Nginx?Socket代理的實現(xiàn)方法
前言
Nginx 的 socket 代理通常指的是 Nginx 通過 stream 模塊來處理非 HTTP 的 TCP 流量,比如數(shù)據(jù)庫連接、SSH 連接或其他 TCP 協(xié)議的流量。stream 模塊允許 Nginx 作為一個反向代理來處理這些連接。
簡單的 Nginx stream 代理配置
以下是一個簡單的 Nginx stream 代理配置示例,用于代理 TCP 連接:
events {
worker_connections 1024;
}
stream {
server {
listen <local_port>; # Nginx 監(jiān)聽的本地端口
proxy_pass <backend_server>:<backend_port>; # 后端服務器的地址和端口
# 可選配置項
# proxy_connect_timeout 1s; # 連接超時時間
# proxy_timeout 10m; # 代理超時時間
}
}
在這個配置中,你需要替換 <local_port> 為 Nginx 將要監(jiān)聽的本地端口,以及 <backend_server> 和 <backend_port> 為實際的后端服務器地址和端口。
負載均衡配置
stream 模塊還支持負載均衡。你可以使用 upstream 塊來定義一組后端服務器,然后在 server 塊中引用這個 upstream 塊。
stream {
upstream backend_servers {
server backend1.example.com:12345;
server backend2.example.com:12345;
# 可以添加更多服務器
# 可選配置項
# hash $remote_addr; # 根據(jù)客戶端 IP 進行哈希負載均衡
# least_conn; # 使用最少連接數(shù)的服務器
}
server {
listen <local_port>;
proxy_pass backend_servers;
}
}
注意幾點:
- stream 模塊:確保你的 Nginx 版本支持 stream 模塊。較新版本的 Nginx 默認包含這個模塊。
- 非 HTTP 流量:stream 模塊處理的是 TCP 流量,不是 HTTP 流量。因此,它不適合代理 web 請求。
- 安全性:當你代理敏感數(shù)據(jù)(如數(shù)據(jù)庫連接)時,請確保使用加密連接(如 SSL/TLS),并在 Nginx 配置中啟用相應的加密選項。
- 負載均衡:除了簡單的代理功能外,你還可以使用 stream 模塊來實現(xiàn) TCP 連接的負載均衡。這可以通過在
upstream塊中定義多個后端服務器來實現(xiàn)。 - 日志和監(jiān)控:與 HTTP 代理一樣,你也可以為 stream 代理配置日志和監(jiān)控功能,以便跟蹤和調試連接問題。
一、編譯安裝支持stream 模塊的Nginx
1.安裝必要的編譯工具和依賴項
在 CentOS 7 上,您可以使用以下命令安裝這些工具:
sudo yum install gcc-c++ pcre-devel zlib-devel make
2. 下載Nginx源代碼
下載 Nginx 1.24.0 的源代碼壓縮包,并解壓縮:
wget http://nginx.org/download/nginx-1.24.0.tar.gz tar -zxvf nginx-1.24.0.tar.gz
改名
mv nginx-1.24.0 nginxSrc
3. 配置編譯選項
進入 Nginx 源代碼目錄并運行configure腳本,指定所需的stream功能模塊。
[root@td66 nginxSrc]# ./configure --prefix=/usr/local/nginx --with-stream
checking for OS
+ Linux 3.10.0-957.el7.x86_64 x86_64
checking for C compiler ... found
+ using GNU C compiler
+ gcc version: 4.8.5 20150623 (Red Hat 4.8.5-44) (GCC)
checking for gcc -pipe switch ... found
checking for -Wl,-E switch ... found
checking for gcc builtin atomic operations ... found
checking for C99 variadic macros ... found
checking for gcc variadic macros ... found
checking for gcc builtin 64 bit byteswap ... found
checking for unistd.h ... found
checking for inttypes.h ... found
checking for limits.h ... found
checking for sys/filio.h ... not found
checking for sys/param.h ... found
checking for sys/mount.h ... found
checking for sys/statvfs.h ... found
checking for crypt.h ... found
checking for Linux specific features
checking for epoll ... found
checking for EPOLLRDHUP ... found
checking for EPOLLEXCLUSIVE ... not found
checking for eventfd() ... found
checking for O_PATH ... found
checking for sendfile() ... found
checking for sendfile64() ... found
checking for sys/prctl.h ... found
checking for prctl(PR_SET_DUMPABLE) ... found
checking for prctl(PR_SET_KEEPCAPS) ... found
checking for capabilities ... found
checking for crypt_r() ... found
checking for sys/vfs.h ... found
checking for UDP_SEGMENT ... not found
checking for nobody group ... found
checking for poll() ... found
checking for /dev/poll ... not found
checking for kqueue ... not found
checking for crypt() ... not found
checking for crypt() in libcrypt ... found
checking for F_READAHEAD ... not found
checking for posix_fadvise() ... found
checking for O_DIRECT ... found
checking for F_NOCACHE ... not found
checking for directio() ... not found
checking for statfs() ... found
checking for statvfs() ... found
checking for dlopen() ... not found
checking for dlopen() in libdl ... found
checking for sched_yield() ... found
checking for sched_setaffinity() ... found
checking for SO_SETFIB ... not found
checking for SO_REUSEPORT ... found
checking for SO_ACCEPTFILTER ... not found
checking for SO_BINDANY ... not found
checking for IP_TRANSPARENT ... found
checking for IP_BINDANY ... not found
checking for IP_BIND_ADDRESS_NO_PORT ... found
checking for IP_RECVDSTADDR ... not found
checking for IP_SENDSRCADDR ... not found
checking for IP_PKTINFO ... found
checking for IPV6_RECVPKTINFO ... found
checking for TCP_DEFER_ACCEPT ... found
checking for TCP_KEEPIDLE ... found
checking for TCP_FASTOPEN ... found
checking for TCP_INFO ... found
checking for accept4() ... found
checking for int size ... 4 bytes
checking for long size ... 8 bytes
checking for long long size ... 8 bytes
checking for void * size ... 8 bytes
checking for uint32_t ... found
checking for uint64_t ... found
checking for sig_atomic_t ... found
checking for sig_atomic_t size ... 4 bytes
checking for socklen_t ... found
checking for in_addr_t ... found
checking for in_port_t ... found
checking for rlim_t ... found
checking for uintptr_t ... uintptr_t found
checking for system byte ordering ... little endian
checking for size_t size ... 8 bytes
checking for off_t size ... 8 bytes
checking for time_t size ... 8 bytes
checking for AF_INET6 ... found
checking for setproctitle() ... not found
checking for pread() ... found
checking for pwrite() ... found
checking for pwritev() ... found
checking for strerrordesc_np() ... not found
checking for sys_nerr ... found
checking for localtime_r() ... found
checking for clock_gettime(CLOCK_MONOTONIC) ... found
checking for posix_memalign() ... found
checking for memalign() ... found
checking for mmap(MAP_ANON|MAP_SHARED) ... found
checking for mmap("/dev/zero", MAP_SHARED) ... found
checking for System V shared memory ... found
checking for POSIX semaphores ... not found
checking for POSIX semaphores in libpthread ... found
checking for struct msghdr.msg_control ... found
checking for ioctl(FIONBIO) ... found
checking for ioctl(FIONREAD) ... found
checking for struct tm.tm_gmtoff ... found
checking for struct dirent.d_namlen ... not found
checking for struct dirent.d_type ... found
checking for sysconf(_SC_NPROCESSORS_ONLN) ... found
checking for sysconf(_SC_LEVEL1_DCACHE_LINESIZE) ... found
checking for openat(), fstatat() ... found
checking for getaddrinfo() ... found
checking for PCRE2 library ... not found
checking for PCRE library ... found
checking for PCRE JIT support ... found
checking for zlib library ... found
creating objs/Makefile
Configuration summary
+ using system PCRE library
+ OpenSSL library is not used
+ using system zlib library
nginx path prefix: "/usr/local/nginx"
nginx binary file: "/usr/local/nginx/sbin/nginx"
nginx modules path: "/usr/local/nginx/modules"
nginx configuration prefix: "/usr/local/nginx/conf"
nginx configuration file: "/usr/local/nginx/conf/nginx.conf"
nginx pid file: "/usr/local/nginx/logs/nginx.pid"
nginx error log file: "/usr/local/nginx/logs/error.log"
nginx http access log file: "/usr/local/nginx/logs/access.log"
nginx http client request body temporary files: "client_body_temp"
nginx http proxy temporary files: "proxy_temp"
nginx http fastcgi temporary files: "fastcgi_temp"
nginx http uwsgi temporary files: "uwsgi_temp"
nginx http scgi temporary files: "scgi_temp"
這將配置Nginx以使用"/usr/local/nginx"作為安裝目錄。
4. 編譯和安裝
[root@td66 nginxSrc]# make && make install make -f objs/Makefile make[1]: 進入目錄“/usr/local/nginxSrc” cc -c -pipe -O -W -Wall -Wpointer-arith -Wno-unused-parameter -Werror -g -I src/core -I src/event -I src/event/modules -I src/os/unix -I objs \ -o objs/src/core/nginx.o \ src/core/nginx.c cc -c -pipe -O -W -Wall -Wpointer-arith -Wno-unused-parameter -Werror -g -I src/core -I src/event -I src/event/modules -I src/os/unix -I objs \ -o objs/src/core/ngx_log.o \ src/core/ngx_log.c
5. 啟動 Nginx
cd /usr/local/nginx/sbin/ ./nginx
6. 驗證安裝
打開您的 Web 瀏覽器并訪問服務器的 IP 地址或域名,您應該能夠看到 Nginx 的歡迎頁面。
二、Nginx命令
nginx 命令用于控制 Nginx 服務器的啟動、停止、重新加載配置文件等操作。以下是一些常用的 nginx 命令及其說明:
1. 啟動 Nginx
nginx
這個命令將啟動 Nginx 服務器。如果配置文件(通常是 /etc/nginx/nginx.conf 或 /usr/local/nginx/conf/nginx.conf)存在且沒有語法錯誤,Nginx 將開始監(jiān)聽配置的端口,并處理請求。
2. 停止 Nginx
nginx -s stop
或者
sudo service nginx stop
或者在某些系統(tǒng)上
sudo systemctl stop nginx
這些命令將停止正在運行的 Nginx 服務器。-s stop 選項發(fā)送一個信號給 Nginx 主進程,讓它立即停止。
3. 重新加載配置
nginx -s reload
或者
sudo service nginx reload
或者在某些系統(tǒng)上
sudo systemctl reload nginx
這個命令將重新加載 Nginx 的配置文件。如果配置文件有變動,這個命令將應用新的配置,而不需要停止和重新啟動 Nginx。重新加載配置通常不會導致正在處理的請求中斷。
4. 測試配置文件的語法
nginx -t
這個命令將檢查 Nginx 配置文件的語法是否正確,并返回結果。如果配置文件有語法錯誤,nginx -t 會指出錯誤的位置,但不會實際加載配置。
5. 顯示版本信息
nginx -v
這個命令將顯示當前安裝的 Nginx 的版本信息。
6. 顯示編譯選項
nginx -V
這個命令將顯示 Nginx 在編譯時使用的選項和包含的模塊。這對于診斷問題或了解特定模塊是否已編譯非常有用。
7. 其他常用命令
- 查看幫助信息:
nginx -h或nginx --help - 平滑升級 Nginx:可以使用
nginx -s quit來優(yōu)雅地關閉舊版本的 Nginx,然后啟動新版本。
請注意,上述命令可能需要使用 sudo 來獲取管理員權限,具體取決于你的系統(tǒng)設置和 Nginx 的安裝方式。此外,不同系統(tǒng)或安裝方式可能會使用不同的服務管理器(如 systemctl、service 或 /etc/init.d/nginx 腳本),所以停止和啟動服務的命令可能有所不同。
三、Nginx stream配置
3.1 編輯nginx.conf文件
vim nginx.conf
#user nobody;
worker_processes 1;
#error_log logs/error.log;
#error_log logs/error.log notice;
#error_log logs/error.log info;
#pid logs/nginx.pid;
events {
worker_connections 1024;
}
stream {
server {
listen 6666; # Nginx 監(jiān)聽的端口
proxy_pass 10.68.8.70:6666; # 后端服務器的地址和端口
}
}
3.2檢查配置文件是否正確
nginx -t -c nginx.conf
如果報如下錯誤說明沒有成功安裝stream模塊
nginx: [emerg] unknown directive "stream" in /usr/local/nginx/conf/nginx.conf:16
3.3 使配置文件生效
nginx -s reload
到此這篇關于Nginx Socket代理的實現(xiàn)方法的文章就介紹到這了,更多相關Nginx Socket代理內容請搜索腳本之家以前的文章或繼續(xù)瀏覽下面的相關文章希望大家以后多多支持腳本之家!
相關文章
Nginx 配置 ModSecurity 網絡應用防火墻實現(xiàn)
這篇文章主要介紹了Nginx 配置 ModSecurity 網絡應用防火墻實現(xiàn),文中通過示例代碼介紹的非常詳細,對大家的學習或者工作具有一定的參考學習價值,需要的朋友們下面隨著小編來一起學習學習吧2023-12-12
Linux下Nginx負載均衡多個tomcat配置的方法步驟
這篇文章主要介紹了Linux下Nginx負載均衡多個tomcat配置的方法步驟,小編覺得挺不錯的,現(xiàn)在分享給大家,也給大家做個參考。一起跟隨小編過來看看吧2019-04-04
Nginx配置Basic Auth登錄認證的實現(xiàn)方法
這篇文章主要介紹了Nginx配置Basic Auth登錄認證的實現(xiàn)方法,小編覺得挺不錯的,現(xiàn)在分享給大家,也給大家做個參考。一起跟隨小編過來看看吧2018-09-09
windows系統(tǒng)安裝配置nginx環(huán)境
這篇文章介紹了windows系統(tǒng)安裝配置nginx環(huán)境的方法,對大家的學習或者工作具有一定的參考學習價值,需要的朋友們下面隨著小編來一起學習學習吧2022-06-06

