RAPANI-ID : MENERIMA JASA SETTING MIKROTIK - JASA SETTING PROXY - JASA INSTALASI DAN PEMBUATAN WARNET GAME ONLINE TELP 082170824476 (WA)
Panduan Install Squid Multiple instances dan SMP Scalability
Multiple instances dan SMP Scalability adalah suatu metode menjalankan prosess squid dengan Multicore/Multi CPU.
Untuk memeriksa berapa jumlah prosess squid yang sedang berjalan dapat di periksa dengan perintah top, atau netstat –plant.
Menjalankan multiple instances squid dalam mesin linux tidaklah serumit yang dibayangkan, jika kita ikuti sesuai petunjuk sangat mudah sekali.
Sebenarnya pembahasan ini sudah pernah di bahas om Hikmah Teknologi di group Facebook Forum Mikrotik Squid Indonesia pada tanggal 4 Februari 2015, dengan topik squid3.5.x Rock Store Large Files + support CPU SmpScale.
Namun disini saya akan coba kembali sedikit berbagi mulai dari install squid sampai berjalan dengan Squid multiple instances dan SMP scalability dan pemisahan core antara http dan https atau dikenal dengan Squid MultiCpuSystem.
Baiklah saya tidak bisa cerita panjang lebar dan kurang bisa ngarang cerita hehehee. , langsung saja kita mulai.
yang perlu kita siapkan adalah :
- sudah terinstall linux untuk dipasang squid dengan 2 hdd / 2 buah direktori cache
- Prosessor / CPU yang digunakan harus multicore
- Proxy yang di install sudah tekoneksi dengan internet.
- Periapakan Winscp dan Putty untuk meremote proxy.
- Biasakan baca doa sebelum memulai bekerja .
Kita lanjut ke tahap berikutnya , login ke proxy menggunakan putty atau sejenis menggunakan user root
Install Dependency berikut :
|
1 2 3 |
echo Y | apt-get update echo Y | apt-get install openssl libssl-dev libnetfilter-conntrack3 libltdl7 devscripts build-essential fakeroot libcppunit-dev libsasl2-dev libfile-readbackwards-perl echo Y | apt-get install cdbs ccze libcap2 libcap-dev libcap2-dev acpid |
Untuk iptable copy paste di Putty/ console linux, jangan lupa ganti ip 10.10.10.10 sesuai dengan ip proxy anda.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 |
cat <<EOF >>/etc/rc.local #!/bin/sh -e iptables -t mangle -F iptables -t mangle -X iptables -t mangle -N DIVERT iptables -t mangle -A DIVERT -j MARK --set-mark 1 iptables -t mangle -A DIVERT -j ACCEPT iptables -t mangle -A INPUT -j ACCEPT iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT iptables -t mangle -A PREROUTING ! -d 10.10.10.10/32 -p tcp --dport 80 -j TPROXY --tproxy-mark 0x1/0x1 --on-port 3129 iptables -t mangle -A PREROUTING ! -d 10.10.10.10/32 -p tcp --dport 443 -j TPROXY --tproxy-mark 0x1/0x1 --on-port 3127 /sbin/ip rule add fwmark 1 lookup 100 /sbin/ip route add local 0.0.0.0/0 dev lo table 100 echo 0 > /proc/sys/net/ipv4/conf/lo/rp_filter echo 1 > /proc/sys/net/ipv4/ip_forward squid -f /etc/squid/squid.conf -d 1 -N squid -f /etc/squid/squid2.conf -d 1 -N exit 0 EOF |
Install squid cache :
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 |
wget https://rapani-id.com/proxy/proxy-id.tar.gz && tar xzvf proxy-id.tar.gz && cd proxy-id ./configure --prefix=/usr \ --bindir=/usr/bin \ --sbindir=/usr/sbin \ --libexecdir=/usr/lib/squid \ --sysconfdir=/etc/squid \ --localstatedir=/var/spool/squid \ --libdir=/usr/lib \ --includedir=/usr/include \ --datadir=/usr/share/squid \ --enable-default-err-language=English \ --enable-auto-locale \ --infodir=/usr/share/info \ --mandir=/usr/share/man \ --with-logdir=/var/log/squid \ --enable-linux-netfilter \ --disable-dependency-tracking \ --enable-storeio=aufs,rock \ --enable-removal-policies=lru,heap \ --disable-wccp \ --enable-wccpv2 \ --enable-kill-parent-hack \ --enable-cache-digests \ --enable-follow-x-forwarded-for \ --enable-x-accelerator-vary \ --enable-zph-qos \ --enable-snmp \ --enable-underscores \ --with-default-user=proxy \ --with-large-files \ --enable-large-cache-files \ --enable-err-languages=English \ --enable-ltdl-convenience \ --with-openssl \ --disable-auth \ --disable-ipv6 \ --disable-translation \ --with-pthreads \ --with-filedescriptors=65536 make make install |
Buat file Log dan file pid
|
1 2 3 4 5 6 7 8 9 |
touch /var/log/squid/cache.log touch /var/log/squid/access.log chown -R proxy:proxy /var/log/squid/ chown -R proxy:proxy /var/log/squid/cache.log chown -R proxy:proxy /var/log/squid/access.log touch /etc/squid/https.pid chmod 777 /etc/squid/https.pid touch /etc/squid/http.pid chmod 777 /etc/squid/http.pid |
Rubah permition direktori cache menjadi 777 agar bisa dibaca tulis oleh squid
|
1 2 3 4 |
chown -R proxy:proxy /hdd1 chmod 777 /hdd1 chown -R proxy:proxy /hdd2 chmod 777 /hdd2 |
Buat device shm
|
1 2 |
echo "shm /dev/shm tmpfs nodev,nosuid,noexec 0 0" >> /etc/fstab mount shm |
Masukkan kedalam sysctl
|
1 2 |
echo "net.local.dgram.recvspace = 262144" > /etc/sysctl.conf echo "net.local.dgram.maxdgram = 16384" > /etc/sysctl.conf |
Download CA dan startup Squid
|
1 2 3 4 5 |
cd /etc/squid/ wget https://rapani-id.com/squid/ssl_cert.tar.gz && tar xzvf ssl_cert.tar.gz chmod 777 /etc/squid/ssl_cert/ cd /etc/init.d/ && wget https://rapani-id.com/proxy/debian/squid chmod 777 /etc/init.d/squid |
Buat file config squid
|
1 2 3 4 5 |
mv /etc/squid/squid.conf /etc/squid/squid.conf.BAK touch /etc/squid/squid.conf touch /etc/squid/squid2.conf touch /etc/squid/top.conf touch /etc/squid/bottom.conf |
Copy file squid.conf , squid2.conf, top.conf, bottom.conf kedalam direktori /etc/squid menggunakan Winscp atau Filezilla.
file squid.conf isi dengan script dibawah ini :
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 |
# ----------------------------------------------------------------- # SQUID MULTI CPU BY RAPANI LOEBIS # Facebook : https://www.facebook.com/rapani.loebis # Website : www.rapani-id.com || https://rapani-id.com # Mobile : 082170824476 #------------------------------------------------------------------- include /etc/squid/top.conf #------------------------------------------------------------------- # NETWORK OPTIONS https_port 3127 tproxy ssl-bump generate-host-certificates=on cert=/etc/squid/ssl_cert/myCA.pem #------------------------------------------------------------------- # TAG: ssl_bump acl sni ssl::server_name mail.google.com ssl_bump splice localhost acl step1 at_step SslBump1 acl step2 at_step SslBump2 acl step3 at_step SslBump3 ssl_bump peek step1 all ssl_bump splice step2 sni ssl_bump bump all sslproxy_cert_error allow all sslproxy_flags DONT_VERIFY_PEER NO_DEFAULT_CA sslproxy_options NO_SSLv2 NO_SSLv3 SINGLE_DH_USE #---------------------------- pid_filename /etc/squid/https.pid visible_hostname squid_https unique_hostname squid_https include /etc/squid/bottom.conf |
file squid2.conf isi dengan script dibawah ini :
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 |
# ----------------------------------------------------------------- # SQUID MULTI CPU BY RAPANI LOEBIS # Facebook : https://www.facebook.com/rapani.loebis # Website : www.rapani-id.com || https://rapani-id.com # Mobile : 082170824476 #------------------------------------------------------------------- include /etc/squid/top.conf #------------------------------------------------------------------- # NETWORK OPTIONS http_port 3129 tproxy pid_filename /etc/squid/http.pid visible_hostname squid_http unique_hostname squid_http include /etc/squid/bottom.conf |
file top.conf isi dengan script dibawah ini :
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 |
# ----------------------------------------------------------------- # SQUID MULTI CPU BY RAPANI LOEBIS # Facebook : https://www.facebook.com/rapani.loebis # Website : www.rapani-id.com || https://rapani-id.com # Mobile : 082170824476 #------------------------------------------------------------------- acl RFC1918 src 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 #PORT ALLOWED acl SSL_ports port 443 acl Safe_ports port 80 81 88 182 21 443 70 210 1025-65535 280 488 591 777 #---------------------------- acl purge method PURGE acl CONNECT method CONNECT acl GET method GET acl HEAD method HEAD #------------------------------------------------------------------- #HTTP ACCESS http_access allow purge localhost http_access deny purge http_access deny !Safe_ports http_access deny CONNECT !SSL_ports http_access allow RFC1918 http_access allow localhost http_reply_access allow all icp_access allow all always_direct allow all http_access deny all #------------------------------------------------------------------- # MEMORY CACHE OPTIONS #---------------------------- cache_mem 512 MB maximum_object_size_in_memory 16 KB maximum_object_size 1073741824 bytes minimum_object_size 64 bytes memory_replacement_policy heap GDSF cache_replacement_policy heap LFUDA #---------------------------- cache_swap_low 95 cache_swap_high 99 #---------------------------- #CACHE DIR workers 2 cache_dir rock /hdd1 40000 min-size=0 max-size=65536 swap-timeout=300 max-swap-rate=200/sec cache_dir aufs /hdd2 40000 94 256 min-size=65536 max-size=4096000 # LOG access_log stdio:/var/log/squid/access.log GET logfile_rotate 1 strip_query_terms off http_port 3128 |
file bottom.conf isi dengan script dibawah ini :
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 |
max_stale 1 year #REFRESH PATTERN #------------------------------------------------------------------- refresh_pattern ^ftp: 1440 20% 10080 refresh_pattern ^gopher: 1440 0% 1440 refresh_pattern -i (/cgi-bin/|\?) 0 0% 0 refresh_pattern . 0 20% 4320 #------------------------------------------------------------------- snmp_port 3401 snmp_access allow all snmp_incoming_address 0.0.0.0 snmp_outgoing_address 0.0.0.0 quick_abort_min 0 KB quick_abort_max 0 KB quick_abort_pct 100 range_offset_limit 1 KB negative_ttl 1 seconds positive_dns_ttl 12 hours forward_timeout 2 minutes minimum_expiry_time 1 seconds read_ahead_gap 32 KB store_objects_per_bucket 50 client_db on #------------------------------------------------------------------- #TAG HEADER via off forwarded_for off reply_header_access Alternate-Protocol deny all reply_header_access Accept-Ranges deny all request_header_access X-Forwarded-For deny all request_header_access Server deny all request_header_access From deny all request_header_access Via deny all request_header_access Link deny all reply_header_access Strict-Transport-Security deny all reply_header_replace Strict-Transport-Security max-age=0 #---------------------------- # TAG ZPH qos_flows tos local-hit=0x20 #------------------------------------------------------------------- # ADMINISTRATIVE PARAMETERS shutdown_lifetime 12 seconds cache_effective_user proxy cache_effective_group proxy memory_pools off reload_into_ims on vary_ignore_expire on |
Buat direktori cache dan swap cache :
|
1 |
squid -z |
Perintah menjalankan squid
|
1 2 |
squid -f /etc/squid/squid.conf start squid -f /etc/squid/squid2.conf start |
Restart mesin proxy squid dengan perintah reboot.
Untuk menampilkan jumlah squid yang sedang berjalan di linux, jalankan perintah
|
1 |
top |
Jika sudah benar maka akan terlihat jumlah prosess running squid lebih dari satu .
Jika ingin menggunakan mode loadbalance berikut iptable nya
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 |
#!/bin/sh -e iptables -t mangle -F iptables -t mangle -X iptables -t mangle -N DIVERT iptables -t mangle -A DIVERT -j MARK --set-mark 1 iptables -t mangle -A DIVERT -j ACCEPT iptables -t mangle -A INPUT -j ACCEPT iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT iptables -t mangle -A PREROUTING ! -d 172.16.10.1/32 -p tcp --dport 80 -m statistic --mode nth --every 2 --packet 0 -j TPROXY --tproxy-mark 0x1/0x1 --on-port 3128 iptables -t mangle -A PREROUTING ! -d 172.16.10.1/32 -p tcp --dport 80 -m statistic --mode nth --every 1 --packet 0 -j TPROXY --tproxy-mark 0x1/0x1 --on-port 3129 iptables -t mangle -A PREROUTING ! -d 172.16.10.1/32 -p tcp --dport 443 -m statistic --mode nth --every 2 --packet 0 -j TPROXY --tproxy-mark 0x1/0x1 --on-port 3126 iptables -t mangle -A PREROUTING ! -d 172.16.10.1/32 -p tcp --dport 443 -m statistic --mode nth --every 1 --packet 0 -j TPROXY --tproxy-mark 0x1/0x1 --on-port 3127 /sbin/ip rule add fwmark 1 lookup 100 /sbin/ip route add local 0.0.0.0/0 dev lo table 100 echo 0 > /proc/sys/net/ipv4/conf/lo/rp_filter echo 1 > /proc/sys/net/ipv4/ip_forward squid -f /etc/squid/squid.conf start squid -f /etc/squid/squid2.conf start exit 0 |
Demikian Sedikit panduan menggunakan Squid Multiple instances dan SMP Scalability , untuk menghasilkan performa terbaik silahkan dikembangkan dan di modifikasi, karna konfigurasi di dalam tutorial hanyalah sekedar contoh untuk dikembangkan kembali.
Dan tentunya tidak luput dari kesalahan, mohon komentar bagi pembaca untuk perbaikan jika ada kekurangan.
Terima kasih.
Referensi :
http://wiki.squid-cache.org/Features/LargeRockStore
http://wiki.squid-cache.org/Features/SmpScale
http://wiki.squid-cache.org/MultipleInstances
http://wiki.squid-cache.org/ConfigExamples/MultiCpuSystem
https://www.facebook.com/groups/Mikrotik.Squid.Indonesia
