Deploying an Application on an Intranet Host Using a Proxy Host

Application Scenario

Deploy applications on the intranet through proxy hosts to effectively control intranet and extranet communication, enhance data security and network performance, and meet compliance requirements. This policy is widely used in various key scenarios, such as resource access control, secure communication between data centers, content cache acceleration, environment isolation, security audit, and sensitive data processing.

Solution Architecture

The Internet forward proxy function of Squid is used to specify the IP address and port of the target host on the proxy, enabling the target host to access the public network.

For more information about Squid, go to Squid official website. The following procedure uses a Linux host as an example.

Prerequisites

• A host (Proxy-B) bound to a public IP address is available. If no proxy host is available, see Applying for an ECS.
• A host (Host-A) not bound to a public IP address is available.
• Proxy-B and Host-A can access each other through the intranet.

Process

This section describes how to deploy an application on an intranet host or server using a proxy host.

Figure 1 Process flowchart

1. Install Squid.

   Access the command line tool of Proxy-B and run the following command:

   yum install squid -y

   If Complete is displayed, run the following command:

   yum install iptables-services 

   Enter Y. If Complete is displayed, the installation is complete.

2. Edit the Squid configuration file.
   1. Access the command line tool of Proxy-B and run the following command:

      vim /etc/squid/squid.conf

      

   2. Add the following command to the position marked in the red box in the preceding figure:

      acl local src Internal IP address of the host/24

   3. Press Esc and enter :wq to save the file and exit.

3. Configure the firewall of Proxy-B.

   Access the command line tool of Proxy-B and run the following commands in sequence:

   systemctl stop firewalld.service 

   systemctl disable firewalld.service

   yum install iptables-services iptables-devel -y

   systemctl enable iptables.service

   systemctl start iptables.service

   iptables -I INPUT 1 -s Internal IP address of the host/24 -p tcp --dport 3128 -j ACCEPT

   iptables -I INPUT 2 -p tcp --dport 3128 -j DROP 

   

   The IP address in the last but one line must be set to the internal IP address segment or IP address of Host-A. 3128 is the proxy port of Squid.

4. Install OpenSSL.

   Access the command line tool of Proxy-B and run the following command:

   yum install openssl 

   If Complete is displayed, the installation is complete.

5. Start Squid.

   Access the command line tool of Proxy-B and run the following command:

   systemctl start squid     //Start Squid.

   systemctl status squid    //Check the status of Squid.

   

6. Configure the forward proxy.

   Access the command line tool of Host-A and run the following command:

   echo "export http_proxy=http://Internal IP address of the proxy host:3128" >>/etc/profile
   echo "export https_proxy=http://Internal IP address of the proxy host:3128" >>/etc/profile
   echo "export http_proxy=http://Internal IP address of the proxy host:3128" >>~/.bashrc
   echo "export https_proxy=http://Internal IP address of the proxy host:3128" >>~/.bashrc
   echo "export http_proxy=http://Internal IP address of the proxy host:3128" >>~/.bash_profile
   echo "export https_proxy=http://Internal IP address of the proxy host:3128" >>~/.bash_profile
   source /etc/profile
   source ~/.bashrc
   source ~/.bash_profile

7. Create basic resources.
   1. Click Homepage to view all created projects, and then go to the target project.
   2. Choose Settings > General > Basic Resources. The Host Clusters page is displayed by default.
      

      Choose CICD > Deploy. Click Basic Resources. The Host Clusters page is displayed by default.

   3. Click Create Host Cluster, enter the following information, and click Save.

      Parameter	Mandatory	Description
      Cluster Name	Yes	Enter a custom name.
      OS	Yes	Select Linux based on the OS of the host to be added.
      Host Connection Mode	Yes	Select Proxy.
      Execution Resource Pool	Yes	A resource pool is a collection of physical environments where commands are executed during software package deployment. In this scenario, select official.
      Description	No	Enter a description.

   4. Click Add Host, select Adding IP for Add hosts by, enter the following information, and click OK. The proxy host is created.

      Table 1 Parameters of a Linux proxy host

      Parameter	Mandatory	Description
      Host Name	Yes	Enter a custom name, for example, Proxy-B.
      IP	Yes	Enter the public IP address bound to Proxy-B.
      OS	Yes	Keep the default value because it is the OS of your host cluster.
      Authorization	Yes	In this scenario, the Password is used for authentication. Enter the username and password of Proxy-B.
      SSH Port	Yes	Port 22 is recommended.

   5. Click Add Host, select Adding IP for Add hosts by, enter the following information, and click OK. The target host is created.

      Table 2 Parameters of a Linux target host

      Parameter	Mandatory	Description
      Host Name	Yes	Enter a custom name, for example, Host-A.
      Proxy Host	Yes	Select Proxy-B as the network proxy for the target host that cannot connect to the public network.
      IP	Yes	Enter the private IP address of Host-A.
      OS	Yes	Keep the default value because it is the OS of your host cluster.
      Authorization	Yes	In this scenario, the Password is used for authentication. Enter the username and password of Host-A.
      SSH Port	Yes	Port 22 is recommended.

   6. Click in the Operation column of a host to start the host for connectivity verification.

8. Create an application.
   1. Log in to the CodeArts homepage and click the target project name to access the project.
   2. Choose CICD > Deploy.
   3. Click Create Application. On the Set Basic Information page, modify the basic information such as Name, Description, and Execution Host as required.
   4. After editing the basic application information, click Next. On the deployment template selection page, select Blank Template and click OK.
   5. On the Deployment Actions tab page, find the action list on the right, click Add to add an action to the orchestration area on the left.
   6. On the Environment Management page, click Create Environment, enter the basic information, and click Save.
   7. Click Import Host. The system automatically filters all clusters that meet the requirements of the current environment. In the dialog box that is displayed, select the target host cluster and import Proxy-B and Host-A to the environment.

9. Deploy the application. For details, see Deploying an Application and Viewing the Result.
   1. Select the target application in the application list and click .
   2. After the deployment is complete, click the application name and click the target deployment record. The application status bar changes to green and the message Successful is displayed, indicating that the application is successfully deployed.