mirror of
https://github.com/3proxy/3proxy.git
synced 2025-02-23 18:45:40 +08:00
Merge remote-tracking branch 'refs/remotes/origin/devel'
This commit is contained in:
z3APA3A
commit
87c947987c
@ -33,6 +33,9 @@
|
||||
<li><A HREF="#BANDLIM">How to limit bandwidth</A>
|
||||
<li><A HREF="#TRAFLIM">How to limit traffic amount</A>
|
||||
<li><A HREF="#NETLIST">How to build network lists</A>
|
||||
<li><a href="#NSCACHING">How to configure name resolution and DNS caching</a>
|
||||
<li><a href="#IPV6">How to use IPv6</a>
|
||||
<li><a href="#CONNBACK">How to use connect back</a>
|
||||
</ul>
|
||||
<li><A HREF="#CLIENT">Client configuration</A>
|
||||
<li><A HREF="#ADMIN">Administering and information analisys</A>
|
||||
@ -737,6 +740,65 @@ flush
|
||||
In this example we obtain list of local networks from provider's page to
|
||||
local.networks file, allow direct access to these networks and redirect all
|
||||
connection to external networks to provider's proxy.
|
||||
</p>
|
||||
<li><a name="NSCACHING"><i>How to configure name resolution and DNS caching</i></a>
|
||||
<p>
|
||||
For name resolution and caching use commands nserver, nscache / nscache6 and nsrecord.
|
||||
<pre>
|
||||
nserver 192.168.1.2
|
||||
nserver 192.168.1.3:5353/tcp</pre>
|
||||
sets DNS resolvers. 192.168.1.3 will be used via TCP/5353 (instead of default UDP/53)
|
||||
only if 192.168.1.2 fails. Up to 5 nservers may be specified.
|
||||
If no nserver is configured, default system name resolution functions are used.
|
||||
<pre>
|
||||
nscache 65535
|
||||
nscache6 65535</pre>
|
||||
sets name cache size for IPv4 and IPv6. Name cache must be large enouth, if presents.
|
||||
name cache is only used if nserver is configured.
|
||||
<pre>
|
||||
nsrecord server.mycompany.example.com 192.168.1.1
|
||||
nsrecord www.porno.com 127.0.0.2
|
||||
...
|
||||
deny * * 127.0.0.2</pre>
|
||||
adds static nsrecords. Also, static nsrecords are used for dnspr, unless -s option is specified.
|
||||
Since 0.8 version, parent proxy may be configured for dnspr.
|
||||
</p>
|
||||
<li><a name="IPV6"><i>How to use IPv6</i></a>
|
||||
<p>
|
||||
IPv6 is supported since 0.8. Please note, some proxy protolos, e.g. SOCKSv4,
|
||||
do not support IPv6. SOCKSv5 supports IPv6 with special request type (must be
|
||||
implemented by client).
|
||||
<br>
|
||||
3proxy supports proxying from IPv4 and IPv6 networks to IPv4,
|
||||
IPv6 and mixed networks. IPv6 address may be used in
|
||||
internal, external, parent commands, ACLs, -i and -e options,etc.
|
||||
external command and -e options may be given twice for each service - once with IPv4
|
||||
and once with IPv6 address. internal can be given only once, to bind to all IPv4 and
|
||||
IPv6 addresses use [0:0:0:0:0:0:0:0] or [::].
|
||||
<br>
|
||||
Any service may be configured with -4, -46, -64, -6 options to specify decied
|
||||
priority for name to IPv4/IPv6 address resolution (IPv4 only, IPv4 priority,
|
||||
IPv6 priority, IPv6 only).
|
||||
</p>
|
||||
<li><a name="CONNBACK"><i>How to use connect back</i></a>
|
||||
<p>
|
||||
In example, users needs access from external network to proxy server located
|
||||
on the host 192.168.1.2. This host can not be accessed from external network,
|
||||
but it has access to external network with with external address 1.1.1.1.
|
||||
Also, user has access to the host 2.2.2.2 (IP address may be dynamic) with
|
||||
hostname host.dyndns.example.org via external network. User needs 2 instances
|
||||
of 3proxy, first one on the host 192.168.1.2 with config
|
||||
<pre>
|
||||
users user:CL:password
|
||||
auth strong
|
||||
allow user
|
||||
proxy -rhost.dyndns.example.org:1234</pre>
|
||||
second one on the host.dyndns.example.org (2.2.2.2) with config
|
||||
<pre>
|
||||
auth iponly
|
||||
allow * * 1.1.1.1
|
||||
tcppm -R0.0.0.0:1234 3128 1.1.1.1 3128</pre>
|
||||
For browser settings proxy is host.dyndns.example.org:3128.
|
||||
</p>
|
||||
</ul>
|
||||
|
||||
|
||||
@ -34,6 +34,8 @@
|
||||
<li><a href="#TRAFLIM">Как ограничивать объем принимаемого трафика</a>
|
||||
<li><a href="#NETLIST">Как строить списки сетей</a>
|
||||
<li><a href="#NSCACHING">Как управлять разрешением имен и кэшированием DNS</a>
|
||||
<li><a href="#IPV6">Как использовать IPv6</a>
|
||||
<li><a href="#CONNBACK">Как использовать connect back</a>
|
||||
<li><a href="#DEMANDDIAL">Как устанавливать соединение по требованию</a>
|
||||
</ul>
|
||||
<li><a href="#CLIENT">Конфигурация и настройка клиентов</a>
|
||||
@ -765,21 +767,57 @@
|
||||
nscache и nsrecord.
|
||||
<pre>
|
||||
nserver 192.168.1.2
|
||||
nserver 192.168.1.3</pre>
|
||||
nserver 192.168.1.3:5353/tcp</pre>
|
||||
указывает 3proxy какие машины следует использвоать в качестве серверов
|
||||
DNS. Сервер 192.168.1.3 будет использоваться толкьо при недостижимости
|
||||
DNS. Сервер 192.168.1.3 будет использоваться по порту TCP/5353 (вместо дефолтного UDP/53) только при недостижимости
|
||||
192.168.1.2. Можно указать до 5 серверов. Если nserver не указан, будут
|
||||
использованы системные функции разрешения имен.
|
||||
<pre>
|
||||
nscache 65535</pre>
|
||||
указывает размер кэша для разрешения имен (обычно достаточно большой).
|
||||
nscache 65535
|
||||
nscache6 65535</pre>
|
||||
указывает размер кэша для разрешения имен (обычно достаточно большой) для IPv4 и IPv6 соответственно.
|
||||
Кэш исопльзуется только при явном указании nserver.
|
||||
<pre>
|
||||
nsrecord server.mycompany.example.com 192.168.1.1
|
||||
nsrecord www.porno.com 127.0.0.2
|
||||
...
|
||||
deny * * 127.0.0.2</pre>
|
||||
добавляет статическую запись в кэш.</p>
|
||||
добавляет статическую запись в кэш. Статические записи так же влияют на разрешение через dnspr если не указана опция -s. Начиная с версии 0.8 для dnspr могут быть сконфигурированы родительские прокси.</p>
|
||||
<li><a name="IPv6"><i>Как использовать IPv6</i></a>
|
||||
<p>
|
||||
IPv6 поддерживается с версии 0.8. Обратите внимание, что в некоторых видах прокси (например SOCKSv4)
|
||||
IPv6 не поддерживает на уровне протокола. В SOCKSv5 есть поддержка IPv6 с помощью отдельного вида
|
||||
запроса, который должен быть реализован в клиентском приложении или соксификаторе.
|
||||
<br>
|
||||
Возможно проксирование из сетей IPv4 и IPv6 в сети IPv4,
|
||||
IPv6 и смешанные. Адреса IPv6 могут использоваться в командах
|
||||
internal, external, parent, ACL, опциях -i, -e и т.д. Команду external и опцию
|
||||
-e для каждого сервиса можно давать два раза - один раз с IPv4 и один раз с IPv6
|
||||
адресом. internal и -i может быть указан только один, для биндинга ко всем адресам IPv4 и IPv6
|
||||
можно использовать адрес [0:0:0:0:0:0:0:0] or [::].
|
||||
<br>
|
||||
Кроме того, для каждого сервиса могут быть даны опции -4, -46, -64, -6 которые
|
||||
задают приоритет разрешения имен в адреса IPv4 и IPv6 (только IPv4, приоритет IPv4, приоритет IPv6, только IPv6).
|
||||
</p>
|
||||
<li><a name="CONNBACK"><i>Как использовать connect back</i></a>
|
||||
<p>
|
||||
Например, пользователю нужен доступ к прокси-серверу, который расположен
|
||||
на хосте 192.168.1.2 недоступном из внешней сети, но имеющем доступ во внешнюю
|
||||
сеть с внешним адрес 1.1.1.1. Так же у него есть машина с именем host.dyndns.example.org
|
||||
с внешним адресом 2.2.2.2. Пользователь запускает 2 экземпляра 3proxy, один на
|
||||
хосте 192.168.1.2 с конфигурацией
|
||||
<pre>
|
||||
users user:CL:password
|
||||
auth strong
|
||||
allow user
|
||||
proxy -rhost.dyndns.example.org:1234</pre>
|
||||
второй на хосте host.dyndns.example.org (2.2.2.2) с конфигурацией
|
||||
<pre>
|
||||
auth iponly
|
||||
allow * * 1.1.1.1
|
||||
tcppm -R0.0.0.0:1234 3128 1.1.1.1 3128</pre>
|
||||
В настройках браузера указывается host.dyndns.example.org:3128.
|
||||
</p>
|
||||
<li><a name="DEMANDDIAL"><i>Как устанавливать соединение по требованию</i></a>
|
||||
<p>
|
||||
Команда dialer задает программу, которая будет запускаться при
|
||||
|
||||
@ -113,19 +113,30 @@ view without ability to reset).
|
||||
(for dnspr) - simple, do not use 'resolver' and 3proxy cache, always use external DNS server.
|
||||
.br
|
||||
(for udppm) - singlepacket, expect only one packet from both client and server
|
||||
.br
|
||||
.B -a
|
||||
(for proxy) - anonymous proxy (no information about client reported)
|
||||
.br
|
||||
.B -a1
|
||||
(for proxy) - anonymous proxy (random client information reported)
|
||||
.br
|
||||
.B -6
|
||||
Only resolve IPv6 addresses
|
||||
.br
|
||||
.B -4
|
||||
Only resolve IPv4 addresses
|
||||
.br
|
||||
.B -46
|
||||
Resolve IPv6 addresses if IPv4 address is not resolvable
|
||||
.br
|
||||
.B -64
|
||||
Resolve IPv4 addresses if IPv6 address is not resolvable
|
||||
.br
|
||||
.B -RHOST:port
|
||||
listen on given local HOST:port for incoming connections instead of making remote outgoing connection. Can be used with another 3proxy service running -r option for connect back functionality. Most commonly used with tcppm. HOST can be given as IP or hostname, useful in case of dynamic DNS.
|
||||
.br
|
||||
.B -rHOST:port
|
||||
connect to given remote HOST:port instead of listening local connection on -p or default port. Can be used with another 3proxy service running -R option for connect back functionality. Most commonly used with proxy or socks. HOST can be given as IP or hostname, useful in case of dynamic DNS.
|
||||
.br
|
||||
Also, all options mentioned for
|
||||
.BR proxy (8)
|
||||
@ -157,13 +168,9 @@ proxy on a client with FTP proxy support. Username format is one of
|
||||
.br
|
||||
proxyuser:proxypassword:FTPuser:FTPpassword@FTPserver
|
||||
.br
|
||||
Please note, if you use FTP client interface for FTP proxy
|
||||
do not add FTPpassword and FTPServer to username, because
|
||||
FTP client does it for you. That is, if you use 3proxy with
|
||||
authentication use
|
||||
proxyuser:proxypassword:FTPuser
|
||||
as FTP username, otherwise do not change original FTP user name
|
||||
Please note, if you use FTP client interface for FTP proxy do not add FTPpassword and FTPServer to username, because FTP client does it for you. That is, if you use 3proxy with authentication use proxyuser:proxypassword:FTPuser as FTP username, otherwise do not change original FTP user name
|
||||
|
||||
.br
|
||||
.B include
|
||||
<path>
|
||||
.br
|
||||
@ -478,6 +485,7 @@ required in ACL. It's usefull to protect access to some resources with
|
||||
password allowing passwordless access to another resources, or to use
|
||||
IP-based authentication for dedicated laptops and request username/password for
|
||||
shared ones.
|
||||
|
||||
.br
|
||||
.B authcache
|
||||
<cachtype> <cachtime>
|
||||
@ -496,6 +504,7 @@ assigned to the same user without actual authentication.
|
||||
user,password - both username and password are checked against cached ones.
|
||||
.br
|
||||
Use auth type 'cache' for cached authentication
|
||||
|
||||
.br
|
||||
.B allow
|
||||
<userlist> <sourcelist> <targetlist> <targetportlist> <operationlist>
|
||||
@ -573,7 +582,9 @@ Operation is one of:
|
||||
Weeksdays are week days numbers or periods (0 or 7 means Sunday, 1 is Monday,
|
||||
1-5 means Monday through Friday). Timeperiodlists is a list of time
|
||||
periods in HH:MM:SS-HH:MM:SS format. For example,
|
||||
.br
|
||||
00:00:00-08:00:00,17:00:00-24:00:00
|
||||
.br
|
||||
lists non-working hours.
|
||||
|
||||
.br
|
||||
@ -726,6 +737,7 @@ Weight may be used for different purposes.
|
||||
.br
|
||||
.B nobandlimin
|
||||
<userlist> <sourcelist> <targetlist> <targetportlist> <operationlist>
|
||||
.br
|
||||
.B bandlimout
|
||||
<rate> <userlist> <sourcelist> <targetlist> <targetportlist> <operationlist>
|
||||
.br
|
||||
@ -750,7 +762,7 @@ addresses) to 57600 bps you have to specify 4 rules like
|
||||
.br
|
||||
bandlimin 57600 * 192.168.10.19
|
||||
.br
|
||||
and every of you clients will have 56K channel. if you specify
|
||||
and every of you clients will have 56K channel. If you specify
|
||||
.br
|
||||
bandlimin 57600 * 192.168.10.16/30
|
||||
.br
|
||||
@ -787,6 +799,8 @@ no traffic information on this counter is saved in file (that is
|
||||
if proxy restarted all information is loosed) overwise it should be
|
||||
unique sequential number.
|
||||
Type specifies a type of counter. Type is one of:
|
||||
.br
|
||||
H - counter is resetted hourly
|
||||
.br
|
||||
D - counter is resetted daily
|
||||
.br
|
||||
@ -799,7 +813,7 @@ Reporttype is one of D,W,M,H(hourly) and repotname specifies filename
|
||||
template for reports. Report is text file with counter values in
|
||||
format:
|
||||
.br
|
||||
<COUNTERNUMBER> <TRAF*4GB> <TRAF>
|
||||
<COUNTERNUMBER> <TRAF>
|
||||
.br
|
||||
The rest of parameters is identical to bandlim/nobandlim.
|
||||
|
||||
@ -823,7 +837,7 @@ example:
|
||||
.br
|
||||
users test3:NT:BD7DFBF29A93F93C63CB84790DA00E63
|
||||
.br
|
||||
(note: double quotes are requiered because password contains $ sign).
|
||||
Note: double quotes are requiered because password contains $ sign.
|
||||
|
||||
.br
|
||||
.B flush
|
||||
|
||||
@ -127,8 +127,8 @@ int MODULEMAINFUNC (int argc, char** argv){
|
||||
" -t be silent (do not log service start/stop)\n"
|
||||
" -iIP ip address or internal interface (clients are expected to connect)\n"
|
||||
" -eIP ip address or external interface (outgoing connection will have this)\n"
|
||||
" -rIP:PORT Use IP:port for connect back proxy instead of listen port\n"
|
||||
" -RPORT Use PORT to listen connect back proxy connection to pass data to\n"
|
||||
" -rHOST:PORT Use IP:port for connect back proxy instead of listen port\n"
|
||||
" -RHOST:PORT Use PORT to listen connect back proxy connection to pass data to\n"
|
||||
" -4 Use IPv4 for outgoing connections\n"
|
||||
" -6 Use IPv6 for outgoing connections\n"
|
||||
" -46 Prefer IPv4 for outgoing connections, use both IPv4 and IPv6\n"
|
||||
|
||||
Loading…
Reference in New Issue
Block a user