Openstack(Juno)中VPNaaS的配置

 

vpnaas配置的资料很少,官网目前参考的https://wiki.openstack.org/wiki/Neutron/VPNaaS/HowToInstall比较旧,方面配置基本没有讲

经历漫长时间的查找资料、学习,现终于配置成功了,记录下来给大家参考一下,有什么不正确的地方及时留言

1. 配置

1.1 准备

yum install openstack-neutron-vpn-agent libreswan -y  

vi /etc/sysctl
net.ipv4.ip_forward=1
net.ipv4.conf.default.send_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv4.conf.default.rp_filter = 0


1.2添加vpn服务

vim /etc/neutron/neutron.conf
[DEFAULT]
service_plugins = router,vpnaas
[service_providers]
service_provider = VPN:Vpn:neutron.services.vpn.service_drivers.ipsec.IPsecVPNDriver:default

 1.3 配置vpnaas

vim /etc/neutron/vpn_agent.ini 
[DEFAULT]
# VPN-Agent configuration file
# Note vpn-agent inherits l3-agent, so you can use configs on l3-agent also
interface_driver = neutron.agent.linux.interface.OVSInterfaceDriver
[vpnagent]
vpn_device_driver=neutron.services.vpn.device_drivers.ipsec.OpenSwanDriver
[ipsec]
ipsec_status_check_interval=30
vi /usr/share/neutron/rootwrap/vpnaas.filters
[Filters]
ip: IpFilter, ip, root
ip_exec: IpNetnsExecFilter, ip, root
openswan: CommandFilter, ipsec, root
libreswan: CommandFilter, certutil, root

 1.4 dashboard启用vpn

vim /etc/openstack-dashboard/local_settings 

OPENSTACK_NEUTRON_NETWORK = {
        ‘enable_vpn‘: True,
        }

1.5 确认ipsec

#cat test.sh

for FILE in /proc/sys/net/ipv4/conf/*
    do
      echo 0 > $FILE/accept_redirects
      echo 0 > $FILE/rp_filter
    done

 

sh test.sh
service ipsec start ipsec verify

2 修改代码

2.1

vi /usr/lib/python2.7/site-packages/neutron/services/vpn/device_drivers/ipsec.py

97行添加 
        bcertutil = "certutil"
    114行添加 
        NSS_FILES = [
         ‘cert8.db‘,
         ‘key3.db‘,
         ‘secmod.db‘
     ]
    189行添加 
        def _ensure_nss(self, nss_files):
            if not os.path.isfile(nss_files):
                #start nss database
                self._execute([self.bcertutil,
                        ‘-N‘,
                        ‘--empty-password‘,
                        ‘-d‘, self.ipsecd_dir,
                        ])
    204行添加
        for nss_file in self.NSS_FILES:
             nss_path = os.path.join(self.ipsecd_dir, nss_file)
             self._ensure_nss(nss_path)
    327行添加
        self.ipsecd_dir = os.path.join(
             self.etc_dir, ‘ipsec.d‘)
    409、410行修改和删除
        修改 ‘--ipsecdir‘, self.etc_dir  成:  ‘--ipsecdir‘, self.ipsecd_dir
        删除 ‘--use-netkey‘,
    422行删除
        ‘--defaultroutenexthop‘, nexthop,
    470行添加
        pid_file = self.pid_path + ‘.pid‘
        if os.path.exists(pid_file):
            os.remove(pid_file)

2.2

vi /usr/lib/python2.7/site-packages/neutron/services/vpn/device_drivers/template/openswan/ipsec.conf.template

    3行删除:nat_traversal=yes
    7行删除:keylife=60m 添加:salifetime=60m
    20行删除:leftnexthop=%defaultroute
    31行删除:rightnexthop=%defaultroute
    63行删除:lifetime={{ipsec_site_connection.ipsecpolicy.lifetime_value}}s 添加:salifetime={{ipsec_site_connection.ipsecpolicy.lifetime_value}}s


3. 重启服务

systemctl enable neutron-vpn-agent
service neutron-vpn-agent start
重启neutron所有服务

4. 测试

    (10.1.0.0/24 - DevStack East)
              |
              |  10.1.0.1
     [Quantum Router]
              |  172.24.4.226
              |
              |  172.24.4.225
     [Internet GW]
              |  
              |
     [Internet GW]
              | 172.24.4.232
              |
              | 172.24.4.233
     [Quantum Router]
              |  10.2.0.1
              |
     (10.2.0.0/24 DevStack West)

openstack集群A(East)

    外网:flat
    网关:172.24.4.225
    路由(routerA)外网ip:172.24.4.226
    路由(routerA)内网ip:10.1.0.1
    子网(netA):10.1.0.0/24

openstack集群B(West)

    外网:flat
    网关:172.24.4.232
    路由(routerB)外网ip:172.24.4.233
    路由(routerB)内网ip:10.2.0.1
    子网(netB):10.2.0.0/24

在集群A分别执行下列命令,创建ike策略 ipsec策略 vpn服务 以及连接

     

neutron vpn-ikepolicy-create ikepolicy1
neutron vpn-ipsecpolicy-create ipsecpolicy1
neutron vpn-service-create --name myvpnA routerA netA
neutron ipsec-site-connection-create --name vpnconnectionA --vpnservice-id myvpnA --ikepolicy-id ikepolicy1 --ipsecpolicy-id ipsecpolicy1 --peer-address 172.24.4.233 --peer-id 172.24.4.233 --peer-cidr 10.2.0.0/24 --psk secret

在集群B分别执行下列命令,创建ike策略 ipsec策略 vpn服务 以及连接

neutron vpn-ikepolicy-create ikepolicy1
neutron vpn-ipsecpolicy-create ipsecpolicy1
neutron vpn-service-create --name myvpnB routerB netB
neutron ipsec-site-connection-create --name vpnconnectionB --vpnservice-id myvpn --ikepolicy-id ikepolicy1 --ipsecpolicy-id ipsecpolicy --peer-address 172.24.4.233 --peer-id 172.24.4.233 --peer-cidr 10.2.0.0/24 --psk secret

 

> peer-address 和peer-id 对写成对方router的外网ip地址即可

> peer-cidr写成对方路由保护的内网

> psk可以自定义,只要双方一致即可


接下来就是稍等片刻,connection的状态会由pending create 变成active


PS

在同一个集群中,创建两个用户网络和两个路由也可以进行测试
在测试vpn之前先确认两个子网上的vm可以ping通对方路由的外网ip,确认下vm是否可以访问外网

 

有问题及时留言

郑重声明:本站内容如果来自互联网及其他传播媒体,其版权均属原媒体及文章作者所有。转载目的在于传递更多信息及用于网络分享,并不代表本站赞同其观点和对其真实性负责,也不构成任何其他建议。