How nginx implements database port forwarding

Due to data security considerations, under normal circumstances, the website or project database is generally prohibited from accessing the external network, or only allows access to some hosts. So, how can we allow other hosts that are prohibited from accessing to access this database without modifying such permissions? At this time, the role of Nginx is reflected.

1, mysql as an example

Oracle, sqlserver and other database configurations are the same as the following configurations, except that the database ports are different
It should be noted that this configuration must be written outside http

#使用nginx做数据库端口转发
stream {
    upstream sql {   
    # 配置数据库的ip和端口
        server 172.16.8.190:3306 weight=1 max_fails=2 fail_timeout=30s;   
    }
    server {
     # 配置本机暴露端口
       listen     925;
       proxy_connect_timeout 1s;
       proxy_timeout 3s;
       proxy_pass sql;
    }
}

2. The complete configuration is as follows

#user  nobody;#配置用户或者用户组，默认为nobody
worker_processes  2;#允许生成的进程数，默认为1

#制定日志路径，级别。这个设置可以放入全局块，http块，server块，
#级别以此为：debug|info|notice|warn|error|crit|alert|emerg
#error_log  logs/error.log;
#error_log  logs/error.log  notice;
#error_log  logs/error.log  info;

#pid        logs/nginx.pid;#指定nginx进程运行文件存放地址


events {
    worker_connections  1024;    #最大连接数，默认为512
    accept_mutex on;   #设置网路连接序列化，防止惊群现象发生，默认为on
    multi_accept on;  #设置一个进程是否同时接受多个网络连接，默认为off
    #use epoll;      #事件驱动模型，select|poll|kqueue|epoll|resig|/dev/poll|eventport
}

stream {
    upstream sql {   
        server 172.16.8.190:3306 weight=1 max_fails=2 fail_timeout=30s;   
    }
    server {
       listen     925;
       proxy_connect_timeout 1s;
       proxy_timeout 3s;
       proxy_pass sql;
    }
}

http {
    include       mime.types;
    default_type  application/octet-stream;

    #log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
    #                  '$status $body_bytes_sent "$http_referer" '
    #                  '"$http_user_agent" "$http_x_forwarded_for"';

    #access_log  logs/access.log  main;

    sendfile        on;
    #tcp_nopush     on;

    #keepalive_timeout  0;
    keepalive_timeout  65;

    #gzip  on;

    #配置tomcat的IP地址和访问端口
    upstream tomcat {
        server 172.16.8.190:8080;
        
     }
    
    server {
        listen       9008;
        server_name  172.16.8.190;
    #header name含下划线
    underscores_in_headers on; 
    #charset gbk; # 编码设置
    #开启gzip压缩
        #gzip模块设置
        gzip on; #开启gzip压缩输出
        gzip_min_length 1k; #最小压缩文件大小
        gzip_buffers 4 16k; #压缩缓冲区
        gzip_http_version 1.0; #压缩版本（默认1.1，前端如果是squid2.5请使用1.0）
        gzip_comp_level 2; #压缩等级
        gzip_types text/plain application/x-javascript text/css application/xml;
        #压缩类型，默认就已经包含text/html，所以下面就不用再写了，写上去也不会有问题，但是会有一个warn。
        gzip_vary on;
        #charset koi8-r;
        #charset utf-8,gbk; # 避免中文乱码
        #root    D:/htmlPage/dist; 
        #access_log  logs/host.access.log  main;
    location /{
        #这个地方指定被访问的文件夹位置
        root   D:/htmlPage;
        index  index.html index.htm;
        #limit_rate 1280k; #限制速度
        client_max_body_size  100M;
        allow all;
        autoindex on;
        proxy_set_header X-Real-IP  $remote_addr;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        add_header 'Access-Control-Allow-Headers' 'Content-Type';
        add_header 'Access-Control-Allow-Methods' 'GET';
        add_header 'Access-Control-Allow-Methods' 'POST';
        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Origin' '*';
        proxy_connect_timeout       600s;
        proxy_read_timeout          600s;
        proxy_send_timeout          600s; 
        access_log off;
        break;
        }
     }
 }

The above is the detailed content of How nginx implements database port forwarding. For more information, please follow other related articles on the PHP Chinese website!