基于Apache与Raspberry Pi搭建安全代理的技术问询

Hey there! Since you've already got your SSL certificates sorted, let's get that Raspberry Pi Apache proxy up and running so your US-hosted Django script can route HTTPS requests through the UK. Here's a step-by-step breakdown tailored to your setup:

1. Enable Required Apache Modules #

First, we need to turn on the Apache modules that handle proxying and SSL. Run these commands on your Raspberry Pi:

sudo a2enmod proxy proxy_http proxy_connect ssl
sudo systemctl restart apache2

• proxy and proxy_http handle core HTTP proxying logic
• proxy_connect lets the proxy process HTTPS CONNECT requests (critical for forwarding encrypted traffic to target sites)
• ssl enables SSL support for your proxy's endpoint

2. Configure Apache as a Secure Forward Proxy #

Create a new Apache site configuration file for your proxy. We'll use /etc/apache2/sites-available/proxy.conf (adjust paths if you're not on a Debian/Ubuntu-based Pi):

<VirtualHost *:443>
    # Enable SSL encryption for proxy traffic
    SSLEngine On
    SSLCertificateFile /path/to/your/certificate.crt
    SSLCertificateKeyFile /path/to/your/private.key

    # Enable forward proxy mode
    ProxyRequests On
    ProxyVia On

    # Restrict access to ONLY your US server's IP (security critical!)
    <Proxy *>
        Require ip YOUR_US_SERVER_PUBLIC_IP
        # Optional: Add HTTP Basic Auth for extra layer of security
        # AuthType Basic
        # AuthName "UK Proxy Access"
        # AuthUserFile /etc/apache2/.htpasswd
        # Require valid-user
    </Proxy>

    # Set timeouts to prevent hanging connections
    ProxyConnectTimeout 10
    ProxyTimeout 60

    # Logging for debugging (optional but helpful)
    ErrorLog ${APACHE_LOG_DIR}/proxy_error.log
    CustomLog ${APACHE_LOG_DIR}/proxy_access.log combined
</VirtualHost>

• Replace /path/to/your/certificate.crt and /path/to/your/private.key with your actual SSL file paths
• Replace YOUR_US_SERVER_PUBLIC_IP with the public IP of your US host server—this blocks unauthorized use of your proxy
• If you want extra security, uncomment the Basic Auth lines and create a credentials file with sudo htpasswd -c /etc/apache2/.htpasswd your-preferred-username

Next, enable the site and restart Apache to apply changes:

sudo a2ensite proxy.conf
sudo systemctl restart apache2

3. Open Firewall Ports on Raspberry Pi #

Make sure your Pi's firewall allows incoming traffic on port 443 (HTTPS). If you're using ufw (default on many Pi setups):

sudo ufw allow 443/tcp
sudo ufw reload

4. Configure Your Django Script to Use the Proxy #

Assuming your Django script uses the requests library (common for HTTP/HTTPS calls), add proxy configuration to your requests. Here's an example:

import requests

# Define your UK proxy details
proxies = {
    "https": "https://YOUR_PI_UK_PUBLIC_IP:443"
    # If you enabled Basic Auth, use this format: "https://username:password@YOUR_PI_UK_PUBLIC_IP:443"
}

# Example HTTPS request routed through the proxy
try:
    response = requests.get("https://target-website.com", proxies=proxies, verify=True)
    # Set verify=True to validate the proxy's SSL certificate (use False only for self-signed certs, not recommended for production)
    response.raise_for_status()
    print("Request successful! Response originates from:", response.text.strip()) # Adjust based on target site's output
except requests.exceptions.RequestException as e:
    print(f"Request failed: {e}")

• Replace YOUR_PI_UK_PUBLIC_IP with your Pi's public UK IP address
• If using a self-signed SSL certificate for the proxy, replace verify=True with verify="/path/to/your/certificate.crt" to avoid SSL validation errors

5. Test the Setup #

• On your Raspberry Pi: Test the proxy locally to confirm it routes traffic through the UK:

  curl -x https://localhost:443 https://ifconfig.me
  

  This should return your Pi's UK public IP.
• On your US server: Run the same curl command pointing to your Pi's public IP to ensure cross-region connectivity works.

Troubleshooting Tips #

• If you get connection timeouts: Double-check your Pi's firewall rules and confirm your US server can reach the Pi's public IP.
• If you get SSL errors: Verify your SSL certificate paths in the Apache config are correct, and that your script trusts the certificate.
• If target sites block your proxy: Some sites flag proxy IPs—try changing your Pi's IP or adjusting the User-Agent header in your Django requests to mimic a regular browser.

内容的提问来源于stack exchange，提问作者Matthew Kelly