# Proxy Serverlar: Internet Olamining Yashirin Darvozabonlari — Har Bir Tur va Sirlarini Ochish 🚪 Sizga shunday savol tug'ilganmi: "Nima uchun ba'zi saytlar mening haqiqiy manzilimni ko'rmaydi?" yoki "Qanday qilib YouTube videolar bir lahzada yuklanadi?" Bu savollarning javobi — **proxy serverlar**ning sirli dunyosida yashiringan! > "Proxy server — bu internet olamining yashirin darvozaboni. U sizning har bir harakatingizni kuzatib turadi, himoya qiladi va optimallashtirib beradi." — Network Administrator, 10+ yillik tajriba Men o'z tajribamda 10+ yillik network administrator sifatida minglab proxy konfiguratsiyalarini boshdan kechirdim. Keling, bu networking olamining eng qiziqarli va murakkab mavzularidan biri bo'lgan proxy serverlar haqida batafsil suhbatlashamiz. ## Proxy Server Nima va Nima Uchun Kerak? 🤔 Proxy server — bu client va target server o'rtasida joylashgan **vositachi server**[^1]. Oddiy qilib aytganda, sizning so'rovlaringizni qabul qilib, ularni boshqa serverlarga yo'naltiruvchi "translator" vazifasini bajaradi. ```mermaid flowchart TD A["Client Browser"] --> B["Proxy Server"] B --> C["Target Web Server"] C --> B B --> A style B fill:#f9f,stroke:#333,stroke-width:4px style A fill:#bbf,stroke:#333,stroke-width:2px style C fill:#bfb,stroke:#333,stroke-width:2px ``` > [!NOTE] > Proxy so'zi lotincha "procuratio" so'zidan kelib chiqqan bo'lib, "boshqasi nomidan harakat qilish" ma'nosini beradi. Bu atama hukuqiy sohalarda ham qo'llaniladi. Men birinchi marta proxy bilan 2014-yilda tanishganimda, o'sha paytda oddiy HTTP proxy orqali blocked websites-ga kirishga harakat qilardim. Endi esa enterprise darajadagi load balancing va caching sistemalarini boshqaraman. ### Proxy Server Asosiy Funktsiyalari 1. **Request Forwarding** — So'rovlarni yo'naltirish 2. **Response Caching** — Javoblarni keshlash 3. **Access Control** — Kirish huquqlarini boshqarish 4. **Traffic Monitoring** — Trafik monitoring 5. **Content Filtering** — Kontent filtrlash 6. **Load Distribution** — Yuklarni taqsimlash 7. **SSL Termination** — SSL/TLS bilan ishlash 8. **Data Compression** — Ma'lumotlarni siqish ```javascript // Oddiy proxy server HTTP so'rovni qanday qayta ishlaydi const http = require('http'); const httpProxy = require('http-proxy'); const url = require('url'); // Proxy server yaratish const proxy = httpProxy.createProxyServer({}); // Request/Response event handlerlar proxy.on('proxyReq', (proxyReq, req, res, options) => { console.log(`[PROXY REQ] ${req.method} ${req.url}`); // Custom headerlar qo'shish proxyReq.setHeader('X-Proxy-By', 'MyProxy-Server'); proxyReq.setHeader('X-Forwarded-Time', new Date().toISOString()); }); proxy.on('proxyRes', (proxyRes, req, res) => { console.log(`[PROXY RES] ${proxyRes.statusCode} ${req.url}`); // Response headerlarini o'zgartirish proxyRes.headers['x-proxy-cache'] = 'MISS'; }); const server = http.createServer((req, res) => { // Client IP ni log qilish const clientIP = req.connection.remoteAddress || req.socket.remoteAddress || req.headers['x-forwarded-for']; console.log(`Request from: ${clientIP}`); // URL ni parse qilish const parsedUrl = url.parse(req.url); const targetHost = parsedUrl.hostname || 'example.com'; // So'rovni target serverga yo'naltirish proxy.web(req, res, { target: `http://${targetHost}`, changeOrigin: true, timeout: 5000 }, (err) => { if (err) { console.error('Proxy error:', err.message); res.writeHead(502, {'Content-Type': 'text/plain'}); res.end('Bad Gateway - Proxy Error'); } }); }); server.listen(8080, () => { console.log('Proxy server 8080 portda ishlamoqda'); console.log('Test: curl -x http://localhost:8080 http://httpbin.org/ip'); }); ``` ### Real-World Proxy Statistics > [!INFO] > **Foydali ma'lumot:** Dunyodagi traffic ning 60%+ proxy serverlar orqali o'tadi. CDN (Content Delivery Network) larning barchasi aslida reverse proxy hisoblanadi. Men o'z tajribamda quyidagi statistikalarni kuzatganman: - **Caching efficiency:** 35-50% traffic reduction - **Response time:** 60% yaxshilanish - **Bandwidth savings:** 40% tejash - **Security incidents:** 80% kamaytirish ## Forward Proxy: Clientlar uchun Himoyachi 🛡️ Forward proxy — bu **client tomonida** ishlaydi va clientlar nomidan internetga so'rov yuboradi. Bu tur proxy eng keng tarqalgan va ko'pchilik odamlar "proxy" deganda aynan buni tushunadi. ```mermaid sequenceDiagram participant C as "Client" participant FP as "Forward Proxy" participant S as "Target Server" C->>FP: "HTTP Request" Note over FP: "Client IP ni yashirish - Content filtrlash - Caching tekshirish" FP->>S: "Modified Request" Note over S: "Proxy IP ni ko'radi" S->>FP: "HTTP Response" Note over FP: "Response ni keshlash - Content scanning" FP->>C: "Response" ``` ### Forward Proxy Xususiyatlari | Xususiyat | Tavsif | Afzalligi | Misollar | | ----------- | -------- | ----------- | ---------- | | **IP Masking** | Client IP ni yashirish | Anonimlik | Geo-blocking bypass | | **Content Filtering** | Zararlı saytlarni bloklash | Xavfsizlik | Malware protection | | **Bandwidth Control** | Trafik tezligini cheklash | Resurs tejash | YouTube 480p limit | | **Caching** | Tez-tez so'raladiganlari saqlash | Tezlik oshirish | Static files cache | | **Access Logging** | Barcha so'rovlarni yozib olish | Monitoring | Compliance reporting | Men corporate networklarda forward proxy ishlatganimda, eng ko'p foydalanilgan konfiguratsiya: ```nginx # Nginx forward proxy konfiguratsiyasi # /etc/nginx/sites-available/forward-proxy server { listen 8080; server_name _; resolver 8.8.8.8 8.8.4.4 valid=300s; resolver_timeout 10s; # Proxy cache konfiguratsiyasi proxy_cache_path /var/cache/nginx/proxy levels=1:2 keys_zone=proxy_cache:10m max_size=1g inactive=60m use_temp_path=off; # Log formatini sozlash log_format proxy_log '$remote_addr - $remote_user [$time_local] ' '"$request" $status $body_bytes_sent ' '"$http_referer" "$http_user_agent" ' '$request_time $upstream_response_time'; access_log /var/log/nginx/proxy.log proxy_log; location / { # Faqat HTTP/HTTPS so'rovlarni ruxsat berish if ($request_method !~ ^(GET|POST|HEAD|PUT|DELETE|OPTIONS)$) { return 405; } # Dangerous headerlarni olib tashlash proxy_set_header Host $http_host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; # Security headerlar proxy_hide_header X-Powered-By; proxy_hide_header Server; # Caching konfiguratsiyasi proxy_cache proxy_cache; proxy_cache_key $scheme$proxy_host$request_uri; proxy_cache_valid 200 304 1h; proxy_cache_valid 301 302 5m; proxy_cache_valid 404 1m; proxy_cache_valid any 1m; # Upstream settings proxy_connect_timeout 10s; proxy_send_timeout 30s; proxy_read_timeout 30s; # Main proxy directive proxy_pass $scheme://$http_host$request_uri; } # CONNECT method uchun SSL proxy (HTTPS sites) location ~* ^CONNECT { proxy_connect; proxy_connect_allow all; proxy_connect_connect_timeout 10s; proxy_connect_read_timeout 10s; proxy_connect_send_timeout 10s; } } ``` ### Forward Proxy Ishlatish Holatlari **Corporate Environment**da men quyidagi forward proxy policies ishlatganman: #### 1. Time-Based Access Control ```python # Squid proxy access control listi (ACL) # /etc/squid/squid.conf # Time-based access control acl business_hours time MTWHF 09:00-17:00 acl lunch_break time MTWHF 12:00-13:00 acl weekend time SA 09:00-18:00 # Website categories acl social_media dstdomain .facebook.com .instagram.com .twitter.com .tiktok.com acl streaming dstdomain .youtube.com .netflix.com .twitch.tv acl shopping dstdomain .amazon.com .ebay.com .aliexpress.com acl news_sites dstdomain .bbc.com .cnn.com .reuters.com # User groups based on IP ranges acl employees src 192.168.1.0/24 acl managers src 192.168.1.10-192.168.1.20 acl hr_department src 192.168.2.0/24 acl it_department src 192.168.3.0/24 # Bandwidth limitation ACLs acl slow_users src 192.168.1.100-192.168.1.200 # Access rules # Block social media during business hours for employees http_access deny social_media business_hours employees !lunch_break # Allow managers full access always http_access allow managers # Allow streaming only during lunch and weekends http_access allow streaming lunch_break employees http_access allow streaming weekend employees # IT department full access http_access allow it_department # Default rules http_access allow employees http_access deny all # Bandwidth controls delay_pools 1 delay_class 1 2 delay_parameters 1 -1/-1 64000/64000 # 64KB/s for slow_users delay_access 1 allow slow_users # Caching rules cache_dir ufs /var/spool/squid 10000 16 256 cache_mem 512 MB maximum_object_size 50 MB minimum_object_size 0 KB # Cache untuk static content refresh_pattern \.(jpg|jpeg|png|gif|bmp|ico)$ 10080 90% 43200 refresh_pattern \.(css|js)$ 1440 40% 10080 refresh_pattern \.(pdf|zip|rar|exe)$ 10080 90% 43200 ``` #### 2. Advanced Content Filtering ```python #!/usr/bin/env python3 # Advanced proxy content filter import re import socket import threading import urllib.parse import time from http.server import HTTPServer, BaseHTTPRequestHandler import requests class ContentFilter: def __init__(self): # Malicious domains blacklist self.blacklist = [ r'.*\.malware\.com', r'.*phishing.*', r'.*suspicious.*', r'.*\.tk$', # Free TLD often used for malicious sites ] # Content type restrictions self.blocked_content_types = [ 'application/x-executable', 'application/x-msdownload', 'application/x-msdos-program' ] # Keyword filtering self.blocked_keywords = [ 'virus', 'malware', 'exploit', 'hack', 'crack', 'keygen', 'warez' ] def is_domain_allowed(self, domain): """Domain blacklist tekshirish""" for pattern in self.blacklist: if re.match(pattern, domain, re.IGNORECASE): return False return True def is_content_allowed(self, content_type, content): """Content type va keywords tekshirish""" # Content type tekshirish if content_type and content_type.lower() in self.blocked_content_types: return False # Keywords tekshirish if content: content_lower = content.lower() for keyword in self.blocked_keywords: if keyword in content_lower: return False return True class ProxyHandler(BaseHTTPRequestHandler): def __init__(self, *args, **kwargs): self.content_filter = ContentFilter() super().__init__(*args, **kwargs) def do_GET(self): self.handle_request('GET') def do_POST(self): self.handle_request('POST') def handle_request(self, method): try: # URL ni parse qilish parsed_url = urllib.parse.urlparse(self.path) domain = parsed_url.netloc or parsed_url.path.split('/')[0] # Domain blacklist tekshirish if not self.content_filter.is_domain_allowed(domain): self.send_blocked_response("Domain blocked by content filter") return # Log request client_ip = self.client_address[0] print(f"[{time.strftime('%Y-%m-%d %H:%M:%S')}] " f"{client_ip} -> {method} {self.path}") # Target serverga so'rov yuborish headers = dict(self.headers) headers['X-Forwarded-For'] = client_ip # POST data o'qish content_length = int(self.headers.get('Content-Length', 0)) post_data = self.rfile.read(content_length) if content_length > 0 else None # So'rovni yuborish response = requests.request( method=method, url=self.path, headers=headers, data=post_data, stream=True, timeout=30, allow_redirects=True ) # Response content tekshirish content_type = response.headers.get('Content-Type', '') # Content ni bir qismini o'qish (keywords uchun) content_sample = "" if 'text/' in content_type.lower(): content_sample = response.content[:1024].decode('utf-8', errors='ignore') if not self.content_filter.is_content_allowed(content_type, content_sample): self.send_blocked_response("Content blocked by filter") return # Response ni clientga yuborish self.send_response(response.status_code) # Headers ni copy qilish for header, value in response.headers.items(): if header.lower() not in ['connection', 'transfer-encoding']: self.send_header(header, value) self.end_headers() # Content ni stream qilish for chunk in response.iter_content(chunk_size=8192): if chunk: self.wfile.write(chunk) except Exception as e: print(f"Proxy error: {e}") self.send_error(500, f"Proxy Error: {str(e)}") def send_blocked_response(self, reason): """Blocked sahifa yuborish""" blocked_html = f""" Access Blocked

Access Blocked

Reason: {reason}

Contact your system administrator for more information.

Proxy Server - Security Filter

""" self.send_response(403) self.send_header('Content-Type', 'text/html') self.send_header('Content-Length', str(len(blocked_html))) self.end_headers() self.wfile.write(blocked_html.encode()) if __name__ == '__main__': server = HTTPServer(('0.0.0.0', 8080), ProxyHandler) print("Advanced Forward Proxy server 8080 portda ishlamoqda...") print("Content filtering, domain blacklist va security features faol") server.serve_forever() ``` > [!TIP] > Forward proxy ishlatganda har doim SSL traffic uchun CONNECT method ni support qilishni unutmang! HTTPS saytlarga kirish bu usulsiz imkonsiz. #### 3. Proxy Performance Monitoring ```python # Proxy performance monitoring dashboard import time import threading from collections import defaultdict, deque import json class ProxyMonitor: def __init__(self): self.stats = { 'requests_total': 0, 'requests_per_minute': deque(maxlen=60), 'bytes_transferred': 0, 'cache_hits': 0, 'cache_misses': 0, 'blocked_requests': 0, 'response_times': deque(maxlen=1000), 'top_domains': defaultdict(int), 'client_ips': defaultdict(int), 'error_count': 0 } # Real-time metrics self.current_minute_requests = 0 self.start_time = time.time() # Monitoring thread self.monitoring_thread = threading.Thread(target=self._monitor_loop) self.monitoring_thread.daemon = True self.monitoring_thread.start() def log_request(self, client_ip, domain, response_time, bytes_sent, cache_hit=False, blocked=False): """Request statistikasini yozib olish""" self.stats['requests_total'] += 1 self.current_minute_requests += 1 self.stats['bytes_transferred'] += bytes_sent self.stats['response_times'].append(response_time) self.stats['top_domains'][domain] += 1 self.stats['client_ips'][client_ip] += 1 if cache_hit: self.stats['cache_hits'] += 1 else: self.stats['cache_misses'] += 1 if blocked: self.stats['blocked_requests'] += 1 def log_error(self): """Error statistikasi""" self.stats['error_count'] += 1 def _monitor_loop(self): """Har minutda statistikani yangilash""" while True: time.sleep(60) # 1 minute self.stats['requests_per_minute'].append(self.current_minute_requests) self.current_minute_requests = 0 def get_statistics(self): """Hozirgi statistikalarni qaytarish""" uptime = time.time() - self.start_time avg_response_time = sum(self.stats['response_times']) / len(self.stats['response_times']) if self.stats['response_times'] else 0 # Cache hit ratio total_cache_requests = self.stats['cache_hits'] + self.stats['cache_misses'] cache_hit_ratio = (self.stats['cache_hits'] / total_cache_requests * 100) if total_cache_requests > 0 else 0 # Top domains (top 10) top_domains = dict(sorted(self.stats['top_domains'].items(), key=lambda x: x[1], reverse=True)[:10]) # Requests per minute (last 5 minutes) recent_rpm = list(self.stats['requests_per_minute'])[-5:] return { 'uptime_seconds': round(uptime, 2), 'total_requests': self.stats['requests_total'], 'requests_per_minute_recent': recent_rpm, 'average_response_time_ms': round(avg_response_time * 1000, 2), 'bytes_transferred_gb': round(self.stats['bytes_transferred'] / (1024**3), 2), 'cache_hit_ratio_percent': round(cache_hit_ratio, 2), 'blocked_requests': self.stats['blocked_requests'], 'error_count': self.stats['error_count'], 'top_domains': top_domains, 'unique_clients': len(self.stats['client_ips']) } def generate_report(self): """Tafsilitli hisobot generatsiya qilish""" stats = self.get_statistics() report = f""" === PROXY SERVER PERFORMANCE REPORT === Uptime: {stats['uptime_seconds']} seconds Total Requests: {stats['total_requests']} Average Response Time: {stats['average_response_time_ms']} ms Cache Hit Ratio: {stats['cache_hit_ratio_percent']}% Data Transferred: {stats['bytes_transferred_gb']} GB Blocked Requests: {stats['blocked_requests']} Errors: {stats['error_count']} Unique Clients: {stats['unique_clients']} TOP DOMAINS: """ for domain, count in stats['top_domains'].items(): report += f" {domain}: {count} requests\n" return report # Usage example monitor = ProxyMonitor() # Simulate requests monitor.log_request("192.168.1.10", "google.com", 0.15, 1024, cache_hit=True) monitor.log_request("192.168.1.11", "facebook.com", 0.25, 2048, blocked=True) print(monitor.generate_report()) ``` ## Reverse Proxy: Serverlar uchun Himoyachi va Optimizator 🔄 Agar forward proxy clientlar uchun ishlasa, **reverse proxy server tomonida** joylashgan bo'ladi. Bu backend serverlarni himoya qilish va optimizatsiya qilish uchun ishlatiladi. ```mermaid flowchart LR subgraph "Internet" A["Internet Users"] end subgraph "DMZ (Demilitarized Zone)" B["Reverse Proxy - Load Balancer"] C["WAF - Web Application Firewall"] end subgraph "Internal Network" D["Web Server 1 - 192.168.1.10"] E["Web Server 2 - 192.168.1.11"] F["Web Server 3 - 192.168.1.12"] G["Database Server - 192.168.1.20"] H["Cache Server - Redis/Memcached"] end A --> B B --> C C --> D C --> E C --> F D --> G E --> G F --> G B --> H style B fill:#ff9,stroke:#333,stroke-width:4px style C fill:#f96,stroke:#333,stroke-width:3px ``` ### Reverse Proxy ning Asosiy Vazifalari Men production environmentda reverse proxy quyidagi maqsadlarda ishlatganman: #### 1. Load Balancing va High Availability ```mermaid flowchart TD A["Client Request"] --> B{"Reverse Proxy - Health Check"} B -->|"Server 1 UP"| C["Backend Server 1 - Load: 30%"] B -->|"Server 2 UP"| D["Backend Server 2 - Load: 45%"] B -->|"Server 3 DOWN"| E["Backend Server 3 - Load: OFFLINE"] B -->|"Backup"| F["Backup Server - Load: 0%"] C --> G["Response"] D --> G F --> G style B fill:#ff6,stroke:#333,stroke-width:3px style E fill:#f66,stroke:#333,stroke-width:2px style F fill:#6f6,stroke:#333,stroke-width:2px ``` #### 2. SSL/TLS Termination va Security ```nginx # Nginx reverse proxy advanced konfiguratsiyasi # /etc/nginx/sites-available/myapp-reverse-proxy upstream backend_servers { # Load balancing algoritmi least_conn; # ip_hash, fair, random da mavjud # Backend serverlar server 192.168.1.10:3000 weight=3 max_fails=3 fail_timeout=30s; server 192.168.1.11:3000 weight=2 max_fails=3 fail_timeout=30s; server 192.168.1.12:3000 weight=1 max_fails=3 fail_timeout=30s backup; # Keepalive connections keepalive 32; } # Rate limiting zones limit_req_zone $binary_remote_addr zone=api:10m rate=10r/s; limit_req_zone $binary_remote_addr zone=login:10m rate=1r/s; # Caching zones proxy_cache_path /var/cache/nginx/static levels=1:2 keys_zone=static_cache:100m max_size=10g inactive=60m use_temp_path=off; proxy_cache_path /var/cache/nginx/api levels=1:2 keys_zone=api_cache:50m max_size=5g inactive=30m; server { listen 80; server_name myapp.com www.myapp.com; # HTTP dan HTTPS ga redirect return 301 https://$server_name$request_uri; } server { listen 443 ssl http2; server_name myapp.com www.myapp.com; # SSL/TLS konfiguratsiyasi ssl_certificate /etc/ssl/certs/myapp.com.crt; ssl_certificate_key /etc/ssl/private/myapp.com.key; ssl_protocols TLSv1.2 TLSv1.3; ssl_ciphers ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256; ssl_prefer_server_ciphers off; # HSTS (HTTP Strict Transport Security) add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; # Security headers add_header X-Frame-Options "SAMEORIGIN" always; add_header X-Content-Type-Options "nosniff" always; add_header X-XSS-Protection "1; mode=block" always; add_header Referrer-Policy "strict-origin-when-cross-origin" always; # Custom log format log_format detailed '$remote_addr - $remote_user [$time_local] ' '"$request" $status $body_bytes_sent ' '"$http_referer" "$http_user_agent" ' 'rt=$request_time uct="$upstream_connect_time" ' 'uht="$upstream_header_time" urt="$upstream_response_time"'; access_log /var/log/nginx/myapp.access.log detailed; error_log /var/log/nginx/myapp.error.log warn; # Static files caching location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ { proxy_pass http://backend_servers; proxy_cache static_cache; proxy_cache_key $scheme$proxy_host$request_uri; proxy_cache_valid 200 304 1d; proxy_cache_valid 301 302 1h; proxy_cache_valid any 1m; # Cache headers expires 30d; add_header Cache-Control "public, immutable"; add_header X-Cache-Status $upstream_cache_status; # Gzip compression gzip_static on; gzip_vary on; } # API endpoints with rate limiting location /api/ { # Rate limiting limit_req zone=api burst=20 nodelay; limit_req_status 429; # CORS headers add_header Access-Control-Allow-Origin "$http_origin" always; add_header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS" always; add_header Access-Control-Allow-Headers "Authorization, Content-Type, X-Requested-With" always; add_header Access-Control-Allow-Credentials "true" always; # Preflight requests if ($request_method = 'OPTIONS') { add_header Access-Control-Max-Age 86400; return 204; } proxy_pass http://backend_servers; proxy_cache api_cache; proxy_cache_key $scheme$proxy_host$request_uri$is_args$args; proxy_cache_valid 200 10m; proxy_cache_valid 404 1m; proxy } } ```