一、網路環境

主機A ：192.168.0.11

主機B：66.0.0.6

主機C：4.2.2.2

主機A和B互通，B和C互通，A訪問C網路較慢或不通，可以通過stunnel+squid代理跳轉訪問。

二、squid 安裝配置

squid和stunnel可以在主機B上配置，也可在不同主機配置實現網路跳轉。這裡squid和stunnel server在主機B配置，stunnel client 在客戶端主機A配置

• 安裝 yum install squid

• 配置 vim /etc/squid/squid.conf，主要配置如下兩處

acl localnet src 66.0.0.6
 
/32  # 根據實際情況修改，新增允許 stunnel-client 的ip地址
http_port 3128  # squid監聽埠

啟動服務 service squid start

三、stunnel 配置

• 安裝yum -y install stunnel openssl openssl-devel

1、stunnel server 配置

• 生成證書認證檔案

  openssl req -new -x509 -days 365 -nodes -out stunnel.pem -keyout stunnel.pem
  openssl gendh 512>> stunnel.pem
   
     #不是必須的

• 配置

vim  /etc/stunnel/stunnel_ser.conf   (;;; 註釋形式)

cert = /etc/stunnel/stunnel.pem   ;;;# 認證檔案
CAfile = /etc/stunnel/stunnel.pem  ;;;# 認證檔案
socket = l:TCP_NODELAY=1
socket = r:TCP_NODELAY=1
;;;chroot = /var/run/stunnel
pid = /tmp/stunnel_server.pid
verify = 3
;;; CApath = certs
;;; CRLpath = crls
;;; CRLfile = crls.pem
setuid
 
 = web
setgid = web
;;; client=yes
compression = zlib
;;; taskbar = no
delay = no
;;; failover = rr
;;; failover = prio
;;; sslVersion = TLSv1
;;; fips=no
sslVersion = all
;;; options = NO_SSLv2
;;; options = NO_SSLv3
debug = 7
syslog = no
output = /var/logs/stunnel_server.log
client = no  ;;;# 服務端
[sproxy]
accept = 44550  ;;;# 監聽埠
connect = 66.0.0.6:3128  ;;;# squid服務連線埠

• 啟動服務 stunnel /etc/stunnel/stunnel_ser.conf

2、stunnel client 安裝配置

yum -y install stunnel openssl openssl-devel
vim  /etc/stunnel/stunnel_cli.conf 

cert = /usr/local/etc/stunnel/stunnel_cli.pem  ;;;#步驟1中生成的stunnel.pem，改了名字而已
CAfile = /usr/local/etc/stunnel/stunnel_cli.pem
socket = l:TCP_NODELAY=1
socket = r:TCP_NODELAY=1

;;;chroot = /var/run/stunnel
pid = /tmp/stunnel.pid
verify = 3

;;; CApath = certs
;;; CRLpath = crls
;;; CRLfile = crls.pem

setuid = web
setgid = web

;;; client=yes
compression = zlib
;;; taskbar = no
delay = no
;;; failover = rr
;;; failover = prio
;;; fips=no
sslVersion = all
;;; options = NO_SSLv2
;;; options = NO_SSLv3

debug = 7
syslog = no
output = /data/logs/stunnel.log
client = yes   ;;;# 客戶端

[sproxy]
accept = 0.0.0.0:44550  ;;;# 監聽地址
connect = 66.0.0.6:44550  ;;;# stunnel 服務端地址

四、測試及錯誤解決

• 測試：配置代理伺服器地址：192.168.0.11，埠44550後，可以訪問主機C
• 錯誤解決：

stunnel 報錯:CERT: Verification error: certificate has expired

stunnel客戶端連不上服務端，連上幾秒就斷開了，具體報錯資訊如下

# stunnel 客戶端：
2017.09.25 10:16:19 LOG7[13955:140155381970688]: Starting certificate verification: depth=0, /C=CN/L=Default City/O=Default Company Ltd
2017.09.25 10:16:19 LOG4[13955:140155381970688]: CERT: Verification error: certificate has expired
2017.09.25 10:16:19 LOG4[13955:140155381970688]: Certificate check failed: depth=0, /C=CN/L=Default City/O=Default Company Ltd
2017.09.25 10:16:19 LOG7[13955:140155381970688]: SSL alert (write): fatal: certificate expired
2017.09.25 10:16:19 LOG3[13955:140155381970688]: SSL_connect: 14090086: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed
2017.09.25 10:16:19 LOG5[13955:140155381970688]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket
2017.09.25 10:16:19 LOG7[13955:140155381970688]: Remote socket (FD=13) closed
2017.09.25 10:16:19 LOG7[13955:140155381970688]: Local socket (FD=3) closed
2017.09.25 10:16:19 LOG7[13955:140155381970688]: Service [sproxy] finished (0 left)

# stunnel 服務端：
2017.09.25 10:13:24 LOG7[15546:140344803059456]: SSL state (accept): SSLv3 flush data
2017.09.25 10:13:24 LOG7[15546:140344803059456]: SSL alert (read): fatal: certificate expired
2017.09.25 10:13:24 LOG3[15546:140344803059456]: SSL_accept: 14094415: error:14094415:SSL routines:SSL3_READ_BYTES:sslv3 alert certificate expired
2017.09.25 10:13:24 LOG5[15546:140344803059456]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket
2017.09.25 10:13:24 LOG7[15546:140344803059456]: sproxy finished (0 left)

需要安裝上面的證書生成命令，重新生成證書後手動更新

openssl req -new -x509 -days 365 -nodes -out stunnel.pem -keyout stunnel.pem