将 VPN 流量转发到 Squid 代理

Question 1

我实际上已经设置好了，也花了我一段时间来设置......

如果您使用 OpenVPN，则可以使用我的 OpenVPN/squid 上行/下行脚本。您还需要设置 BIND 以通过 VPN：

#!/usr/bin/env bash

status="$1"
ip="$5"
configdir_squid="/etc/squid/proxyoff"
configdir_bind="/etc/named"

if [ "$status" = "up" ]; then
        echo "tcp_outgoing_address $ip" > "$configdir_squid/tcp_outgoing_address.conf"
        echo "http_access allow localnet" > "$configdir_squid/http_access.conf"
        echo "query-source address $ip;" > "$configdir_bind/query_source.conf"
else
        echo "" > "$configdir_squid/tcp_outgoing_address.conf"
        echo "http_access deny localnet" > "$configdir_squid/http_access.conf"
        echo "" > "$configdir_bind/query_source.conf"
fi

systemctl restart named squid transmission-daemon

然后在 /etc/squid 中创建一个名为 proxyoff 的文件夹。然后在 OpenVPN 中设置脚本：

up "/opt/scripts/openvpn_tun1.sh up"
down "/opt/scripts/openvpn_tun1.sh down"

您将需要 IPtables 规则来控制来自 squid 和 bind 的通信（您需要为您的 VPN 提供商设置静态路由）：

-A vyprvpn-only -o lo -j ACCEPT
-A vyprvpn-only -d 192.168.1.0/24,10.8.0.0/24 ! -o tun1 -j ACCEPT
-A vyprvpn-only ! -o tun1 -j REJECT --reject-with icmp-net-unreachable
-A OUTPUT -m owner --gid-owner transmission -j vyprvpn-only
-A OUTPUT -m owner --gid-owner squid -j vyprvpn-only
-A OUTPUT -m owner --gid-owner named -j vyprvpn-only

在 squid 中的 http_access 规则的底部某处添加，但在 http_access 拒绝所有内容之前：

include /etc/squid/proxyoff/http_access.conf

另外，在 http_port 之后或 http_access 规则之后添加：

include /etc/squid/proxyoff/tcp_outgoing_address.conf

设置您的名称服务器，使其反映将通过 VPN 的 LAN 上的 DNS 服务器或将通过 iptables 规则的 DNS 的 Internet DNS 服务器：

dns_v4_first on
dns_nameservers 8.8.8.8 8.8.4.4

例如，我的 dns_nameservers 是 3 个 Windows DNS 服务器，它们处理 AD，然后将任何它们不知道的查询发送回与 VPN 在同一台服务器上运行的 BIND 服务器。

为squid中的localnet ACL添加网关故障或者重命名ACL以及脚本中的ACL：

deny_info ERR_GATEWAY_FAILURE localnet

然后只需设置代理自动配置：

function FindProxyForURL(url, host) {
    var proxy_on = "PROXY 192.168.1.20:3128; PROXY 192.168.1.21:3128";
    var proxy_off = "DIRECT";
    var network = "192.168.1.0";
    var subnet = "255.255.255.0";

    var proxy_bypass = new Array(
        "pyronexus.lan", "*.pyronexus.lan",
        "pyronexus.com", "*.pyronexus.com",
        "amazon.com", "*.amazon.com",
        "amazon.co.uk", "*.amazon.co.uk",
        "channel4.com", "*.channel4.com",
        "c4assets.com", "*.c4assets.com",
        "ipv6-test.com", "*.ipv6-test.com",
        // Banks
        "tsb.co.uk", "*.tsb.co.uk",
        "bankofscotland.co.uk", "*.bankofscotland.co.uk",
        "barclays.co.uk", "*.barclays.co.uk",
        "halifax.co.uk", "*.halifax.co.uk",
        "rbs.co.uk", "*.rbs.co.uk",
        "natwest.com", "*.natwest.com"
    );

    var blockedsites = new Array(
        "trafficstars.com", "*.trafficstars.com",
        "trafficfactory.biz", "*.trafficfactory.biz"
    );

    // Blocked websites (block them in the proxy server configuration to prevent circumvention
    for (var i = 0; i < blockedsites.length; i++) {
        if (shExpMatch(host, blockedsites[i])) {
            return "proxy 127.0.0.1";
        }
    }

    // Below here evaluates the above.
    // Bypass proxy for local web servers in the same subnet as the client.
    if (isInNet(host, network, subnet)) {
        return proxy_off;
    }

    // Bypass proxy for those listed under proxy_bypass.
    for (var i = 0; i < proxy_bypass.length; i++) {
        if (shExpMatch(host, proxy_bypass[i])) {
            return proxy_off;
        }
    }

    // Everything else not caught by the above, should be checked to see if it is HTTP, HTTPS or FTP
    // before sending to a proxy server.
    if (shExpMatch(url, "http:*") ||
        shExpMatch(url, "https:*") ||
        shExpMatch(url, "ftp:*")) {
            return proxy_on;
    }

    // Finally, send all other requests direct.
    return proxy_off;
}

将其添加到选项下的 /etc/named.conf 中（将转发器添加到互联网 DNS 服务器但删除根提示）：

include "/etc/named/query_source.conf";

将 VPN 的 IP 添加到 /etc/hosts：

209.99.22.37    uk1.vyprvpn.com

并添加路线：

ip route add 209.99.22.37/32 via 192.168.1.1 dev eth0

您可以在以下网址查看我的其他代理指南https://pyronexus.com

Answer