一、准备环境

  1. 基础配置：CentOS-9-Stream

  2. 添加虚拟内存（流量转发机器只有 1G内存，执行 dnf install tree 就会卡住）

1
2
3
4
5
6
7
fallocate -l 2G /swapfile
chmod 600 /swapfile
mkswap /swapfile
swapon /swapfile

# 开机自动挂载
echo '/swapfile swap swap defaults 0 0' >> /etc/fstab

二、安装

  1. 添加nginx官方仓库，安装
1
2
3
4
5
6
7
8
9
10
11
cat > /etc/yum.repos.d/nginx.repo << 'EOF'
[nginx-stable]
name=nginx stable repo
baseurl=https://nginx.org/packages/centos/9/$basearch/
gpgcheck=1
enabled=1
gpgkey=https://nginx.org/keys/nginx_signing.key
module_hotfixes=true
EOF

dnf install -y nginx
  1. 确认携带的模块
1
nginx -V 2>&1 | grep -o with-stream

三、配置

  1. 创建四层转发的配置文件夹
1
2
3
mkdir -pv /etc/nginx/{stream.d,logs}
mv /etc/nginx/nginx.conf /etc/nginx/nginx.conf.bak
mv /etc/nginx/conf.d/default.conf /etc/nginx/conf.d/default.conf.bak
  1. 配置主配置文件
1
vim /etc/nginx/nginx.conf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
user  nginx;
worker_processes  1;  # 1c机器,1个worker足够

error_log  logs/error.log warn;
pid        /run/nginx.pid;

events {
    worker_connections  1024;
}

# ===== 4层转发(TCP/UDP) =====
stream {
    log_format basic '$remote_addr [$time_local] '
                      '$protocol $status $bytes_sent $bytes_received '
                      '$session_time';

    access_log logs/stream-access.log basic;

    include stream.d/*.conf;
}

# ===== 7层反代(HTTP/HTTPS) =====
http {
    include       mime.types;
    default_type  application/octet-stream;

    log_format main '$remote_addr - $remote_user [$time_local] "$request" '
                     '$status $body_bytes_sent "$http_referer" '
                     '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  logs/access.log  main;

    sendfile        on;
    tcp_nopush      on;
    tcp_nodelay     on;
    keepalive_timeout  65;
    gzip  on;

    include http.d/*.conf;
}
  1. 配置4层转发
1
vim /etc/nginx/stream.d/forward.conf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
# 转发到甲骨文机器,把下面的IP换成你自己的
upstream oracle_http {
    server 1.2.3.4:80;
}

upstream oracle_https {
    server 1.2.3.4:443;
}

server {
    listen 80;
    proxy_pass oracle_http;
    proxy_timeout 10s;
    proxy_connect_timeout 5s;
}

server {
    listen 443;
    proxy_pass oracle_https;
    proxy_timeout 10s;
    proxy_connect_timeout 5s;
}
  1. 验证配置、启动、验证端口
1
2
3
nginx -t
systemctl enable --now nginx
ss -untlp

四、透传ip

  1. stream 入口开启代理协议
1
2
3
4
5
6
7
8
9
10
11
upstream oracle_reality {
    server 1.2.3.4:8443;
}

server {
    listen 80;
    proxy_protocol on; # 开启代理协议
    proxy_pass oracle_http;
    proxy_timeout 10s;
    proxy_connect_timeout 5s;
}
  1. 后端修改
1
2
3
4
5
6
7
8
server {
    listen 80 proxy_protocol ; 
    listen [::]:80 proxy_protocol ; 
    listen 443 proxy_protocol ssl ; 
    listen [::]:443 proxy_protocol ssl ;
    set_real_ip_from 1.1.1.1;  # HK出口IP
    real_ip_header proxy_protocol;
}

五、iptables 透传ip

放弃，同一个局域网内才能透传。还需要搞VPN，放弃。

hk

1
2
3
4
5
6
7
8
9
10
11
12
# 开启 IP 转发
echo 'net.ipv4.ip_forward = 1' >> /etc/sysctl.conf
sysctl -p

# 替换你的三个端口转发
SG_IP="140.245.44.88"

iptables -t nat -A PREROUTING -p tcp --dport 80   -j DNAT --to-destination $SG_IP:80
iptables -t nat -A PREROUTING -p tcp --dport 443  -j DNAT --to-destination $SG_IP:443
iptables -t nat -A PREROUTING -p tcp --dport 6443 -j DNAT --to-destination $SG_IP:8443

iptables -t nat -A POSTROUTING -d $SG_IP -j MASQUERADE

sg

1
ip route add default via <HK_IP> dev eth0

清除规则

1
2
3
4
5
6
7
8
# 清除 nat 表规则
iptables -t nat -F

# 保存（清空状态持久化）
iptables-save > /etc/sysconfig/iptables

# 验证
iptables -t nat -L -n -v

六、优化 Oracle 网络

参考

  1. 查看网卡
1
ip link show
  1. 查看 BBR 版本
1
2
uname -r
sysctl net.ipv4.tcp_congestion_control
  1. 修改 MTU
1
2
3
4
5
6
# 临时生效（立即测试用）
ip link set eth0 mtu 1500

# 永久生效，连接名有空格要加引号
nmcli connection modify "Wired Connection" 802-3-ethernet.mtu 1500
nmcli connection up "Wired Connection"
  1. sysctl 参数
1
2
3
4
5
6
7
8
9
10
cat > /etc/sysctl.d/99-oci-tune.conf << 'EOF'
net.ipv4.tcp_congestion_control = bbr
net.core.default_qdisc = fq
net.ipv4.tcp_wmem = 4096 16384 12582912
net.ipv4.tcp_rmem = 4096 131072 33554432
net.ipv4.tcp_limit_output_bytes = 4194304
net.ipv4.tcp_slow_start_after_idle = 0
EOF

sysctl --system
  1. fq qdisc
1
2
3
4
5
6
# 先删已有的，再加
tc qdisc del dev eth0 root 2>/dev/null
tc qdisc add dev eth0 root fq quantum 18028 initial_quantum 90140

# 验证
tc qdisc show dev eth0

​ 持久化

1
2
3
4
5
6
7
8
9
10
11
cat > /etc/NetworkManager/dispatcher.d/99-fq-tune << 'EOF'
#!/bin/bash
IFACE=$1
ACTION=$2
if [ "$ACTION" = "up" ] && [ "$IFACE" = "eth0" ]; then
    tc qdisc del dev $IFACE root 2>/dev/null
    tc qdisc add dev $IFACE root fq quantum 18028 initial_quantum 90140
fi
EOF

chmod +x /etc/NetworkManager/dispatcher.d/99-fq-tune
  1. 验证
1
2
3
4
ip link show eth0 | grep mtu
sysctl net.ipv4.tcp_congestion_control
sysctl net.core.default_qdisc
tc qdisc show dev eth0