准备：
购买一台香港区服务器
购买一个跨境带宽包， （需要拿企业营业执照备案）
购买一个云企业网

安装nginx

这个nginx是阿里云二次开发的，引入的也是特殊的模块，配置也不一样

  1. sudo yum install yum-utils -y
  2. vim /etc/yum.repos.d/nginx.repo
  3. [root@iZj6c0od2gvqtan4qpaapcZ ~]# cat /etc/yum.repos.d/nginx.repo
  4. [nginx-stable]
  5. name=nginx stable repo
  6. baseurl=http://nginx.org/packages/centos/$releasever/$basearch/
  7. gpgcheck=1
  8. enabled=1
  9. gpgkey=https://nginx.org/keys/nginx_signing.key
  10. module_hotfixes=true
  12. [nginx-mainline]
  13. name=nginx mainline repo
  14. baseurl=http://nginx.org/packages/mainline/centos/$releasever/$basearch/
  15. gpgcheck=1
  16. enabled=0
  17. gpgkey=https://nginx.org/keys/nginx_signing.key
  18. module_hotfixes=true
  20. sudo yum install yum-sudo yum-config-manager --enable nginx-mainline
  21. sudo yum install nginx -y
  22. sudo setsebool -P httpd_can_network_connect 1
  23. systemctl start nginx

配置

  1. user nginx;
  2. worker_processes auto;
  3. error_log /var/log/nginx/error.log;
  4. pid /run/nginx.pid;
  6. include /usr/share/nginx/modules/*.conf;
  8. events {
  10.   use epoll;
  11.   worker_connections 4096;
  12. }
  14. stream {
  16.    map $ssl_preread_server_name $backend_pool {
  17.      https://www.apple.com $ssl_preread_server_name:$server_port; 
  18.      https://www.google.com $ssl_preread_server_name:$server_port;
  19.      https://www.facebook.com $ssl_preread_server_name:$server_port;
  20.      https://www.googleapis.com $ssl_preread_server_name:$server_port;
  21.      https://oauth2.googleapis.com $ssl_preread_server_name:$server_port;
  22.      googleapis.com $ssl_preread_server_name:$server_port;
  23.     oauth2.googleapis.com $ssl_preread_server_name:$server_port;
  24.       apple.com $ssl_preread_server_name:$server_port;
  25.         ~.*\.apple\.com $ssl_preread_server_name:$server_port;
  26.       google.com $ssl_preread_server_name:$server_port;
  27.       facebook.com $ssl_preread_server_name:$server_port;
  28.         ~.*\.facebook\.com $ssl_preread_server_name:$server_port;
  29.         ~.*\.oauth2.googleapis\.com $ssl_preread_server_name:$server_port;
  30.         ~.*\.googleapis\.com $ssl_preread_server_name:$server_port;
  31.         ~.*\.google\.com $ssl_preread_server_name:$server_port;
  32.       default "";
  33.   }
  35.   server {
  36.     listen 443;
  37.     ssl_preread on;
  38.     resolver 8.8.8.8; 
  39.     proxy_pass $backend_pool;
  40.   }
  41. }
  43. http {
  45.   log_format main '$remote_addr - $remote_user [$time_local] $host$request_uri "$request" '
  46.   '$status $body_bytes_sent "$http_referer" '
  47.   '"$http_user_agent" "$http_x_forwarded_for"';
  49.   access_log /var/log/nginx/access.log main;
  51.   sendfile on;
  52.   tcp_nopush on;
  53.   tcp_nodelay on;
  54.   keepalive_timeout 65;
  55.   types_hash_max_size 2048;
  56.   gzip on;
  57.   gzip_comp_level 6;
  58.   gzip_http_version 1.1;
  59.   gzip_proxied any;
  60.   gzip_min_length 1k;
  61.   gzip_buffers 16 8k;
  62.   gzip_types text/plain text/css text/javascript application/json application/javascript application/x-javascript application/xml;
  63.   gzip_vary on;
  64.   #end gzip
  66.   client_max_body_size 10m; client_body_buffer_size 128k;
  68.   proxy_buffer_size 128k;
  69.   proxy_buffers 32 64k;
  70.   proxy_busy_buffers_size 256k;
  71.   proxy_connect_timeout 60;
  72.   proxy_send_timeout 60;
  73.   proxy_read_timeout 60;
  75.   include /etc/nginx/mime.types;
  76.   default_type application/octet-stream;
  78.   include /etc/nginx/conf.d/*.conf;
  80.   server {
  82.     listen 80 default_server;
  83.     listen [::]:80 default_server;
  84.     server_name _;
  85.     # Load configuration files for the default server block.
  86.     include /etc/nginx/default.d/*.conf;
  87.     location / {
  88.         set $is_allow 0;
  90.        if ($host = 'www.apple.com') {
  91.             set $is_allow 1;
  93.        }
  94. if ($host = 'www.facebook.com') {
  95. set $is_allow 1;
  96. }
  97. if ($host = 'www.google.com') {
  98. set $is_allow 1;
  99. }
  100. if ($host = 'www.googleapis.com') {
  101. set $is_allow 1;
  102. }
  103.   if ($host = 'apple.com') {
  104.             set $is_allow 1;
  106.        }
  107. if ($host = 'facebook.com') {
  108. set $is_allow 1;
  109. }
  110. if ($host = 'google.com') {
  111. set $is_allow 1;
  112. }
  113. if ($host = 'googleapis.com') {
  114. set $is_allow 1;
  115. }
  116. if ($host ~ '.*\.office365\.com') {
  117. set $is_allow 1;
  118. }
  119.        if ($is_allow = 0) {
  120.             return 404;
  121.        }
  123.       proxy_set_header Host $host;
  124.       proxy_set_header Accept-Encoding "";
  125.       proxy_set_header X-Real-IP $remote_addr;
  126.       proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  127.       proxy_set_header Cookie $http_cookie;
  129.       resolver 8.8.8.8; 
  130.       proxy_pass http://$host:$server_port$request_uri;
  131.     }
  133.   }
  135. }

PrivateZone

云解析DNS—-》PrivateZone—-》添加Zone
图片.png
点击解析设置，进去添加记录，解析泛域名，记录值是香港服务器内网ip：172.21.15.93