☰

Strongswan 私网下配置代理 Squid

tag-icon • tag-icon networking vpn proxy squid strongswan
Strongswan 私网下配置代理 Squid

我无法连接到代理服务器（乌贼）从我的电脑（Windows 10) 通过 VPN (StrongSwan，IKEv2）在我的 VPS 上（CentOS 8）

我不知道自己在做什么，所以请耐心等待！

  1. 防火墙-cmd中的端口已打开，防火墙重新启动

  2. 我的电脑已连接到 VPN，并具有 10.20.30.1 虚拟 IP：strongswan 状态

  3. 我已经创建了这条路线：ip 路由 220

如果我尝试像这样连接，则会失败： 卷曲

如果我尝试连接公共 IP，它就可以工作（当然，由于 squid 规则，它不允许我这样做）

请告诉我如何使用私有 IP 来实现这一点？我遗漏了什么？（除了清楚地了解这一切是如何运作的）

/etc/squid/squid.conf：

# Example rule allowing access from your local networks.
# Adapt to list your (internal) IP networks from where browsing
# should be allowed

acl SSL_ports port 443
acl Safe_ports port 80          # http
acl Safe_ports port 21          # ftp
acl Safe_ports port 443         # https
acl Safe_ports port 70          # gopher
acl Safe_ports port 210         # wais
acl Safe_ports port 1025-65535  # unregistered ports
acl Safe_ports port 280         # http-mgmt
acl Safe_ports port 488         # gss-http
acl Safe_ports port 591         # filemaker
acl Safe_ports port 777         # multiling http
acl CONNECT method CONNECT

#
# Recommended minimum Access Permission configuration:
#
# Deny requests to certain unsafe ports
http_access deny !Safe_ports

# Deny CONNECT to other than secure SSL ports
http_access deny CONNECT !SSL_ports

# Only allow cachemgr access from localhost
http_access allow localhost manager
http_access deny manager

# We strongly recommend the following be uncommented to protect innocent
# web applications running on the proxy server who think the only
# one who can access services on "localhost" is a local user
#http_access deny to_localhost

#
# INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS
#

acl mynet src 10.20.30.0/32
acl mynet src 192.168.0.0/16

# Example rule allowing access from your local networks.
# Adapt localnet in the ACL section to list your (internal) IP networks
# from where browsing should be allowed
http_access allow mynet

# And finally deny all other access to this proxy
http_access deny all

# Squid normally listens to port 3128
http_port 13333

# Uncomment and adjust the following to add a disk cache directory.
#cache_dir ufs /var/spool/squid 100 16 256

# Leave coredumps in the first cache dir
coredump_dir /var/spool/squid

#
# Add any of your own refresh_pattern entries above these.
#
refresh_pattern ^ftp:           1440    20%     10080
refresh_pattern ^gopher:        1440    0%      1440
refresh_pattern -i (/cgi-bin/|\?) 0     0%      0
refresh_pattern .               0       20%     4320

如果您对我正在尝试做的事情感兴趣：通过 VPN 从我的浏览器传输互联网流量，同时保持其余流量畅通。我稍后必须弄清楚 DNS 调用的路由。

相关内容