{"id":352515,"date":"2021-02-17T10:56:36","date_gmt":"2021-02-17T02:56:36","guid":{"rendered":"http:\/\/4563.org\/?p=352515"},"modified":"2021-02-17T10:56:36","modified_gmt":"2021-02-17T02:56:36","slug":"%e5%9f%ba%e4%ba%8e%e4%b8%bb%e6%9c%ba%e5%90%8d%e7%9a%84-nginx-tcp-%e8%bd%ac%e5%8f%91%e9%97%ae%e9%a2%98","status":"publish","type":"post","link":"http:\/\/4563.org\/?p=352515","title":{"rendered":"\u57fa\u4e8e\u4e3b\u673a\u540d\u7684 Nginx TCP \u8f6c\u53d1\u95ee\u9898"},"content":{"rendered":"
\n
\n
\n

\u57fa\u4e8e\u4e3b\u673a\u540d\u7684 Nginx TCP \u8f6c\u53d1\u95ee\u9898 <\/h1>\n

<\/p>\n

\n
\u8cc7\u6df1\u5927\u4f6c : pydiff <\/span> <\/i> 2<\/span> <\/div>\n
<\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n
<\/p>\n

nginx \u53ef\u4ee5\u901a\u8fc7\u4e0d\u540c\u7684\u4e3b\u673a\u540d\u76f8\u540c\u7aef\u53e3\u53f7\u6765\u533a\u5206\u4e0d\u540c\u7684 http \u670d\u52a1,\u4eca\u5929\u60f3\u5229\u7528 nginx \u6765\u8f6c\u53d1 tcp(\u975e http)\u7684\u7aef\u53e3,\u627e\u904d\u4e86\u767e\u5ea6\u90fd\u662f\u5f15\u7528\u4e86 sf \u4e0a\u7684\u4e00\u4e2a\u5e16\u5b50\u7684\u8bbe\u7f6e\u65b9\u6cd5:\u5730\u5740:https:\/\/stackoverflow.com\/questions\/34741571\/nginx-tcp-forwarding-based-on-hostname<\/p>\n

stream {      map $ssl_preread_server_name $name {         vpn1.app.com vpn1_backend;         vpn2.app.com vpn2_backend;         https.app.com https_backend;         default https_default_backend;     }      upstream vpn1_backend {         server 10.0.0.3:443;     }      upstream vpn2_backend {         server 10.0.0.4:443;     }      upstream https_backend {         server 10.0.0.5:443;     }      upstream https_default_backend {         server 127.0.0.1:443;     }      server {         listen 10.0.0.1:443;         proxy_pass $name;         ssl_preread on;     } } <\/code><\/pre>\n
\u7136\u800c\u6211\u5bf9\u7740\u8bbe\u7f6e\u4e86\u5374\u62a5\u8fd9\u4e2a\u9519,<\/p>\n
2021\/02\/20 09:31:32 [error] 23#23: *22 connect() failed (111: Connection refused) while connecting to upstream, client: 1.1.1.1, server: 192.168.0.5:9443, upstream: \"127.0.0.1:9443\", bytes from\/to client:0\/0, bytes from\/to upstream:0\/0  <\/code><\/pre>\n
\u5b9e\u5728\u627e\u4e0d\u5230\u89e3\u51b3\u65b9\u6cd5\u4e86\u60f3\u8fc7\u6765\u95ee\u95ee\u5404\u4f4d\u5927\u4f6c<\/p>\n
\u73b0\u5728\u6211\u5df2\u7ecf\u7528 8443 \u7aef\u53e3\u5728\u8dd1\u7740 web \u670d\u52a1\u4e86,\u8fd8\u60f3\u901a\u8fc7\u6539\u4e0b\u4e3b\u673a\u540d\u6765\u4ee3\u7406\u4e0d\u540c\u7684\u670d\u52a1,\u5982 mysql.test.com \u4ee3\u7406 mysql \u7684 3306,redis.test.com \u4ee3\u7406 redis \u7684 6379, \u53e6\u5916\u5982\u679c\u5c06\u4e0a\u9762\u7684 upstream \u914d\u7f6e\u4e2d 443 \u6539\u6210 8443 \u5219\u62a5\u9519<\/p>\n
nginx: [emerg] bind() to 192.168.0.5:8443 failed (98: Address already in use) <\/code><\/pre>\n
\u60f3\u61c2\u7684\u5927\u4f6c\u6307\u70b9\u4e0b<\/p>\n<\/p><\/div>\n
 \u5927\u4f6c\u6709\u8a71\u8aaa<\/b> (20<\/span>)        <\/div>\n
 <\/div>\n<\/p><\/div>\n<\/p><\/div>\n
    \n
  • \n
    \n
    \n
     \u8cc7\u6df1\u5927\u4f6c : fucUup <\/span>  <\/div>\n
     <\/i>            <\/span> <\/div>\n<\/p><\/div>\n
                                                                 \u5927\u54e5\u4f60\u6807\u9898\u5199\u9519\u4e86\u5427, tcp \u8f6c\u53d1\u5e94\u8be5\u662f https<\/p>\n
    tcp \u54ea\u6709\u57df\u540d\u7684\u5440\u5927\u54e5<\/p>\n
    \u5168\u6587\u90fd\u5728\u8bb2 https sni \u55c5\u63a2                                                            <\/p><\/div>\n<\/p><\/div>\n<\/li>\n
  • \n
    \n
    \n
     \u8cc7\u6df1\u5927\u4f6c : villivateur <\/span>  <\/div>\n
     <\/i>            <\/span> <\/div>\n<\/p><\/div>\n
                                                                 \u57df\u540d\u662f http \u91cc\u9762\u7684\u6982\u5ff5\uff0ctcp \u4e0d\u5b58\u5728\u57df\u540d\u4e00\u8bf4                                                            <\/div>\n<\/p><\/div>\n<\/li>\n
  • \n
    \n
    \n
     \u8cc7\u6df1\u5927\u4f6c : ysc3839 <\/span>  <\/div>\n
     <\/i>            <\/span> <\/div>\n<\/p><\/div>\n
                                                                 \u4f60\u8d34\u7684\u8fd9\u6bb5\u914d\u7f6e\u524d\u9762\u6709\u4e00\u6bb5\u8bdd<\/p>\n
    This allows Nginx to read the TLS Client Hello and decide based on the SNI extension which backend to use.                                                            <\/p><\/div>\n<\/p><\/div>\n<\/li>\n
  • \n
    \n
    \n
     \u4e3b<\/span> \u8cc7\u6df1\u5927\u4f6c : pydiff <\/span>  <\/div>\n
     <\/i>            <\/span> <\/div>\n<\/p><\/div>\n
                                                                 @fucUup \u53ef\u80fd\u6211\u7684\u8868\u8fbe\u6709\u8bef,\u6211\u7684\u9700\u6c42\u5c31\u662f mysql.test.com:8443 \u4ee3\u7406 mysql \u7684 3306,redis.test.com:8443 \u4ee3\u7406 redis \u7684 6379,\u80fd\u641e\u5b9a\u8fd9\u4e2a\u5c31\u884c\u4e86                                                            <\/div>\n<\/p><\/div>\n<\/li>\n
  • \n
    \n
    \n
     \u8cc7\u6df1\u5927\u4f6c : FingerLiu <\/span>  <\/div>\n
     <\/i>            <\/span> <\/div>\n<\/p><\/div>\n
                                                                 \u4f60\u8fd9\u4e2a\u53ea\u80fd\u6309\u5206\u914d\u4e0d\u540c\u7684\u7aef\u53e3\u6765\u533a\u5206\uff0c\u4e0d\u80fd\u901a\u8fc7\u57df\u540d\uff0c\u56e0\u4e3a tcp \u8fde\u63a5\u6ca1\u6709\u57df\u540d\u7684\u6982\u5ff5                                                            <\/div>\n<\/p><\/div>\n<\/li>\n
  • \n
    \n
    \n
     \u8cc7\u6df1\u5927\u4f6c : delpo <\/span>  <\/div>\n
     <\/i>            <\/span> <\/div>\n<\/p><\/div>\n
                                                                 \u540c\u4e0a\u6240\u8bf4\uff0cstream \u8f6c\u53d1\u7684\u662f tcp \u94fe\u63a5\uff0c\u6240\u4ee5\u4f60\u7684\u9700\u6c42\u662f\u4e0d\u80fd\u901a\u8fc7\u8fd9\u4e2a\u65b9\u6cd5\u5b8c\u6210\u7684\u3002
    \u4f46\u662f\u5982\u679c\u4f60\u5f00\u542f\u4e86 tls\uff0c\u5c31\u53ef\u4ee5\u901a\u8fc7 pread server name \u6765\u8fdb\u884c\u533a\u5206\uff0c\u8fd9\u4e2a\u6307\u4ee4\u53ea\u80fd\u533a\u5206 client hello \u7684\u57df\u540d                                                            <\/div>\n<\/p><\/div>\n<\/li>\n
  • \n
    \n
    \n
     \u8cc7\u6df1\u5927\u4f6c : noe132 <\/span>  <\/div>\n
     <\/i>            <\/span> <\/div>\n<\/p><\/div>\n
                                                                 tcp \u6ca1\u6709\u57df\u540d\u3002\u4f60\u8fde\u63a5\u524d\u57df\u540d\u5df2\u7ecf\u88ab dns \u89e3\u6790\u6210 ip \u540e\u624d\u5efa\u7acb\u7684 tcp \u94fe\u63a5\u3002tcp \u662f\u6839\u636e ip+\u7aef\u53e3\u533a\u5206\u94fe\u63a5\u7684\u3002                                                            <\/div>\n<\/p><\/div>\n<\/li>\n
  • \n
    \n
    \n
     \u8cc7\u6df1\u5927\u4f6c : delpo <\/span>  <\/div>\n
     <\/i>            <\/span> <\/div>\n<\/p><\/div>\n
                                                                 pread –> preread                                                            <\/div>\n<\/p><\/div>\n<\/li>\n
  • \n
    \n
    \n
     \u8cc7\u6df1\u5927\u4f6c : Qetesh <\/span>  <\/div>\n
     <\/i>            <\/span> <\/div>\n<\/p><\/div>\n
                                                                 haproxy \u8f7b\u677e\u56db\u5c42\u8d1f\u8f7d                                                            <\/div>\n<\/p><\/div>\n<\/li>\n
  • \n
    \n
    \n
     \u8cc7\u6df1\u5927\u4f6c : snoopyxdy1 <\/span>  <\/div>\n
     <\/i>            <\/span> <\/div>\n<\/p><\/div>\n
                                                                 @pydiff \u4e5f\u53ef\u4ee5\u5b9e\u73b0\uff0c\u914d\u7f6e 2 \u53f0 nginx \u670d\u52a1\u5668\uff0c\u7136\u540e\u5c06\u57df\u540d mysql.test.com \u548c redis.test.com \u5206\u522b\u6307\u5411\u8fd9 2 \u53f0 nginx \u670d\u52a1\u5668\u7684 ip \u5730\u5740\u5373\u53ef                                                            <\/div>\n<\/p><\/div>\n<\/li>\n
  • \n
    \n
    \n
     \u8cc7\u6df1\u5927\u4f6c : iseki <\/span>  <\/div>\n
     <\/i>            <\/span> <\/div>\n<\/p><\/div>\n
                                                                 \u505a\u4e0d\u5230\u7684\u5427\uff0c\u8fd9\u4e2a\u529f\u80fd\u662f TLS SNI proxy\uff0c\u5f97\u662f\u5e26\u6709 SNI \u7684 TLS \u94fe\u63a5\u624d\u8d77\u4f5c\u7528                                                            <\/div>\n<\/p><\/div>\n<\/li>\n
  • \n
    \n
    \n
     \u4e3b<\/span> \u8cc7\u6df1\u5927\u4f6c : pydiff <\/span>  <\/div>\n
     <\/i>            <\/span> <\/div>\n<\/p><\/div>\n
                                                                 @FingerLiu 
    @delpo 
    @noe132 \u597d\u7684,\u5b66\u4e60\u4e86,\u591a\u8c22\u5927\u4f6c\u6307\u70b9                                                            <\/div>\n<\/p><\/div>\n<\/li>\n
  • \n
    \n
    \n
     \u4e3b<\/span> \u8cc7\u6df1\u5927\u4f6c : pydiff <\/span>  <\/div>\n
     <\/i>            <\/span> <\/div>\n<\/p><\/div>\n
                                                                 @Qetesh \u6ca1\u7528\u8fc7,\u6539\u5929\u6709\u7a7a\u65f6\u8bd5\u8bd5                                                            <\/div>\n<\/p><\/div>\n<\/li>\n
  • \n
    \n
    \n
     \u8cc7\u6df1\u5927\u4f6c : also24 <\/span>  <\/div>\n
     <\/i>            <\/span> <\/div>\n<\/p><\/div>\n
                                                                 \u539f\u7406\u4e0a\u7684\u9519\u8bef\u524d\u9762\u5f88\u591a\u4eba\u8bf4\u4e86\uff0c\u4e0d\u591a\u8d58\u8ff0\u3002<\/p>\n
    \u4f60\u8fd9\u4e2a\u539f\u59cb\u9700\u6c42\u4e5f\u6709\u70b9\u5947\u602a\u554a\uff0c\u4e3a\u4ec0\u4e48\u8981\u628a mysql \u548c redis \u8dd1\u5728 80 \u7aef\u53e3\u5462\uff1f<\/p>\n
    \u76f4\u63a5\uff1a
    mysql.test.com:3306                                                            <\/div>\n<\/p><\/div>\n<\/li>\n
  • \n
    \n
    \n
     \u8cc7\u6df1\u5927\u4f6c : also24 <\/span>  <\/div>\n
     <\/i>            <\/span> <\/div>\n<\/p><\/div>\n
                                                                 \u76f4\u63a5\uff1a<\/p>\n
    mysql \u70b9 test \u70b9 com:3306
    redis \u70b9 test \u70b9 com:6379<\/p>\n
    \u8fd9\u6837\u4f7f\u7528\u4e0d\u597d\u4e48<\/p>\n
    \uff08\u524d\u9762\u6ca1\u6253\u5b8c\u4e0d\u5c0f\u5fc3\u6309\u5230\u4e86\u56de\u590d\uff09                                                            <\/p><\/div>\n<\/p><\/div>\n<\/li>\n
  • \n
    \n
    \n
     \u4e3b<\/span> \u8cc7\u6df1\u5927\u4f6c : pydiff <\/span>  <\/div>\n
     <\/i>            <\/span> <\/div>\n<\/p><\/div>\n
                                                                 @also24 \u56e0\u4e3a\u4e0d\u60f3\u6620\u5c04\u592a\u591a\u7aef\u53e3\u53f7\u51fa\u6765\u5440,\u60f3\u7740\u7528\u591a\u4e2a\u4e3b\u673a\u540d\u6765\u533a\u5206,\u8fd8\u5bb9\u6613\u8bb0                                                            <\/div>\n<\/p><\/div>\n<\/li>\n
  • \n
    \n
    \n
     \u8cc7\u6df1\u5927\u4f6c : also24 <\/span>  <\/div>\n
     <\/i>            <\/span> <\/div>\n<\/p><\/div>\n
                                                                 @pydiff #16 
    emmmm \u53cd\u6b63\u524d\u9762\u5df2\u7ecf\u5f88\u591a\u4eba\u79d1\u666e\u4e86\uff0c\u4f60\u7684\u601d\u8def\u5728\u539f\u7406\u4e0a\u662f\u4e0d\u53ef\u884c\u7684\uff0c\u8fd8\u662f\u6309\u5e38\u89c4\u64cd\u4f5c\u6765\u5427\u3002
    \uff08\u5176\u5b9e\u5230\u4e5f\u4e0d\u662f\u5b8c\u5168\u4e0d\u53ef\u884c\uff0c\u81ea\u5df1\u505a\u4e00\u5957\u89e3\u6790\u534f\u8bae\u7684\u5206\u53d1\uff0c\u4e5f\u8bb8\u53ef\u4ee5\u505a\u5230\uff09                                                            <\/div>\n<\/p><\/div>\n<\/li>\n
  • \n
    \n
    \n
     \u4e3b<\/span> \u8cc7\u6df1\u5927\u4f6c : pydiff <\/span>  <\/div>\n
     <\/i>            <\/span> <\/div>\n<\/p><\/div>\n
                                                                 @also24 #17 
    \u8fd9\u4e2a\u8fd8\u662f\u7b97\u4e86,\u83dc\u9e21\u4e00\u4e2a,\u54ea\u4f1a\u8fd9\u79cd\u4e1c\u897f                                                            <\/div>\n<\/p><\/div>\n<\/li>\n
  • \n
    \n
    \n
     \u8cc7\u6df1\u5927\u4f6c : xinyifly <\/span>  <\/div>\n
     <\/i>            <\/span> <\/div>\n<\/p><\/div>\n
                                                                 \u6211\u4e5f\u4f5c\u8fc7\u8fd9\u4e2a\u5c1d\u8bd5\uff0c\u5982\u679c\u6211\u6ca1\u7406\u89e3\u9519\u7684\u8bdd\uff0c\u6211\u518d\u8be6\u7ec6\u89e3\u91ca\u4e00\u4e0b @noe132 \u7684\u7b54\u6848\uff1a<\/p>\n
    1. mysql \u5ba2\u6237\u7aef\u6536\u5230 mysql.test.com:8443 \u7684\u8fde\u63a5\u914d\u7f6e
    2. mysql \u901a\u8fc7\u64cd\u4f5c\u7cfb\u7edf\u7684 DNS \u529f\u80fd\u67e5\u8be2\u5230 mysql.test.com \u7684 ip \u4e3a 69.172.200.109
    3. mysql \u5411 69.172.200.109:8443 \u53d1\u8d77\u8fde\u63a5<\/p>\n
    \u5bf9\u4e8e redis \u4e5f\u662f\u4e00\u6837\u7684\u3002<\/p>\n
    \u6240\u4ee5\u4f60\u53ef\u4ee5\u770b\u5230\uff0c\u5bf9\u4e8e\u63d0\u4f9b TCP \u670d\u52a1\uff08\u975e HTTP \uff09\u7684\u670d\u52a1\u5668\uff0c\u662f\u6536\u4e0d\u5230\u57df\u540d\uff08\u6216\u4e3b\u673a\u540d\uff09\u4fe1\u606f\u7684\u3002<\/p>\n
    \u603b\u7ed3\uff1a\u5bf9\u4e8e\u76ee\u524d\u5927\u90e8\u5206\u57fa\u4e8e TCP \u800c\u975e HTTP \u7684\u670d\u52a1\u800c\u8a00\uff0c\u60f3\u901a\u8fc7\u57df\u540d\u6216\u4e3b\u673a\u540d\u533a\u5206\u6d41\u91cf\u662f\u4e0d\u53ef\u80fd\u7684\uff0c\u56e0\u4e3a\u5ba2\u6237\u7aef\u5e76\u672a\u53d1\u9001\u57df\u540d\uff08\u6216\u4e3b\u673a\u540d\uff09\u4fe1\u606f\u3002<\/p>\n
    \u5176\u5b83\u601d\u8def\uff1aLinux \u5185\u6838\u63d0\u4f9b\u4e86\u591a\u4e2a\u670d\u52a1\u590d\u7528\u540c\u4e00\u4e2a\u7aef\u53e3\u7684\u529f\u80fd\uff0c\u4e5f\u6709\u901a\u8fc7\u55c5\u63a2\u8fde\u63a5\u7c7b\u578b\u4f5c\u8f6c\u53d1\u7684\u4ee3\u7406\u670d\u52a1\uff08\u6bd4\u5982 sslh \uff09\uff0c\u6211\u6ca1\u6709\u5c1d\u8bd5\u8fc7\uff0c\u4e3b\u6709\u9700\u8981\u53ef\u4ee5\u53c2\u8003\u4e00\u4e0b\u3002                                                            <\/p><\/div>\n<\/p><\/div>\n<\/li>\n
  • \n
    \n
    \n
     \u4e3b<\/span> \u8cc7\u6df1\u5927\u4f6c : pydiff <\/span>  <\/div>\n
     <\/i>            <\/span> <\/div>\n<\/p><\/div>\n
                                                                 @xinyifly #19 
    \u597d\u7684,\u8c22\u8c22\u89e3\u7b54\u54c8                                                            <\/div>\n<\/p><\/div>\n<\/li>\n
  • \n","protected":false},"excerpt":{"rendered":"
    \u57fa\u4e8e\u4e3b\u673a\u540d\u7684 Nginx TCP …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[],"tags":[],"_links":{"self":[{"href":"http:\/\/4563.org\/index.php?rest_route=\/wp\/v2\/posts\/352515"}],"collection":[{"href":"http:\/\/4563.org\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/4563.org\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/4563.org\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/4563.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=352515"}],"version-history":[{"count":0,"href":"http:\/\/4563.org\/index.php?rest_route=\/wp\/v2\/posts\/352515\/revisions"}],"wp:attachment":[{"href":"http:\/\/4563.org\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=352515"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/4563.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=352515"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/4563.org\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=352515"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}