>ulimit -u</tt>) limits threads per user and must be raised as well.
|
||||
Check the actual thread count with <tt>grep Threads /proc/PID/status</tt>.
|
||||
@ -145,28 +145,28 @@ Check the actual thread count with <tt>grep Threads /proc/PID/status</tt>.
|
||||
'backlog' command is given, so a large 'maxconn' does not automatically give a large
|
||||
queue, and the kernel caps it at somaxconn:
|
||||
<pre>
|
||||
net.core.somaxconn = 4096 # (4096)
|
||||
net.ipv4.tcp_max_syn_backlog = 4096 # (512) raise for bursty connection rates
|
||||
net.ipv4.tcp_syncookies = 1 # (1) keep enabled
|
||||
net.core.somaxconn = 4096 # (4096)
|
||||
net.ipv4.tcp_max_syn_backlog = 4096 # (512) raise for bursty connection rates
|
||||
net.ipv4.tcp_syncookies = 1 # (1) keep enabled
|
||||
</pre>
|
||||
|
||||
<p><b>Ephemeral ports and TIME_WAIT.</b> See "Extending the Ephemeral Port Range" above
|
||||
for the multi-IP case. The range gives about 28000 outgoing connections per
|
||||
destination address by default:
|
||||
<pre>
|
||||
net.ipv4.ip_local_port_range = 10240 65535 # (32768 60999)
|
||||
net.ipv4.tcp_tw_reuse = 2 # (2) reuse TIME_WAIT for outgoing connections
|
||||
net.ipv4.tcp_fin_timeout = 30 # (60)
|
||||
net.ipv4.ip_local_port_range = 10240 65535 # (32768 60999)
|
||||
net.ipv4.tcp_tw_reuse = 2 # (2) reuse TIME_WAIT for outgoing connections
|
||||
net.ipv4.tcp_fin_timeout = 30 # (60)
|
||||
</pre>
|
||||
Do not enable tcp_tw_recycle; it was removed in kernel 4.12 and breaks NAT clients.
|
||||
|
||||
<p><b>Socket buffers.</b> Autotuning is usually right. Buffer memory is per connection,
|
||||
so raising the maximums with tens of thousands of connections costs a lot of RAM:
|
||||
<pre>
|
||||
net.core.rmem_max = 4194304 # (212992)
|
||||
net.core.wmem_max = 4194304 # (212992)
|
||||
net.ipv4.tcp_rmem = 4096 131072 6291456 # (same) min default max
|
||||
net.ipv4.tcp_wmem = 4096 16384 4194304 # (same)
|
||||
net.core.rmem_max = 4194304 # (212992)
|
||||
net.core.wmem_max = 4194304 # (212992)
|
||||
net.ipv4.tcp_rmem = 4096 131072 6291456 # (same) min default max
|
||||
net.ipv4.tcp_wmem = 4096 16384 4194304 # (same)
|
||||
</pre>
|
||||
Raise these only for high bandwidth-delay product links, and prefer raising the third
|
||||
(max) value and leaving the default alone.
|
||||
@ -177,8 +177,8 @@ it does, the table is exhausted long before 3proxy's own limits, with
|
||||
<pre>
|
||||
net.netfilter.nf_conntrack_max = 1048576
|
||||
net.netfilter.nf_conntrack_buckets = 262144
|
||||
net.netfilter.nf_conntrack_tcp_timeout_established = 3600 # (432000, i.e. 5 days)
|
||||
net.netfilter.nf_conntrack_tcp_timeout_time_wait = 30 # (120)
|
||||
net.netfilter.nf_conntrack_tcp_timeout_established = 3600 # (432000, i.e. 5 days)
|
||||
net.netfilter.nf_conntrack_tcp_timeout_time_wait = 30 # (120)
|
||||
</pre>
|
||||
nf_conntrack_max defaults to nf_conntrack_buckets, which itself is derived from the
|
||||
amount of RAM, so it is often much lower than expected on small machines. Each
|
||||
|
||||
@ -2,20 +2,20 @@
|
||||
<li>3APA3A 3proxy Tiny Proxy Server HowTo
|
||||
<br>Under construction, very incomplete
|
||||
<ul>
|
||||
<li><A HREF="#COMPILE">Compilation</A>
|
||||
<li><A HREF="#COMPILE">Compilation</a>
|
||||
<ul>
|
||||
<li><A HREF="#MSVC">How to compile 3proxy with Visual C++</A>
|
||||
<li><A HREF="#CMAKE">How to compile 3proxy with CMake</A>
|
||||
<li><A HREF="#GCCUNIX">How to compile 3proxy with GCC under Unix/Linux</A>
|
||||
<li><A HREF="#MSVC">How to compile 3proxy with Visual C++</a>
|
||||
<li><A HREF="#CMAKE">How to compile 3proxy with CMake</a>
|
||||
<li><A HREF="#GCCUNIX">How to compile 3proxy with GCC under Unix/Linux</a>
|
||||
</ul>
|
||||
<li><A HREF="#INSTALL">Proxy server installation and removal</A>
|
||||
<li><A HREF="#INSTALL">Proxy server installation and removal</a>
|
||||
<ul>
|
||||
<li><A HREF="#INSTNT">How to install/remove 3proxy under Windows NT/2000/XP</A>
|
||||
<li><A HREF="#INSTUNIX">How to install/remove 3proxy under Unix/Linux</A>
|
||||
<li><A HREF="#INSTMACOS">How to install/remove 3proxy under macOS</A>
|
||||
<li><A HREF="#INSTDOCKER">How to use 3proxy with Docker</A>
|
||||
<li><A HREF="#INSTNT">How to install/remove 3proxy under Windows NT/2000/XP</a>
|
||||
<li><A HREF="#INSTUNIX">How to install/remove 3proxy under Unix/Linux</a>
|
||||
<li><A HREF="#INSTMACOS">How to install/remove 3proxy under macOS</a>
|
||||
<li><A HREF="#INSTDOCKER">How to use 3proxy with Docker</a>
|
||||
</ul>
|
||||
<li><A HREF="#SERVER">Server configuration</A>
|
||||
<li><A HREF="#SERVER">Server configuration</a>
|
||||
<ul>
|
||||
<li><a href="#NOTHING">How to make 3proxy start</a></li>
|
||||
<li><a href="#LIMITS">How to make limitations (access, bandwidth, traffic, connections) work</a></li>
|
||||
@ -24,11 +24,11 @@
|
||||
<li><a href="#ODBC">How to make ODBC logging work?</a></li>
|
||||
<li><a href="#IPV6">How to make IPv6 work</a></li>
|
||||
<li><a href="#CRASH">How to fix 3proxy crashes</a></li>
|
||||
<li><A HREF="#SAMPLE">Where to find a configuration example</A>
|
||||
<li><A HREF="#LOGGING">How to set up logging</A>
|
||||
<li><A HREF="#LOGFORMAT">How to set up logging format</A>
|
||||
<li><A HREF="#LOGANALIZERS">How to use log analyzers with 3proxy</A>
|
||||
<li><A HREF="#LAUNCH">How to start any of the proxy services (HTTP, SOCKS, etc.)</A>
|
||||
<li><A HREF="#SAMPLE">Where to find a configuration example</a>
|
||||
<li><A HREF="#LOGGING">How to set up logging</a>
|
||||
<li><A HREF="#LOGFORMAT">How to set up logging format</a>
|
||||
<li><A HREF="#LOGANALIZERS">How to use log analyzers with 3proxy</a>
|
||||
<li><A HREF="#LAUNCH">How to start any of the proxy services (HTTP, SOCKS, etc.)</a>
|
||||
<li><a href="#BIND">How to bind a service to a specific interface or port</a>
|
||||
<li><a href="#NAMES">How to resolve names through a parent proxy</a></li>
|
||||
<li><a href="#ISFTP">How to set up an FTP proxy</a></li>
|
||||
@ -37,39 +37,39 @@
|
||||
<li><a href="#SSLPLUGIN">How to set up TLS/SSL (https proxy, mTLS)</a></li>
|
||||
<li><a href="#CERTIFICATES">How to create CA and certificates for SSL</a></li>
|
||||
<li><a href="#PCRE">How to use PCRE filtering (regular expressions)</a></li>
|
||||
<li><A HREF="#AUTH">How to limit service access</A>
|
||||
<li><A HREF="#USERS">How to create a user list</A>
|
||||
<li><A HREF="#ACL">How to limit user access to resources</A>
|
||||
<li><A HREF="#REDIR">How to manage redirections</A>
|
||||
<li><A HREF="#AUTH">How to limit service access</a>
|
||||
<li><A HREF="#USERS">How to create a user list</a>
|
||||
<li><A HREF="#ACL">How to limit user access to resources</a>
|
||||
<li><A HREF="#REDIR">How to manage redirections</a>
|
||||
<li><a href="#SOCKSREDIR">How to manage local redirections</a>
|
||||
<li><A HREF="#ROUNDROBIN">How to balance traffic between multiple external channels?</A>
|
||||
<li><A HREF="#CHAIN">How to manage proxy chains</A>
|
||||
<li><A HREF="#BANDLIM">How to limit bandwidth</A>
|
||||
<li><A HREF="#TRAFLIM">How to limit traffic amount</A>
|
||||
<li><A HREF="#ROUNDROBIN">How to balance traffic between multiple external channels?</a>
|
||||
<li><A HREF="#CHAIN">How to manage proxy chains</a>
|
||||
<li><A HREF="#BANDLIM">How to limit bandwidth</a>
|
||||
<li><A HREF="#TRAFLIM">How to limit traffic amount</a>
|
||||
<li><a href="#TRAF">How to fix incorrect traffic accounting</a>
|
||||
<li><A HREF="#NETLIST">How to build network lists</A>
|
||||
<li><A HREF="#NETLIST">How to build network lists</a>
|
||||
<li><a href="#NSCACHING">How to configure name resolution and DNS caching</a>
|
||||
<li><a href="#IPV6">How to use IPv6</a>
|
||||
<li><a href="#CONNBACK">How to use connect back</a>
|
||||
<li><a href="#HAPROXY">How to use HAProxy PROXY protocol</a>
|
||||
<li><a href="#MAXSEG">How to set TCP maximum segment size (MSS)</a>
|
||||
</ul>
|
||||
<li><A HREF="#CLIENT">Client configuration</A>
|
||||
<li><A HREF="#ADMIN">Administering and information analysis</A>
|
||||
<li><A HREF="#CLIENT">Client configuration</a>
|
||||
<li><A HREF="#ADMIN">Administering and information analysis</a>
|
||||
<ul>
|
||||
<li><A HREF="#NEWVERSION">How to obtain the latest 3proxy version</A>
|
||||
<li><A HREF="#NTSERVICE">How to control the 3proxy service under Windows NT/2000/XP</A>
|
||||
<li><A HREF="#ERRORS">Log error codes reference</A>
|
||||
<li><A HREF="#NEWVERSION">How to obtain the latest 3proxy version</a>
|
||||
<li><A HREF="#NTSERVICE">How to control the 3proxy service under Windows NT/2000/XP</a>
|
||||
<li><A HREF="#ERRORS">Log error codes reference</a>
|
||||
</ul>
|
||||
<li><A HREF="#QUEST">How to ask a question not in How To?</A>
|
||||
<li><A HREF="#QUEST">How to ask a question not in How To?</a>
|
||||
</ul>
|
||||
<br>
|
||||
<ul>
|
||||
<hr>
|
||||
<li><A NAME="COMPILE">Compilation</A>
|
||||
<li><A NAME="COMPILE">Compilation</a>
|
||||
<p>
|
||||
<ul>
|
||||
<li><A NAME="MSVC">How to compile 3proxy with Visual C++</A>
|
||||
<li><A NAME="MSVC">How to compile 3proxy with Visual C++</a>
|
||||
<p>
|
||||
Extract source code files from 3proxy.tgz (with WinZip or another utility) or use git.
|
||||
|
||||
@ -78,7 +78,7 @@ nmake /f Makefile.msvc
|
||||
</pre>
|
||||
Binaries will be placed in the <code>bin/</code> directory.
|
||||
</p>
|
||||
<li><A NAME="CMAKE">How to compile 3proxy with CMake</A>
|
||||
<li><A NAME="CMAKE">How to compile 3proxy with CMake</a>
|
||||
<p>
|
||||
CMake provides a cross-platform build system. It works on Windows (MSVC, MinGW), Linux, macOS, and BSD.
|
||||
<br>Basic build steps:
|
||||
@ -100,7 +100,7 @@ cmake -D3PROXY_USE_OPENSSL=ON -D3PROXY_USE_PCRE2=ON ..
|
||||
Available options: 3PROXY_USE_OPENSSL, 3PROXY_USE_PCRE2, 3PROXY_USE_PAM, 3PROXY_USE_ODBC.
|
||||
<br>Binaries will be placed in the <code>build/bin/</code> directory.
|
||||
</p>
|
||||
<li><A NAME="GCCUNIX">How to compile 3proxy with GCC under Unix/Linux</A></li>
|
||||
<li><A NAME="GCCUNIX">How to compile 3proxy with GCC under Unix/Linux</a></li>
|
||||
<p>
|
||||
For Linux, use:
|
||||
<pre>
|
||||
@ -121,14 +121,14 @@ and add the ODBC library to the linker variable.
|
||||
</p>
|
||||
</ul>
|
||||
<hr>
|
||||
<li><A NAME="INSTALL">Proxy server installation and removal</A>
|
||||
<li><A NAME="INSTALL">Proxy server installation and removal</a>
|
||||
<p>
|
||||
<ul>
|
||||
<li><A NAME="INSTNT">How to install/remove 3proxy under Windows NT/2000/XP</A>
|
||||
<li><A NAME="INSTNT">How to install/remove 3proxy under Windows NT/2000/XP</a>
|
||||
<p>
|
||||
Unpack 3proxy.zip to any directory, for example
|
||||
c:\Program Files\3proxy. If needed, create a directory for storing log files,
|
||||
ODBC sources, etc. Create 3proxy.cfg in the 3proxy installation directory (see <A HREF="#SERVER">Server configuration</A>).
|
||||
ODBC sources, etc. Create 3proxy.cfg in the 3proxy installation directory (see <A HREF="#SERVER">Server configuration</a>).
|
||||
Now, start a command prompt (cmd.exe).
|
||||
Change to the 3proxy installation directory and run 3proxy.exe --install:
|
||||
<pre>
|
||||
@ -148,10 +148,10 @@ C:\Program Files\3proxy>3proxy.exe --remove
|
||||
</pre>
|
||||
Now you can simply remove the 3proxy installation directory.
|
||||
</p>
|
||||
<li><A NAME="INSTUNIX">How to install/remove 3proxy under Unix/Linux</A>
|
||||
<li><A NAME="INSTUNIX">How to install/remove 3proxy under Unix/Linux</a>
|
||||
<p>
|
||||
<b>Using Makefile:</b>
|
||||
<br>Compile 3proxy (see <A HREF="#COMPILE">Compilation</A>) then run:
|
||||
<br>Compile 3proxy (see <A HREF="#COMPILE">Compilation</a>) then run:
|
||||
<pre>
|
||||
sudo make install
|
||||
</pre>
|
||||
@ -186,7 +186,7 @@ sudo systemctl enable 3proxy
|
||||
sudo systemctl start 3proxy
|
||||
</pre>
|
||||
</p>
|
||||
<li><A NAME="INSTMACOS">How to install/remove 3proxy under macOS</A>
|
||||
<li><A NAME="INSTMACOS">How to install/remove 3proxy under macOS</a>
|
||||
<p>
|
||||
<b>Using CMake (recommended):</b>
|
||||
<pre>
|
||||
@ -216,22 +216,22 @@ This installs binaries to <code>/usr/local/3proxy/bin/</code> and configuration
|
||||
<b>Service management with launchd:</b>
|
||||
<br>After installation via cmake, the service can be managed with launchctl:
|
||||
<pre>
|
||||
# Load and start the service
|
||||
# Load and start the service
|
||||
sudo launchctl load /Library/LaunchDaemons/org.3proxy.3proxy.plist
|
||||
|
||||
# Stop the service
|
||||
# Stop the service
|
||||
sudo launchctl stop org.3proxy.3proxy
|
||||
|
||||
# Start the service
|
||||
# Start the service
|
||||
sudo launchctl start org.3proxy.3proxy
|
||||
|
||||
# Unload and disable the service
|
||||
# Unload and disable the service
|
||||
sudo launchctl unload /Library/LaunchDaemons/org.3proxy.3proxy.plist
|
||||
</pre>
|
||||
The service runs as user <code>proxy</code> (created during installation).
|
||||
Configuration file: <code>/etc/3proxy/3proxy.cfg</code>
|
||||
</p>
|
||||
<li><A NAME="INSTDOCKER">How to use 3proxy with Docker</A>
|
||||
<li><A NAME="INSTDOCKER">How to use 3proxy with Docker</a>
|
||||
<p>
|
||||
<b>Using pre-built images from GitHub Container Registry:</b>
|
||||
<pre>
|
||||
@ -264,7 +264,7 @@ For non-chroot execution, mount config to <code>/etc/3proxy</code>.
|
||||
</p>
|
||||
</ul>
|
||||
<hr>
|
||||
<li><A NAME="SERVER">Server configuration</A>
|
||||
<li><A NAME="SERVER">Server configuration</a>
|
||||
<p>
|
||||
<ul>
|
||||
<li><a name="NOTHING">How to make 3proxy start</a>
|
||||
@ -293,7 +293,7 @@ location as 3proxy.exe). For an alternative configuration file location, use
|
||||
|
||||
</ul>
|
||||
|
||||
<p><A NAME="INTEXT">How to understand internal and external</A>
|
||||
<p><A NAME="INTEXT">How to understand internal and external</a>
|
||||
<p>
|
||||
Both internal and external IPs are IPs of the host running 3proxy itself.
|
||||
This configuration option is useful in situations where 3proxy is running on a
|
||||
@ -344,15 +344,15 @@ The best solution is to enable the option to resolve hostnames via the proxy on
|
||||
The problem can be resolved with the 'stacksize' command or '-S' option starting with 3proxy 0.8.4.
|
||||
|
||||
|
||||
<li><A NAME="SAMPLE">Where to find a configuration example</A>
|
||||
<li><A NAME="SAMPLE">Where to find a configuration example</a>
|
||||
<p>
|
||||
A server configuration example, 3proxy.cfg.sample, is included in every 3proxy distribution.
|
||||
</p>
|
||||
<li><A NAME="LOGGING">How to set up logging</A>
|
||||
<li><A NAME="LOGGING">How to set up logging</a>
|
||||
<p>
|
||||
3proxy can log to stdout, a file, an ODBC datasource, or
|
||||
syslog (Unix/Linux/Cygwin only). To use ODBC under Unix/Linux, you must
|
||||
compile 3proxy with Unix ODBC libraries; see <A HREF="#COMPILE">Compilation</A>.
|
||||
compile 3proxy with Unix ODBC libraries; see <A HREF="#COMPILE">Compilation</a>.
|
||||
You can control logging from 3proxy.cfg for all services, or you can control
|
||||
logging for an individual service. For example,
|
||||
/usr/local/sbin/socks -l/var/log/socks.log starts a SOCKS proxy with logging to a file.
|
||||
@ -379,14 +379,14 @@ specify an ident for syslog logging. If the filename within the "log" command co
|
||||
log c:\3proxy\logs\%y%m%d.log D creates a file like c:\3proxy\logs\060729.log;
|
||||
the date is generated based on local time.
|
||||
<pre>
|
||||
log &connstring
|
||||
log &connstring;
|
||||
</pre>
|
||||
|
||||
specifies an ODBC connection string; connstring is in the format
|
||||
datasource,username,password (the last two are optional if the
|
||||
datasource does not require or already has authentication information).
|
||||
Also, you must specify logformat to build the SQL query to insert a record into
|
||||
the log; see <A HREF="#LOGFORMAT">How to set up logging format</A>
|
||||
the log; see <A HREF="#LOGFORMAT">How to set up logging format</a>
|
||||
</p>
|
||||
<p>
|
||||
Rotation and archiving may be set up with log, rotate, and archiver commands.
|
||||
@ -416,7 +416,7 @@ sets the rotation type. LOGTYPE may be:
|
||||
Examples are located in
|
||||
3proxy.cfg.sample
|
||||
</p>
|
||||
<li><A NAME="LOGFORMAT">How to set up logging format</A>
|
||||
<li><A NAME="LOGFORMAT">How to set up logging format</a>
|
||||
<p>
|
||||
Since version 0.3, the log format may be set with the "logformat" command.
|
||||
The first symbol of the log format specifies the format of the date and time and
|
||||
@ -437,7 +437,7 @@ sets the rotation type. LOGTYPE may be:
|
||||
<li> %U - Username ('-' if unknown).
|
||||
<li> %N - Service name (PROXY, SOCKS, POP3P, etc.)
|
||||
<li> %p - Service port
|
||||
<li> %E - Error code (see <A HREF="#ERRORS">Log error codes reference</A>)
|
||||
<li> %E - Error code (see <A HREF="#ERRORS">Log error codes reference</a>)
|
||||
<li> %C - client IP
|
||||
<li> %c - client port
|
||||
<li> %R - target IP
|
||||
@ -449,7 +449,7 @@ sets the rotation type. LOGTYPE may be:
|
||||
<li> %O - bytes sent to the target
|
||||
<li> %n - hostname from the request
|
||||
<li> %h - hops before the target (if redirection or chaining is used);
|
||||
see <A HREF="#CHAIN">How to use chains and parent proxies</A>)
|
||||
see <A HREF="#CHAIN">How to use chains and parent proxies</a>)
|
||||
<li> %T - service-specific text (for example, the requested URL). %X-YT,
|
||||
where X and Y are positive numbers, only displays fields
|
||||
(space-delimited) X to Y of the text. An example is %1-2T.
|
||||
@ -472,7 +472,7 @@ logformat "-\'+_GINSERT INTO proxystat VALUES (%t, '%c', '%U', %I)"</pre>
|
||||
<br>(no line breaks)
|
||||
<br>-\'+_ instructs to replace characters \ and ' with _
|
||||
</p>
|
||||
<li><A NAME="LOGANALIZERS">How to use log analyzers with 3proxy</A>
|
||||
<li><A NAME="LOGANALIZERS">How to use log analyzers with 3proxy</a>
|
||||
<p>
|
||||
Just make the format of 3proxy logs compatible with a format supported by your
|
||||
favorite log analyzer. Examples of compatible logformats are:
|
||||
@ -515,7 +515,7 @@ or a more compatible format without the error code:
|
||||
<p><font face="courier">
|
||||
"-""+_L%C - %U [%d/%o/%Y:%H:%M:%S %z] ""%T"" 200 %I"
|
||||
</p>
|
||||
<li><A NAME="LAUNCH">How to start any of the proxy services (HTTP, SOCKS, etc.)</A>
|
||||
<li><A NAME="LAUNCH">How to start any of the proxy services (HTTP, SOCKS, etc.)</a>
|
||||
<p>
|
||||
3proxy is distributed in 2 variants: as a set of standalone modules (proxy,
|
||||
socks, pop3p, tcppm, udppm) and as a universal proxy server. These services are
|
||||
@ -552,7 +552,7 @@ except socks, which is started with port 3129.
|
||||
All logs are in the file /var/log/3proxy.log (with daily date modification and
|
||||
rotation). The 30 most recent files are stored.
|
||||
</p>
|
||||
<li><A NAME="BIND">How to bind a service to a specific interface and port?</A>
|
||||
<li><A NAME="BIND">How to bind a service to a specific interface and port?</a>
|
||||
<p>
|
||||
The -i option specifies the internal interface; -p specifies the listening port. No spaces are
|
||||
allowed. To bind the 'proxy' service to port 8080 on interfaces 192.168.1.1
|
||||
@ -606,17 +606,17 @@ tlspr supports both: for implicit TLS the destination host is taken from SNI and
|
||||
the -X option makes tlspr speak the plaintext protocol phase with the client (greeting, STARTTLS command) before
|
||||
upgrading both sides to TLS. Example:
|
||||
</p><pre>
|
||||
# https (implicit)
|
||||
# https (implicit)
|
||||
tlspr -p443 -P443 -c1
|
||||
# imaps (implicit)
|
||||
# imaps (implicit)
|
||||
tlspr -p993 -P993 -c1
|
||||
# submissions (implicit)
|
||||
# submissions (implicit)
|
||||
tlspr -p465 -P465 -c1
|
||||
# imap STARTTLS (explicit)
|
||||
# imap STARTTLS (explicit)
|
||||
tlspr -p143 -P143 -Ximap
|
||||
# submission STARTTLS (explicit)
|
||||
# submission STARTTLS (explicit)
|
||||
tlspr -p587 -P587 -Xsmtp
|
||||
# pop3 STLS (explicit)
|
||||
# pop3 STLS (explicit)
|
||||
tlspr -p110 -P110 -Xpop3
|
||||
</pre>
|
||||
<p>
|
||||
@ -705,15 +705,15 @@ nscache 65536
|
||||
nscache6 65536
|
||||
dnspr -p53
|
||||
|
||||
# google
|
||||
# google
|
||||
nsrecord smtp.gmail.com 10.0.0.1
|
||||
nsrecord imap.gmail.com 10.0.0.1
|
||||
nsrecord pop.gmail.com 10.0.0.1
|
||||
# mail.ru
|
||||
# mail.ru
|
||||
nsrecord smtp.mail.ru 10.0.0.1
|
||||
nsrecord imap.mail.ru 10.0.0.1
|
||||
nsrecord pop.mail.ru 10.0.0.1
|
||||
# yandex.ru
|
||||
# yandex.ru
|
||||
nsrecord smtp.yandex.ru 10.0.0.1
|
||||
nsrecord imap.yandex.ru 10.0.0.1
|
||||
nsrecord pop.yandex.ru 10.0.0.1
|
||||
@ -825,10 +825,10 @@ This creates an HTTPS proxy (ssl_serv) that accepts TLS connections from clients
|
||||
<b>Creating a Certificate Authority (CA):</b>
|
||||
<br>For MITM or mTLS, you need a CA. Generate a CA private key and certificate:
|
||||
</p><pre>
|
||||
# Generate CA private key
|
||||
# Generate CA private key
|
||||
openssl genrsa -out ca.key 4096
|
||||
|
||||
# Generate CA certificate (valid for 10 years)
|
||||
# Generate CA certificate (valid for 10 years)
|
||||
openssl req -x509 -new -nodes -key ca.key -sha256 -days 3650 \
|
||||
-subj "/C=US/ST=State/L=City/O=MyOrg/CN=My CA" \
|
||||
-out ca.crt
|
||||
@ -840,15 +840,15 @@ For MITM, import ca.crt into client browsers/OS as a trusted root CA.
|
||||
<b>Creating a server certificate for https:// proxy:</b>
|
||||
<br>The server certificate must have proper Subject Alternative Names (SAN):
|
||||
</p><pre>
|
||||
# Generate server private key
|
||||
# Generate server private key
|
||||
openssl genrsa -out server.key 2048
|
||||
|
||||
# Create a certificate signing request (CSR)
|
||||
# Create a certificate signing request (CSR)
|
||||
openssl req -new -key server.key \
|
||||
-subj "/C=US/ST=State/L=City/O=MyOrg/CN=proxy.example.com" \
|
||||
-out server.csr
|
||||
|
||||
# Create extensions file for SAN
|
||||
# Create extensions file for SAN
|
||||
cat > server.ext << 'EOF'
|
||||
authorityKeyIdentifier=keyid,issuer
|
||||
basicConstraints=CA:FALSE
|
||||
@ -862,7 +862,7 @@ DNS.2 = proxy
|
||||
IP.1 = 192.168.1.100
|
||||
EOF
|
||||
|
||||
# Sign the certificate with CA
|
||||
# Sign the certificate with CA
|
||||
openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key \
|
||||
-CAcreateserial -out server.crt -days 365 -sha256 \
|
||||
-extfile server.ext
|
||||
@ -873,27 +873,27 @@ For a public https:// proxy, use a CA like Let's Encrypt instead of self-signed.
|
||||
<p>
|
||||
<b>Creating a client certificate for mTLS:</b>
|
||||
</p><pre>
|
||||
# Generate client private key
|
||||
# Generate client private key
|
||||
openssl genrsa -out client1.key 2048
|
||||
|
||||
# Create CSR
|
||||
# Create CSR
|
||||
openssl req -new -key client1.key \
|
||||
-subj "/C=US/ST=State/L=City/O=MyOrg/CN=client1" \
|
||||
-out client1.csr
|
||||
|
||||
# Create extensions file
|
||||
# Create extensions file
|
||||
cat > client.ext << 'EOF'
|
||||
basicConstraints=CA:FALSE
|
||||
keyUsage = digitalSignature, nonRepudiation, keyEncipherment
|
||||
extendedKeyUsage = clientAuth
|
||||
EOF
|
||||
|
||||
# Sign with CA
|
||||
# Sign with CA
|
||||
openssl x509 -req -in client1.csr -CA ca.crt -CAkey ca.key \
|
||||
-CAcreateserial -out client1.crt -days 365 -sha256 \
|
||||
-extfile client.ext
|
||||
|
||||
# Create PKCS#12 bundle for browser import
|
||||
# Create PKCS#12 bundle for browser import
|
||||
openssl pkcs12 -export -out client1.p12 \
|
||||
-inkey client1.key -in client1.crt -certfile ca.crt
|
||||
</pre>
|
||||
@ -903,15 +903,15 @@ Import client1.p12 into the client browser or OS certificate store.
|
||||
<p>
|
||||
<b>Quick setup script for development/testing:</b>
|
||||
</p><pre>
|
||||
#!/bin/sh
|
||||
# Creates CA, server, and client certificates for SSLPlugin testing
|
||||
#!/bin/sh
|
||||
# Creates CA, server, and client certificates for SSLPlugin testing
|
||||
|
||||
# CA
|
||||
# CA
|
||||
openssl genrsa -out ca.key 4096
|
||||
openssl req -x509 -new -nodes -key ca.key -sha256 -days 3650 \
|
||||
-subj "/CN=3proxy CA" -out ca.crt
|
||||
|
||||
# Server
|
||||
# Server
|
||||
openssl genrsa -out server.key 2048
|
||||
openssl req -new -key server.key -subj "/CN=localhost" -out server.csr
|
||||
cat > server.ext << 'EOF'
|
||||
@ -923,7 +923,7 @@ EOF
|
||||
openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key \
|
||||
-CAcreateserial -out server.crt -days 365 -sha256 -extfile server.ext
|
||||
|
||||
# Client
|
||||
# Client
|
||||
openssl genrsa -out client.key 2048
|
||||
openssl req -new -key client.key -subj "/CN=client" -out client.csr
|
||||
cat > client.ext << 'EOF'
|
||||
@ -980,13 +980,13 @@ matches the connection data.
|
||||
<p>
|
||||
<b>Examples:</b>
|
||||
</p><pre>
|
||||
# Block requests containing specific keywords for certain users
|
||||
# Block requests containing specific keywords for certain users
|
||||
pcre request deny "porn|sex" user1,user2,user3 192.168.0.0/16
|
||||
|
||||
# Block responses with specific content type
|
||||
# Block responses with specific content type
|
||||
pcre srvheader deny "Content-type: application"
|
||||
|
||||
# Replace content in both directions (censorship)
|
||||
# Replace content in both directions (censorship)
|
||||
pcre_rewrite clidata,srvdata dunno "porn|sex|pussy" "***" baduser
|
||||
pcre_extend deny * 192.168.0.1/16
|
||||
</pre>
|
||||
@ -994,11 +994,11 @@ pcre_extend deny * 192.168.0.1/16
|
||||
<b>Note:</b> Regular expressions don't require authentication and cannot replace
|
||||
authentication and/or allow/deny ACLs.
|
||||
</p>
|
||||
<li><A NAME="AUTH">How to limit service access</A>
|
||||
<li><A NAME="AUTH">How to limit service access</a>
|
||||
<p>
|
||||
First, always specify the internal interface to accept incoming connections with the
|
||||
'internal' configuration command or '-i' service command. (See
|
||||
<A HREF="#LAUNCH">How to start any of the proxy services (HTTP, SOCKS, etc.)</A>). If
|
||||
<A HREF="#LAUNCH">How to start any of the proxy services (HTTP, SOCKS, etc.)</a>). If
|
||||
no internal interface is specified, your proxy will act as an open proxy.
|
||||
<p>It's also important to specify the external interface to prevent access to the
|
||||
internal network with 'external' or -e.
|
||||
@ -1040,7 +1040,7 @@ socks
|
||||
|
||||
It's possible to authorize access by client IP address, IP address or requested resource,
|
||||
target port, time, etc., after authentication.
|
||||
(See <A HREF="#ACL">How to limit resource access</A>).
|
||||
(See <A HREF="#ACL">How to limit resource access</a>).
|
||||
</p><p>Since version 0.6, double authentication is possible, e.g.:
|
||||
<pre>
|
||||
auth iponly strong
|
||||
@ -1079,7 +1079,7 @@ critical resources, such as web administration.
|
||||
auth cache strong</pre>
|
||||
the user will not be able to use more than a single IP during the cache time (120 sec).
|
||||
</p>
|
||||
<li><A NAME="USERS">How to create a user list</A>
|
||||
<li><A NAME="USERS">How to create a user list</a>
|
||||
<p>
|
||||
The user list is created with the 'users' command.
|
||||
<pre>
|
||||
@ -1118,7 +1118,7 @@ It's possible to create NT and crypt passwords with the 3proxy_crypt utility inc
|
||||
in the distribution.
|
||||
<br>The user list is system-wide. To manage user access to a specific service, use ACLs.
|
||||
</p>
|
||||
<li><A NAME="ACL">How to limit user access to resources</A>
|
||||
<li><A NAME="ACL">How to limit user access to resources</a>
|
||||
<p>
|
||||
The commands allow, deny, and flush are used to manage ACLs:
|
||||
<p><font face="courier">
|
||||
@ -1130,7 +1130,7 @@ allow <userlist> <sourcelist> <targetlist> <targetportlist&
|
||||
The 'flush' command is used to finish with the existing ACL and start a new one.
|
||||
It's required to have different ACLs for different services.
|
||||
'allow' is used to allow a connection, and 'deny' to deny a connection. The 'allow'
|
||||
command can be extended by the 'parent' command to manage redirections (see <A href="#REDIR">How to manage redirections</A>). If the ACL
|
||||
command can be extended by the 'parent' command to manage redirections (see <A href="#REDIR">How to manage redirections</a>). If the ACL
|
||||
is empty, it allows everything. If the ACL is not empty, the first matching ACL entry
|
||||
is searched for the user request, and the ACL action (allow or deny) is performed. If
|
||||
no matching record is found, the connection is denied, and the user will be asked to
|
||||
@ -1178,7 +1178,7 @@ add 'deny *' to the end of the list.
|
||||
* in an ACL means "any".
|
||||
Usage examples can be found in 3proxy.cfg.sample.
|
||||
</p>
|
||||
<li><A NAME="REDIR">How to manage redirections</A>
|
||||
<li><A NAME="REDIR">How to manage redirections</a>
|
||||
<p>
|
||||
Redirections are useful to, e.g., forward requests from specific clients
|
||||
to different servers or proxy servers. Additionally, redirections are useful
|
||||
@ -1237,22 +1237,22 @@ auth iponly
|
||||
allow * * * 80,8080-8088
|
||||
parent 1000 http 0.0.0.0 0
|
||||
allow * * * 80,8080-8088
|
||||
#redirect ports 80 and 8080-8088 to local HTTP proxy
|
||||
#Second allow is required, because ACLs are checked
|
||||
#twice: first time by socks and second by http proxy.
|
||||
#redirect ports 80 and 8080-8088 to local HTTP proxy
|
||||
#Second allow is required, because ACLs are checked
|
||||
#twice: first time by socks and second by http proxy.
|
||||
|
||||
allow * * * 21,2121
|
||||
parent 1000 ftp 0.0.0.0 0
|
||||
allow * * * 21,2121
|
||||
#redirect ports 21 and 2121 to local
|
||||
#ftp proxy
|
||||
#redirect ports 21 and 2121 to local
|
||||
#ftp proxy
|
||||
|
||||
|
||||
allow *
|
||||
#allow the rest of connections directly
|
||||
#allow the rest of connections directly
|
||||
|
||||
socks
|
||||
#now let the socks server start
|
||||
#now let the socks server start
|
||||
</pre>
|
||||
|
||||
<p><i>Q: How does it affect different ACL rules?</i></p>
|
||||
@ -1260,20 +1260,20 @@ A: After local redirections, rules are applied again to the protocol-level reque
|
||||
<pre>
|
||||
allow * * * 80,8080-8088
|
||||
parent 1000 http 0.0.0.0 0
|
||||
#redirect http traffic to internal proxy
|
||||
#redirect http traffic to internal proxy
|
||||
|
||||
allow * * $c:\3proxy\local.nets 80,8080-8088
|
||||
#allow direct access to local.nets networks
|
||||
#allow direct access to local.nets networks
|
||||
allow * * * 80,8080-8088
|
||||
parent 1000 http proxy.3proxy.org 3128
|
||||
#use parent caching proxy for the rest of the networks
|
||||
#use parent caching proxy for the rest of the networks
|
||||
|
||||
allow *
|
||||
#allow direct connections for the rest of socks
|
||||
#requests
|
||||
#allow direct connections for the rest of socks
|
||||
#requests
|
||||
</pre>
|
||||
|
||||
<li><A NAME="ROUNDROBIN">How to balance traffic between multiple external channels?</A>
|
||||
<li><A NAME="ROUNDROBIN">How to balance traffic between multiple external channels?</a>
|
||||
<p>
|
||||
The proxy itself doesn't manage network-level routing. The only way to control
|
||||
the outgoing channel is to select the external interface. It's possible to make
|
||||
@ -1302,7 +1302,7 @@ for Windows:
|
||||
If you don't have a second address yet, just add it. Under Linux/Unix, it's better
|
||||
to use source routing.
|
||||
</p>
|
||||
<li><A NAME="CHAIN">How to manage proxy chains</A>
|
||||
<li><A NAME="CHAIN">How to manage proxy chains</a>
|
||||
<p>
|
||||
The parent command may also be used to build proxy chains. In this case,
|
||||
multiple 'parent' commands are used for a single 'allow' rule with different
|
||||
@ -1338,7 +1338,7 @@ the second hop is 192.168.20.1, and the 3rd one is either 192.168.30.1 with a pr
|
||||
of 30% or 192.168.40.1 with a probability of 70%.
|
||||
</p>
|
||||
|
||||
<li><A NAME="BANDLIM">How to limit bandwidth</A>
|
||||
<li><A NAME="BANDLIM">How to limit bandwidth</a>
|
||||
<p>
|
||||
3proxy supports bandwidth filters. Use the bandlimin/bandlimout and
|
||||
nobandlimin/nobandlimout commands to manage filters. 'in' means incoming and 'out' means outgoing traffic.
|
||||
@ -1368,7 +1368,7 @@ In this example:
|
||||
mail traffic from POP3 servers bypasses the pipe and has no bandwidth
|
||||
limitation.
|
||||
</p>
|
||||
<li><A NAME="TRAFLIM">How to limit traffic amount</A>
|
||||
<li><A NAME="TRAFLIM">How to limit traffic amount</a>
|
||||
<p>
|
||||
<p><font face="courier">
|
||||
counter <filename> <type> <reportpath>
|
||||
@ -1502,21 +1502,21 @@ proxy -p3128 -OcTCP_NODELAY,TCP_MAXSEG -OsTCP_NODELAY,TCP_MAXSEG
|
||||
</ul>
|
||||
|
||||
<hr>
|
||||
<li><A NAME="CLIENT">Client configuration</A>
|
||||
<li><A NAME="CLIENT">Client configuration</a>
|
||||
<p>
|
||||
<hr>
|
||||
<li><A NAME="ADMIN">Administering and information analysis</A>
|
||||
<li><A NAME="ADMIN">Administering and information analysis</a>
|
||||
<p>
|
||||
<ul>
|
||||
<li><A NAME="NEWVERSION">How to obtain latest 3proxy version</A>
|
||||
<li><A NAME="NEWVERSION">How to obtain latest 3proxy version</a>
|
||||
<p>
|
||||
The latest version of 3proxy may be obtained
|
||||
<A HREF="https://3proxy.org/">here</A>.
|
||||
<A HREF="https://3proxy.org/">here</a>.
|
||||
A new version may have changes and incompatibilities with the previous one in file
|
||||
formats or commands. Please read the CHANGELOG file and other documentation
|
||||
before installing a new version.
|
||||
</p>
|
||||
<li><A NAME="NTSERVICE">How to control 3proxy service under Windows NT/2000/XP</A>
|
||||
<li><A NAME="NTSERVICE">How to control 3proxy service under Windows NT/2000/XP</a>
|
||||
<p>
|
||||
If installed as a system service, 3proxy understands Windows service commands
|
||||
for START, STOP, PAUSE, and RESUME. If the service is PAUSEd, no new connections
|
||||
@ -1532,7 +1532,7 @@ You can control the 3proxy service via "Services" administration or via the "net
|
||||
net continue 3proxy
|
||||
</pre>
|
||||
</p>
|
||||
<li><A NAME="ERRORS">Log error codes reference</A>
|
||||
<li><A NAME="ERRORS">Log error codes reference</a>
|
||||
<p>
|
||||
<ul>
|
||||
<li>0 - Operation successfully completed (connection
|
||||
@ -1595,9 +1595,9 @@ You can control the 3proxy service via "Services" administration or via the "net
|
||||
</p>
|
||||
</ul>
|
||||
<hr>
|
||||
<li><A NAME="QUEST">How to ask a question not in How To?</A>
|
||||
<li><A NAME="QUEST">How to ask a question not in How To?</a>
|
||||
<p>
|
||||
Ask it in <A HREF="https://github.com/z3APA3A/3proxy/issues">Github</A>.
|
||||
Ask it in <A HREF="https://github.com/z3APA3A/3proxy/issues">Github</a>.
|
||||
Please read this document before asking a question.
|
||||
</ul>
|
||||
|
||||
|
||||
@ -210,16 +210,16 @@
|
||||
<b>Управление службой через launchd:</b>
|
||||
<br>После установки через cmake службой можно управлять с помощью launchctl:
|
||||
<pre>
|
||||
# Загрузить и запустить службу
|
||||
# Загрузить и запустить службу
|
||||
sudo launchctl load /Library/LaunchDaemons/org.3proxy.3proxy.plist
|
||||
|
||||
# Остановить службу
|
||||
# Остановить службу
|
||||
sudo launchctl stop org.3proxy.3proxy
|
||||
|
||||
# Запустить службу
|
||||
# Запустить службу
|
||||
sudo launchctl start org.3proxy.3proxy
|
||||
|
||||
# Выгрузить и отключить службу
|
||||
# Выгрузить и отключить службу
|
||||
sudo launchctl unload /Library/LaunchDaemons/org.3proxy.3proxy.plist</pre>
|
||||
Служба запускается от имени пользователя <code>proxy</code> (создаётся при установке).
|
||||
Файл конфигурации: <code>/etc/3proxy/3proxy.cfg</code>
|
||||
@ -388,7 +388,7 @@
|
||||
-l@ident</pre>
|
||||
соответствуют ведению журнала через syslog с идентификатором ident.
|
||||
<pre>
|
||||
log &connstring</pre>
|
||||
log &connstring;</pre>
|
||||
соответствует ведению журнала через ODBC, connstring задается в формате
|
||||
datasource,username,password (последние два параметра опциональны, если
|
||||
datasource не требует или уже содержит сведения для авторизации). При этом
|
||||
@ -614,17 +614,17 @@ tlspr поддерживает оба варианта: для implicit TLS хо
|
||||
опция -X заставляет tlspr говорить с клиентом на plaintext-фазе протокола (приветствие, команда STARTTLS) перед
|
||||
поднятием TLS с обеих сторон. Пример:
|
||||
</p><pre>
|
||||
# https (implicit)
|
||||
# https (implicit)
|
||||
tlspr -p443 -P443 -c1
|
||||
# imaps (implicit)
|
||||
# imaps (implicit)
|
||||
tlspr -p993 -P993 -c1
|
||||
# submissions (implicit)
|
||||
# submissions (implicit)
|
||||
tlspr -p465 -P465 -c1
|
||||
# imap STARTTLS (explicit)
|
||||
# imap STARTTLS (explicit)
|
||||
tlspr -p143 -P143 -Ximap
|
||||
# submission STARTTLS (explicit)
|
||||
# submission STARTTLS (explicit)
|
||||
tlspr -p587 -P587 -Xsmtp
|
||||
# pop3 STLS (explicit)
|
||||
# pop3 STLS (explicit)
|
||||
tlspr -p110 -P110 -Xpop3
|
||||
</pre>
|
||||
<p>
|
||||
@ -714,15 +714,15 @@ nscache 65536
|
||||
nscache6 65536
|
||||
dnspr -p53
|
||||
|
||||
# google
|
||||
# google
|
||||
nsrecord smtp.gmail.com 10.0.0.1
|
||||
nsrecord imap.gmail.com 10.0.0.1
|
||||
nsrecord pop.gmail.com 10.0.0.1
|
||||
# mail.ru
|
||||
# mail.ru
|
||||
nsrecord smtp.mail.ru 10.0.0.1
|
||||
nsrecord imap.mail.ru 10.0.0.1
|
||||
nsrecord pop.mail.ru 10.0.0.1
|
||||
# yandex.ru
|
||||
# yandex.ru
|
||||
nsrecord smtp.yandex.ru 10.0.0.1
|
||||
nsrecord imap.yandex.ru 10.0.0.1
|
||||
nsrecord pop.yandex.ru 10.0.0.1
|
||||
@ -835,10 +835,10 @@ ssl_nocli
|
||||
<b>Создание удостоверяющего центра (CA):</b>
|
||||
<br>Для MITM или mTLS требуется CA. Сгенерируйте закрытый ключ CA и сертификат:
|
||||
</p><pre>
|
||||
# Генерация закрытого ключа CA
|
||||
# Генерация закрытого ключа CA
|
||||
openssl genrsa -out ca.key 4096
|
||||
|
||||
# Генерация сертификата CA (действителен 10 лет)
|
||||
# Генерация сертификата CA (действителен 10 лет)
|
||||
openssl req -x509 -new -nodes -key ca.key -sha256 -days 3650 \
|
||||
-subj "/C=RU/ST=Region/L=City/O=MyOrg/CN=My CA" \
|
||||
-out ca.crt
|
||||
@ -850,15 +850,15 @@ openssl req -x509 -new -nodes -key ca.key -sha256 -days 3650 \
|
||||
<b>Создание серверного сертификата для https:// прокси:</b>
|
||||
<br>Серверный сертификат должен иметь правильные альтернативные имена (SAN):
|
||||
</p><pre>
|
||||
# Генерация закрытого ключа сервера
|
||||
# Генерация закрытого ключа сервера
|
||||
openssl genrsa -out server.key 2048
|
||||
|
||||
# Создание запроса на подпись сертификата (CSR)
|
||||
# Создание запроса на подпись сертификата (CSR)
|
||||
openssl req -new -key server.key \
|
||||
-subj "/C=RU/ST=Region/L=City/O=MyOrg/CN=proxy.example.com" \
|
||||
-out server.csr
|
||||
|
||||
# Создание файла расширений для SAN
|
||||
# Создание файла расширений для SAN
|
||||
cat > server.ext << 'EOF'
|
||||
authorityKeyIdentifier=keyid,issuer
|
||||
basicConstraints=CA:FALSE
|
||||
@ -872,7 +872,7 @@ DNS.2 = proxy
|
||||
IP.1 = 192.168.1.100
|
||||
EOF
|
||||
|
||||
# Подписание сертификата CA
|
||||
# Подписание сертификата CA
|
||||
openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key \
|
||||
-CAcreateserial -out server.crt -days 365 -sha256 \
|
||||
-extfile server.ext
|
||||
@ -883,27 +883,27 @@ openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key \
|
||||
<p>
|
||||
<b>Создание клиентского сертификата для mTLS:</b>
|
||||
</p><pre>
|
||||
# Генерация закрытого ключа клиента
|
||||
# Генерация закрытого ключа клиента
|
||||
openssl genrsa -out client1.key 2048
|
||||
|
||||
# Создание CSR
|
||||
# Создание CSR
|
||||
openssl req -new -key client1.key \
|
||||
-subj "/C=RU/ST=Region/L=City/O=MyOrg/CN=client1" \
|
||||
-out client1.csr
|
||||
|
||||
# Создание файла расширений
|
||||
# Создание файла расширений
|
||||
cat > client.ext << 'EOF'
|
||||
basicConstraints=CA:FALSE
|
||||
keyUsage = digitalSignature, nonRepudiation, keyEncipherment
|
||||
extendedKeyUsage = clientAuth
|
||||
EOF
|
||||
|
||||
# Подписание CA
|
||||
# Подписание CA
|
||||
openssl x509 -req -in client1.csr -CA ca.crt -CAkey ca.key \
|
||||
-CAcreateserial -out client1.crt -days 365 -sha256 \
|
||||
-extfile client.ext
|
||||
|
||||
# Создание PKCS#12 для импорта в браузер
|
||||
# Создание PKCS#12 для импорта в браузер
|
||||
openssl pkcs12 -export -out client1.p12 \
|
||||
-inkey client1.key -in client1.crt -certfile ca.crt
|
||||
</pre>
|
||||
@ -913,15 +913,15 @@ openssl pkcs12 -export -out client1.p12 \
|
||||
<p>
|
||||
<b>Скрипт быстрой настройки для разработки/тестирования:</b>
|
||||
</p><pre>
|
||||
#!/bin/sh
|
||||
# Создаёт CA, серверный и клиентский сертификаты для тестирования SSLPlugin
|
||||
#!/bin/sh
|
||||
# Создаёт CA, серверный и клиентский сертификаты для тестирования SSLPlugin
|
||||
|
||||
# CA
|
||||
# CA
|
||||
openssl genrsa -out ca.key 4096
|
||||
openssl req -x509 -new -nodes -key ca.key -sha256 -days 3650 \
|
||||
-subj "/CN=3proxy CA" -out ca.crt
|
||||
|
||||
# Сервер
|
||||
# Сервер
|
||||
openssl genrsa -out server.key 2048
|
||||
openssl req -new -key server.key -subj "/CN=localhost" -out server.csr
|
||||
cat > server.ext << 'EOF'
|
||||
@ -933,7 +933,7 @@ EOF
|
||||
openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key \
|
||||
-CAcreateserial -out server.crt -days 365 -sha256 -extfile server.ext
|
||||
|
||||
# Клиент
|
||||
# Клиент
|
||||
openssl genrsa -out client.key 2048
|
||||
openssl req -new -key client.key -subj "/CN=client" -out client.csr
|
||||
cat > client.ext << 'EOF'
|
||||
@ -991,13 +991,13 @@ IP назначения, порты и т.д.), аналогичный кома
|
||||
<p>
|
||||
<b>Примеры:</b>
|
||||
</p><pre>
|
||||
# Блокировать запросы с определёнными ключевыми словами для некоторых пользователей
|
||||
# Блокировать запросы с определёнными ключевыми словами для некоторых пользователей
|
||||
pcre request deny "porn|sex" user1,user2,user3 192.168.0.0/16
|
||||
|
||||
# Блокировать ответы с определённым content-type
|
||||
# Блокировать ответы с определённым content-type
|
||||
pcre srvheader deny "Content-type: application"
|
||||
|
||||
# Замена содержимого в обоих направлениях (цензура)
|
||||
# Замена содержимого в обоих направлениях (цензура)
|
||||
pcre_rewrite clidata,srvdata dunno "porn|sex|pussy" "***" baduser
|
||||
pcre_extend deny * 192.168.0.1/16
|
||||
</pre>
|
||||
@ -1268,16 +1268,16 @@ pcre_extend deny * 192.168.0.1/16
|
||||
allow * * * 80,8080-8088
|
||||
parent 1000 http 0.0.0.0 0
|
||||
allow * * * 80,8080-8088
|
||||
#перенаправить соединения по портам 80 и 8080-8088 в локальный
|
||||
#http прокси. Вторая команда allow необходима, т.к. контроль доступа
|
||||
#осуществляется 2 раза - на уровне socks и на уровне HTTP прокси
|
||||
#перенаправить соединения по портам 80 и 8080-8088 в локальный
|
||||
#http прокси. Вторая команда allow необходима, т.к. контроль доступа
|
||||
#осуществляется 2 раза - на уровне socks и на уровне HTTP прокси
|
||||
allow * * * 21,2121
|
||||
parent 1000 ftp 0.0.0.0 0
|
||||
allow * * * 21,2121
|
||||
#перенаправить соединения по портам 21 и 2121 в локальный
|
||||
#ftp прокси
|
||||
#перенаправить соединения по портам 21 и 2121 в локальный
|
||||
#ftp прокси
|
||||
allow *
|
||||
#пустить все соединения напрямую
|
||||
#пустить все соединения напрямую
|
||||
socks</pre>
|
||||
</p>
|
||||
<li><a name="REDIINTER"><i>Q: Как взаимодействует с другими правилами в ACL?</i></a></li>
|
||||
@ -1292,14 +1292,14 @@ pcre_extend deny * 192.168.0.1/16
|
||||
<pre>
|
||||
allow * * * 80,8080-8088
|
||||
parent 1000 http 0.0.0.0 0
|
||||
#перенаправить во внутренний прокси
|
||||
#перенаправить во внутренний прокси
|
||||
allow * * $c:\3proxy\local.nets 80,8080-8088
|
||||
#разрешить прямой web-доступ к сетям из local.nets
|
||||
#разрешить прямой web-доступ к сетям из local.nets
|
||||
allow * * * 80,8080-8088
|
||||
parent 1000 http proxy.3proxy.ru 3128
|
||||
#все остальные веб-запросы перенаправить на внешний прокси-сервер
|
||||
#все остальные веб-запросы перенаправить на внешний прокси-сервер
|
||||
allow *
|
||||
#разрешить socks-запросы по другим портам</pre>
|
||||
#разрешить socks-запросы по другим портам</pre>
|
||||
</p>
|
||||
</ul>
|
||||
<li><a name="ROUNDROBIN"><i>Как организовать балансировку между несоклькими каналами</i></a>
|
||||
|
||||
Loading…
Reference in New Issue
Block a user