Tutorial Opnsense - Configuración de proxy saliente [ Paso a paso ]

¿Desea aprender a realizar la configuración de proxy saliente de OPNsense? En este tutorial, vamos a configurar nuestro servidor OPNsense detrás de un proxy para acceder a Internet y descargar los paquetes opnsense y plugins.

• OPNsense 19.7

Lista de equipos

En la siguiente sección se presenta la lista de equipos utilizados para crear este tutorial.

Como asociado de Amazon, gano con compras calificadas.

OPNsense - Tutorial relacionado:

En esta página, ofrecemos acceso rápido a una lista de tutoriales relacionados con OPNsense.

OPNsense - Configuración de proxy saliente

En el menú de la consola OPNSense, seleccione la opción número 8 para iniciar una sesión de shell.

Utilice los siguientes comandos para establecer la configuración de proxy.

Copy to Clipboard

En nuestro ejemplo, establecemos el servidor proxy 192.168.10.10 utilizando el puerto 3128.

En nuestro ejemplo, autenticamos el acceso proxy usando el nombre de usuario bruno y la contraseña kamisama123.

Utilice los siguientes comandos para probar la configuración del proxy HTTP.

Copy to Clipboard

Aquí está la salida del comando.

Copy to Clipboard

* Uses proxy env variable http_proxy == 'http://192.168.10.10:3128'
*   Trying 192.168.10.10:3128...
* TCP_NODELAY set
* Connected to 192.168.10.10 (192.168.10.10) port 3128 (#0)
> HEAD http://techexpert.tips/ HTTP/1.1
> Host: techexpert.tips
> User-Agent: curl/7.65.1
> Accept: */*
> Proxy-Connection: Keep-Alive
>
* Mark bundle as not supporting multiuse
< HTTP/1.1 301 Moved Permanently
HTTP/1.1 301 Moved Permanently
< Date: Fri, 03 Jan 2020 14:29:14 GMT
Date: Fri, 03 Jan 2020 14:29:14 GMT
< Server: Apache/2.4.29 (Ubuntu)
Server: Apache/2.4.29 (Ubuntu)
< Location: https://techexpert.tips/
Location: https://techexpert.tips/
< Cache-Control: max-age=86400
Cache-Control: max-age=86400
< Expires: Sat, 04 Jan 2020 14:29:14 GMT
Expires: Sat, 04 Jan 2020 14:29:14 GMT
< Content-Type: text/html; charset=iso-8859-1
Content-Type: text/html; charset=iso-8859-1
< Proxy-Connection: Keep-Alive
Proxy-Connection: Keep-Alive
< Connection: Keep-Alive
Connection: Keep-Alive

<
* Connection #0 to host 192.168.10.10 left intact

Utilice los siguientes comandos para probar la configuración del proxy HTTPS.

Copy to Clipboard

Aquí está la salida del comando.

Copy to Clipboard

* Uses proxy env variable https_proxy == 'http://192.168.10.10:3128'
*   Trying 192.168.10.10:3128...
* TCP_NODELAY set
* Connected to 192.168.10.10 (192.168.10.10) port 3128 (#0)
* allocate connect buffer!
* Establish HTTP proxy tunnel to techexpert.tips:443
> CONNECT techexpert.tips:443 HTTP/1.1
> Host: techexpert.tips:443
> User-Agent: curl/7.65.1
> Proxy-Connection: Keep-Alive
>
< HTTP/1.1 200 Connection established
HTTP/1.1 200 Connection established
<

* Proxy replied 200 to CONNECT request
* CONNECT phase completed!
* ALPN, offering h2
* ALPN, offering http/1.1
* Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH
* successfully set certificate verify locations:
*   CAfile: /usr/local/share/certs/ca-root-nss.crt
  CApath: none
* TLSv1.2 (OUT), TLS header, Certificate Status (22):
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
* CONNECT phase completed!
* CONNECT phase completed!
* TLSv1.2 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.2 (OUT), TLS handshake, Finished (20):
* TLSv1.2 (IN), TLS change cipher, Change cipher spec (1):
* TLSv1.2 (IN), TLS handshake, Finished (20):
* SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384
* ALPN, server accepted to use h2
* Server certificate:
*  subject: OU=Domain Control Validated; CN=techexpert.tips
*  start date: Oct  3 11:28:14 2019 GMT
*  expire date: Dec  2 22:46:29 2020 GMT
*  subjectAltName: host "techexpert.tips" matched cert's "techexpert.tips"
*  issuer: C=US; ST=Arizona; L=Scottsdale; O=GoDaddy.com, Inc.; OU=http://certs.godaddy.com/repository/; CN=Go Daddy Secure Certificate Authority - G2
*  SSL certificate verify ok.
* Using HTTP2, server supports multi-use
* Connection state changed (HTTP/2 confirmed)
* Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0
* Using Stream ID: 1 (easy handle 0x6fdae493000)
> HEAD / HTTP/2
> Host: techexpert.tips
> User-Agent: curl/7.65.1
> Accept: */*
>
* Connection state changed (MAX_CONCURRENT_STREAMS == 100)!
< HTTP/2 200
HTTP/2 200
< date: Fri, 03 Jan 2020 14:32:33 GMT
date: Fri, 03 Jan 2020 14:32:33 GMT
< server: Apache/2.4.29 (Ubuntu)
server: Apache/2.4.29 (Ubuntu)
< link: <https://techexpert.tips/wp-json/>; rel="https://api.w.org/", <https://techexpert.tips/>; rel=shortlink, <https://techexpert.tips/wp-json/>; rel="https://api.w.org/", <https://techexpert.tips/>; rel=shortlink
link: <https://techexpert.tips/wp-json/>; rel="https://api.w.org/", <https://techexpert.tips/>; rel=shortlink, <https://techexpert.tips/wp-json/>; rel="https://api.w.org/", <https://techexpert.tips/>; rel=shortlink
< expires: Fri, 03 Jan 2020 04:16:08 GMT
expires: Fri, 03 Jan 2020 04:16:08 GMT
< pragma: public
pragma: public
< cache-control: max-age=0, public
cache-control: max-age=0, public
< x-powered-by: W3 Total Cache/0.12.0
x-powered-by: W3 Total Cache/0.12.0
< last-modified: Fri, 03 Jan 2020 03:16:08 GMT
last-modified: Fri, 03 Jan 2020 03:16:08 GMT
< etag: "7d3760e9ab1b403040af3cdbb4c19dbc"
etag: "7d3760e9ab1b403040af3cdbb4c19dbc"
< access-control-allow-origin: *
access-control-allow-origin: *
< content-type: text/html; charset=UTF-8
content-type: text/html; charset=UTF-8

<
* Connection #0 to host 192.168.10.10 left intact

Edite el archivo pkg.conf.

Copy to Clipboard

Agregue las siguientes líneas al final del archivo.

Copy to Clipboard

Reinicie el firewall OPNsense.

Copy to Clipboard

Utilice los siguientes comandos para establecer la configuración de proxy.

Copy to Clipboard

Verifique su configuración del proxy PKG.

Copy to Clipboard

Aquí está la salida del comando.

Copy to Clipboard

Utilice el siguiente comando para descargar la lista de paquetes

Copy to Clipboard

Aquí está la salida del comando.

Copy to Clipboard

DBG(1)[97884]> pkg initialized
Updating OPNsense repository catalogue...
DBG(1)[97884]> PkgRepo: verifying update for OPNsense
pkg: Repository OPNsense load error: access repo file(https://d1ny9casiyy5u5.cloudfront.net/var/db/pkg/repo-OPNsense.sqlite) failed: No such file or directory
DBG(1)[97884]> PkgRepo: need forced update of OPNsense
DBG(1)[97884]> Pkgrepo, begin update of 'https://d1ny9casiyy5u5.cloudfront.net/var/db/pkg/repo-OPNsense.sqlite'
DBG(1)[97884]> Fetch: fetching from: https://pkg.opnsense.org/FreeBSD:11:amd64/19.7/latest/meta.txz with opts "i"
Fetching meta.txz: 100%    1 KiB   1.5kB/s    00:01
DBG(1)[97884]> PkgRepo: extracting meta of repo OPNsense
DBG(1)[6392]> PkgRepo: extracting signature of repo in a sandbox
DBG(1)[97884]> Fetch: fetching from: https://pkg.opnsense.org/FreeBSD:11:amd64/19.7/latest/packagesite.txz with opts "i"
Fetching packagesite.txz: 100%  180 KiB 183.9kB/s    00:01
DBG(1)[97884]> PkgRepo: extracting packagesite.yaml of repo OPNsense
DBG(1)[32989]> PkgRepo: extracting signature of repo in a sandbox
DBG(1)[97884]> Pkgrepo, reading new packagesite.yaml for 'https://d1ny9casiyy5u5.cloudfront.net/var/db/pkg/repo-OPNsense.sqlite'
Processing entries: 100%
OPNsense repository update completed. 707 packages processed.
All repositories are up to date.

¡Felicitaciones! Ha configurado el servidor OPNsense para que funcione behing un servidor proxy.

Opnsense - Configuración de proxy saliente

Opnsense - Configuración de proxy saliente

Lista de equipos

OPNsense - Tutorial relacionado:

OPNsense - Configuración de proxy saliente

Related Posts