튜토리얼 Opnsense - 아웃바운드 프록시 구성 [ 단계별 단계]

OPNsense 아웃바운드 프록시 구성을 수행하는 방법을 알고 싶습니까? 이 튜토리얼에서는, 우리는 인터넷에 액세스하고 opnsense 패키지와 플러그인을 다운로드하는 프록시 뒤에 우리의 OPNsense 서버를 구성하려고합니다.

• OPNsense 19.7

장비 목록

다음 섹션에서는 이 자습서를 만드는 데 사용되는 장비 목록을 제공합니다.

아마존 어소시에이트로서, 나는 적격 구매에서 적립.

OPNsense - 관련 자습서:

이 페이지에서는 OPNsense와 관련된 자습서 목록에 빠르게 액세스할 수 있습니다.

OPNsense - 아웃바운드 프록시 구성

OPNSense 콘솔 메뉴에서 셸 세션을 시작하려면 옵션 번호 8을 선택합니다.

다음 명령을 사용하여 프록시 구성을 설정합니다.

Copy to Clipboard

이 예제에서는 3128 포트를 사용하여 프록시 서버 192.168.10.10을 설정합니다.

이 예제에서는 사용자 이름 bruno 및 암호 kamisama123을 사용하여 프록시 액세스를 인증합니다.

다음 명령을 사용하여 HTTP 프록시 구성을 테스트합니다.

Copy to Clipboard

다음은 명령 출력입니다.

Copy to Clipboard

* Uses proxy env variable http_proxy == 'http://192.168.10.10:3128'
*   Trying 192.168.10.10:3128...
* TCP_NODELAY set
* Connected to 192.168.10.10 (192.168.10.10) port 3128 (#0)
> HEAD http://techexpert.tips/ HTTP/1.1
> Host: techexpert.tips
> User-Agent: curl/7.65.1
> Accept: */*
> Proxy-Connection: Keep-Alive
>
* Mark bundle as not supporting multiuse
< HTTP/1.1 301 Moved Permanently
HTTP/1.1 301 Moved Permanently
< Date: Fri, 03 Jan 2020 14:29:14 GMT
Date: Fri, 03 Jan 2020 14:29:14 GMT
< Server: Apache/2.4.29 (Ubuntu)
Server: Apache/2.4.29 (Ubuntu)
< Location: https://techexpert.tips/
Location: https://techexpert.tips/
< Cache-Control: max-age=86400
Cache-Control: max-age=86400
< Expires: Sat, 04 Jan 2020 14:29:14 GMT
Expires: Sat, 04 Jan 2020 14:29:14 GMT
< Content-Type: text/html; charset=iso-8859-1
Content-Type: text/html; charset=iso-8859-1
< Proxy-Connection: Keep-Alive
Proxy-Connection: Keep-Alive
< Connection: Keep-Alive
Connection: Keep-Alive

<
* Connection #0 to host 192.168.10.10 left intact

다음 명령을 사용하여 HTTPS 프록시 구성을 테스트합니다.

Copy to Clipboard

다음은 명령 출력입니다.

Copy to Clipboard

* Uses proxy env variable https_proxy == 'http://192.168.10.10:3128'
*   Trying 192.168.10.10:3128...
* TCP_NODELAY set
* Connected to 192.168.10.10 (192.168.10.10) port 3128 (#0)
* allocate connect buffer!
* Establish HTTP proxy tunnel to techexpert.tips:443
> CONNECT techexpert.tips:443 HTTP/1.1
> Host: techexpert.tips:443
> User-Agent: curl/7.65.1
> Proxy-Connection: Keep-Alive
>
< HTTP/1.1 200 Connection established
HTTP/1.1 200 Connection established
<

* Proxy replied 200 to CONNECT request
* CONNECT phase completed!
* ALPN, offering h2
* ALPN, offering http/1.1
* Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH
* successfully set certificate verify locations:
*   CAfile: /usr/local/share/certs/ca-root-nss.crt
  CApath: none
* TLSv1.2 (OUT), TLS header, Certificate Status (22):
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
* CONNECT phase completed!
* CONNECT phase completed!
* TLSv1.2 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.2 (OUT), TLS handshake, Finished (20):
* TLSv1.2 (IN), TLS change cipher, Change cipher spec (1):
* TLSv1.2 (IN), TLS handshake, Finished (20):
* SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384
* ALPN, server accepted to use h2
* Server certificate:
*  subject: OU=Domain Control Validated; CN=techexpert.tips
*  start date: Oct  3 11:28:14 2019 GMT
*  expire date: Dec  2 22:46:29 2020 GMT
*  subjectAltName: host "techexpert.tips" matched cert's "techexpert.tips"
*  issuer: C=US; ST=Arizona; L=Scottsdale; O=GoDaddy.com, Inc.; OU=http://certs.godaddy.com/repository/; CN=Go Daddy Secure Certificate Authority - G2
*  SSL certificate verify ok.
* Using HTTP2, server supports multi-use
* Connection state changed (HTTP/2 confirmed)
* Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0
* Using Stream ID: 1 (easy handle 0x6fdae493000)
> HEAD / HTTP/2
> Host: techexpert.tips
> User-Agent: curl/7.65.1
> Accept: */*
>
* Connection state changed (MAX_CONCURRENT_STREAMS == 100)!
< HTTP/2 200
HTTP/2 200
< date: Fri, 03 Jan 2020 14:32:33 GMT
date: Fri, 03 Jan 2020 14:32:33 GMT
< server: Apache/2.4.29 (Ubuntu)
server: Apache/2.4.29 (Ubuntu)
< link: <https://techexpert.tips/wp-json/>; rel="https://api.w.org/", <https://techexpert.tips/>; rel=shortlink, <https://techexpert.tips/wp-json/>; rel="https://api.w.org/", <https://techexpert.tips/>; rel=shortlink
link: <https://techexpert.tips/wp-json/>; rel="https://api.w.org/", <https://techexpert.tips/>; rel=shortlink, <https://techexpert.tips/wp-json/>; rel="https://api.w.org/", <https://techexpert.tips/>; rel=shortlink
< expires: Fri, 03 Jan 2020 04:16:08 GMT
expires: Fri, 03 Jan 2020 04:16:08 GMT
< pragma: public
pragma: public
< cache-control: max-age=0, public
cache-control: max-age=0, public
< x-powered-by: W3 Total Cache/0.12.0
x-powered-by: W3 Total Cache/0.12.0
< last-modified: Fri, 03 Jan 2020 03:16:08 GMT
last-modified: Fri, 03 Jan 2020 03:16:08 GMT
< etag: "7d3760e9ab1b403040af3cdbb4c19dbc"
etag: "7d3760e9ab1b403040af3cdbb4c19dbc"
< access-control-allow-origin: *
access-control-allow-origin: *
< content-type: text/html; charset=UTF-8
content-type: text/html; charset=UTF-8

<
* Connection #0 to host 192.168.10.10 left intact

pkg.conf를 편집합니다.

Copy to Clipboard

파일 끝에 다음 줄을 추가합니다.

Copy to Clipboard

OPNsense 방화벽을 재부팅합니다.

Copy to Clipboard

다음 명령을 사용하여 프록시 구성을 설정합니다.

Copy to Clipboard

PKG 프록시 구성을 확인합니다.

Copy to Clipboard

다음은 명령 출력입니다.

Copy to Clipboard

다음 명령을 사용하여 패키지 목록을 다운로드합니다.

Copy to Clipboard

다음은 명령 출력입니다.

Copy to Clipboard

DBG(1)[97884]> pkg initialized
Updating OPNsense repository catalogue...
DBG(1)[97884]> PkgRepo: verifying update for OPNsense
pkg: Repository OPNsense load error: access repo file(https://d1ny9casiyy5u5.cloudfront.net/var/db/pkg/repo-OPNsense.sqlite) failed: No such file or directory
DBG(1)[97884]> PkgRepo: need forced update of OPNsense
DBG(1)[97884]> Pkgrepo, begin update of 'https://d1ny9casiyy5u5.cloudfront.net/var/db/pkg/repo-OPNsense.sqlite'
DBG(1)[97884]> Fetch: fetching from: https://pkg.opnsense.org/FreeBSD:11:amd64/19.7/latest/meta.txz with opts "i"
Fetching meta.txz: 100%    1 KiB   1.5kB/s    00:01
DBG(1)[97884]> PkgRepo: extracting meta of repo OPNsense
DBG(1)[6392]> PkgRepo: extracting signature of repo in a sandbox
DBG(1)[97884]> Fetch: fetching from: https://pkg.opnsense.org/FreeBSD:11:amd64/19.7/latest/packagesite.txz with opts "i"
Fetching packagesite.txz: 100%  180 KiB 183.9kB/s    00:01
DBG(1)[97884]> PkgRepo: extracting packagesite.yaml of repo OPNsense
DBG(1)[32989]> PkgRepo: extracting signature of repo in a sandbox
DBG(1)[97884]> Pkgrepo, reading new packagesite.yaml for 'https://d1ny9casiyy5u5.cloudfront.net/var/db/pkg/repo-OPNsense.sqlite'
Processing entries: 100%
OPNsense repository update completed. 707 packages processed.
All repositories are up to date.

축! OPNsense 서버를 프록시 서버를 괴롭히는 작업을 하도록 구성했습니다.

Opnsense - 아웃바운드 프록시 구성

Opnsense - 아웃바운드 프록시 구성

장비 목록

OPNsense - 관련 자습서:

OPNsense - 아웃바운드 프록시 구성

Related Posts