1、 CDN概述
CDN，即内容分发网络，是构建在现有网络基础之上的智能虚拟网络，依靠部署在各地的边缘服务器，通过中心平台的负载均衡、内容分发、调度等功能模块，使用户就近获取所需内容，降低网络拥塞，提高用户访问响应速度和命中率。通常情况下，CDN的关键技术主要有内容存储和分发技术。（引自?百度百科：CDN）
CDN的搭建方式有很多种，并且所使用的软件也有很多种，在本文中以老牌的squid为例进行搭建和实验。
2、 本实验CDN拓扑
在本文中，旨在通过nginx+squid这样的方式搭建一个简易的CDN服务器，用于缓存源服务器上的内容，从而提高达到提高访问速度和流量分摊的目的，我们使用两台服务器进行实验，其中一台安装nginx充当源服务器，另一台则是安装nginx和squid充当CDN缓存服务器，相关拓扑如下：
3、 配置步骤
3.1、网站源服务器（操作系统为debian）
（1）安装nginx
apt install nginx -y
（2）修改nginx的初始页面，以便区分
echo 'This is test webpage!!!!' > /var/www/html/index.nginx-debian.html
（3）重启nginx
systemctl restart nginx
需要注意的是，debian默认的防火墙为iptables，因为该防火墙默认是没有规则的，因此不用专门关闭。
上述配置完成后，客户端输入网站源服务器的IP地址，可以看到访问是正常的如下图所示：
3.2、CDN服务器（操作系统为CentOS-Stream 9）
针对于CDN服务器，相应的部署步骤如下：
（1）关闭防火墙以及防火墙自启动，也可写入具体的安全策略至防火墙
systemctl disable firewalld
systemctl stop firewalld
（2）安装nginx和squid
yum install nginx -y
yum install squid -y
（3）输入命令“vim /etc/squid/squid.conf”，修改该配置文件，增加如下图红框中所示的内容，以达到将squid缓存代理服务指向网站源服务器的IP地址和端口（192.168.80.135:80）之目的
（4）输入命令“vim /etc/nginx/nginx.conf”，修改该配置文件，在server结构体下，增加如下图红框中所示的内容，以达到CDN上的nginx指向squid代理服务（默认监听端口是3128）之目的
（5）配置完成后，重启nginx和squid
systemctl restart nginx
systemctl restart squid
（6）输入以下命令修改SELinux安全上下文的布尔值，如果在CentOS上遗失此步骤，会出现因为SELinux的httpd_can_network_connect模块阻拦，而导致nginx和squid无法建立通信，缓存不到网站源服务器的资源，最终使得客户端访问CDN服务器时报“502 bad Gateway”错误，如下图
输入命令“setsebool -P httpd_can_network_connect 1”后，然后在客户端的浏览器上输入CDN服务器的IP地址192.168.80.136，发现可以成功访问到网站源服务器（192.168.80.135）上的页面，通过浏览器的开发者工具也可以看到访问过程中经过了squid，说明此时CDN服务器缓存成功
4、附：nginx和squid的配置文件
4.1、/etc/nginx/nginx.conf
# For more information on configuration, see:
# * Official English Documentation: http://nginx.org/en/docs/
# * Official Russian Documentation: http://nginx.org/ru/docs/
user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log;
pid /run/nginx.pid;
# Load dynamic modules. See /usr/share/doc/nginx/README.dynamic.
include /usr/share/nginx/modules/*.conf;
events {
worker_connections 1024;
}
http {
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
access_log /var/log/nginx/access.log main;
sendfile on;
tcp_nopush on;
tcp_nodelay on;
keepalive_timeout 65;
types_hash_max_size 4096;
include /etc/nginx/mime.types;
default_type application/octet-stream;
# Load modular configuration files from the /etc/nginx/conf.d directory.
# See http://nginx.org/en/docs/ngx_core_module.html#include
# for more information.
include /etc/nginx/conf.d/*.conf;
server {
listen 80;
#listen [::]:80;
#server_name _;
#root /usr/share/nginx/html;
# Load configuration files for the default server block.
#include /etc/nginx/default.d/*.conf;
location / {
proxy_pass http://127.0.0.1:3128;
}
error_page 404 /404.html;
location = /404.html {
}
error_page 500 502 503 504 /50x.html;
location = /50x.html {
}
}
# Settings for a TLS enabled server.
#
# server {
# listen 443 ssl http2;
# listen [::]:443 ssl http2;
# server_name _;
# root /usr/share/nginx/html;
#
# ssl_certificate "/etc/pki/nginx/server.crt";
# ssl_certificate_key "/etc/pki/nginx/private/server.key";
# ssl_session_cache shared:SSL:1m;
# ssl_session_timeout 10m;
# ssl_ciphers PROFILE=SYSTEM;
# ssl_prefer_server_ciphers on;
#
# # Load configuration files for the default server block.
# include /etc/nginx/default.d/*.conf;
#
# error_page 404 /404.html;
# location = /40x.html {
# }
#
# error_page 500 502 503 504 /50x.html;
# location = /50x.html {
# }
# }
}
4.2、/etc/squid/squid.conf
#
# Recommended minimum configuration:
#
# Example rule allowing access from your local networks.
# Adapt to list your (internal) IP networks from where browsing
# should be allowed
acl localnet src 0.0.0.1-0.255.255.255 # RFC 1122 "this" network (LAN)
acl localnet src 10.0.0.0/8 # RFC 1918 local private network (LAN)
acl localnet src 100.64.0.0/10 # RFC 6598 shared address space (CGN)
acl localnet src 169.254.0.0/16 # RFC 3927 link-local (directly plugged) machines
acl localnet src 172.16.0.0/12 # RFC 1918 local private network (LAN)
acl localnet src 192.168.0.0/16 # RFC 1918 local private network (LAN)
acl localnet src fc00::/7 # RFC 4193 local private network range
acl localnet src fe80::/10 # RFC 4291 link-local (directly plugged) machines
acl SSL_ports port 443
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 # https
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
#
# Recommended minimum Access Permission configuration:
#
# Deny requests to certain unsafe ports
http_access deny !Safe_ports
# Deny CONNECT to other than secure SSL ports
http_access deny CONNECT !SSL_ports
# Only allow cachemgr access from localhost
http_access allow localhost manager
http_access deny manager
cache_peer 192.168.80.135 parent 80 0 originserver
cache_peer_access 192.168.80.135 allow all
# We strongly recommend the following be uncommented to protect innocent
# web applications running on the proxy server who think the only
# one who can access services on "localhost" is a local user
#http_access deny to_localhost
#
# INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS
#
# Example rule allowing access from your local networks.
# Adapt localnet in the ACL section to list your (internal) IP networks
# from where browsing should be allowed
http_access allow localnet
http_access allow localhost
# And finally deny all other access to this proxy
#http_access deny all
#http_access allow all
# Squid normally listens to port 3128
http_port 3128 accel vhost vport
# Uncomment and adjust the following to add a disk cache directory.
cache_dir ufs /var/spool/squid 100 16 256
# Leave coredumps in the first cache dir
coredump_dir /var/spool/squid
#
# Add any of your own refresh_pattern entries above these.
#
refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
refresh_pattern . 0 20% 4320