架设基于StrongSwan的L2tp/IPSec VPN服务器
架设基于StrongSwan的L2tp/IPSec VPN服务器
参考: http://agit8.turbulent.ca/bwp/2011/01/setting-up-a-vpn-server-with-ubuntu-1004-and-strongswan/
以下操作基于Debian 6
安装StrongSwan
apt-get install libgmp3-dev libssl-dev make cd /tmp wget http://download.strongswan.org/strongswan-4.6.2.tar.gz tar zxvf strongswan-4.6.2.tar.gz cd /tmp/strongswan-4.6.2 ./configure --prefix=/usr --sysconfdir=/etc --libexecdir=/usr/lib --with-ipsecdir=/usr/lib/strongswan --enable-cisco-quirks --enable-openssl --enable-nat-transport --disable-mysql --disable-ldap --disable-static --enable-shared --enable-eap-mschapv2 --enable-eap-radius --enable-eap-md5 --enable-dhcp make make install
编辑 IPSec 配置文件
cp /etc/ipsec.conf /etc/ipsec.conf.old cat >/etc/ipsec.conf<<EOF config setup nat_traversal=yes virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12 plutostart=yes charonstart=yes conn L2TP-PSK-NAT rightsubnet=vhost:%priv also=L2TP-PSK-noNAT conn L2TP-PSK-noNAT type=transport authby=psk keyexchange=ikev1 pfs=no keyingtries=3 rekey=no left=%defaultroute leftnexthop=%defaultroute leftprotoport=17/1701 right=%any rightprotoport=17/%any rightsubnetwithin=0.0.0.0/0 auto=add EOF
设置 PSK 预共享密钥,需要修改成你自己服务器的公网IP及”nsshell.com”部分
cat >/etc/ipsec.secrets<<EOF 216.187.89.188 %any: PSK "nsshell.com" EOF
调整网络策略, for 循环语句,请一行一行地输入,输完后按回车。
[wp_ad_camp_1]
function updateipv4conf() { for each in /proc/sys/net/ipv4/conf/* do echo 0 > $each/accept_redirects echo 0 > $each/send_redirects done }
updateipv4conf
重启IPSec 服务,StrongSwan的ipsec命令应该会自动添加到$PATH中
ipsec restart
安装 L2TP
apt-get install xl2tpd
编辑 xl2tpd 配置文件,请修改下面对应的服务器IP
cat >/etc/xl2tpd/xl2tpd.conf<<EOF [global] port = 1701 listen-addr = < SERVER_PUBLIC_IP > ipsec saref = yes [lns default] local ip = 10.31.2.1 ip range = 10.31.2.2-10.31.2.254 require chap = yes refuse pap = yes require authentication = yes ppp debug = yes pppoptfile = /etc/ppp/options.xl2tpd length bit = yes name = xl2tpd EOF
PPP 的安装配置
cat >/etc/ppp/options.xl2tpd<<EOF require-mschap-v2 ms-dns 8.8.8.8 ms-dns 8.8.4.4 asyncmap 0 auth crtscts lock hide-password modem debug name xl2tpd proxyarp lcp-echo-interval 30 lcp-echo-failure 4 mtu 1410 mru 1410 connect-delay 50 EOF
添加 VPN 用户
cat >>/etc/ppp/chap-secrets<<EOF test * test * EOF
[wp_ad_camp_3]
包转发及iptables设置在前面已经设置好(见OpenVPN配置页面中关于iptables的配置)
重启xl2tpd
/etc/init.d/xl2tpd restart
注意:Strongswan需要单独运行ipsec命令来启动服务,安装strongswan后,以root用户执行
ipsec
命令,即可启动strongswan. 试用
ipsec statusall
郑重声明:本站内容如果来自互联网及其他传播媒体,其版权均属原媒体及文章作者所有。转载目的在于传递更多信息及用于网络分享,并不代表本站赞同其观点和对其真实性负责,也不构成任何其他建议。