i版本vpn的功能配置后不生效
浏览数：68 /
时间：2015年06月20日
i版本vpn的功能配置后不生效(centos 6.5)，ipsec verify显示：
[root@network-174 ~]# ipsec verify
Checking your system to see if IPsec got installed and started correctly:
Version check and ipsec on-path [OK]
Linux Openswan U2.6.32/K(no kernel code presently loaded)
Checking for IPsec support in kernel [FAILED]
SAref kernel support [N/A]
Testing against enforced SElinux mode [OK]
Checking that pluto is running [FAILED]
whack: Pluto is not running (no "/var/run/pluto/pluto.ctl")
Two or more interfaces found, checking IP forwarding [FAILED]
whack: Pluto is not running (no "/var/run/pluto/pluto.ctl")
Checking NAT and MASQUERADEing [OK]
Checking for ‘ip‘ command [OK]
Checking /bin/sh is not /bin/dash [OK]
Checking for ‘iptables‘ command [OK]
Opportunistic Encryption Support [DISABLED]
其中第二个failed只要启动了ipsec服务就可以解决：
/etc/init.d/ipsec start
NETKEY: Testing for disabled ICMP send_redirects [FAILED]
Please disable /proc/sys/net/ipv4/conf/*/send_redirects
or NETKEY will cause the sending of bogus ICMP redirects!
NETKEY detected, testing for disabled ICMP accept_redirects [FAILED]
Please disable /proc/sys/net/ipv4/conf/*/accept_redirects
or NETKEY will accept bogus ICMP redirects!
之后出现这个failed，解决办法：
for each in /proc/sys/net/ipv4/conf/*
do
echo 0 > $each/accept_redirects
echo 0 > $each/send_redirects
done
ipsec verify
Checking your system to see if IPsec got installed and started correctly:
Version check and ipsec on-path [OK]
Linux Openswan U2.6.32/K2.6.32-431.el6.x86_64 (netkey)
Checking for IPsec support in kernel [OK]
SAref kernel support [N/A]
NETKEY: Testing for disabled ICMP send_redirects [OK]
NETKEY detected, testing for disabled ICMP accept_redirects [OK]
Testing against enforced SElinux mode [OK]
Checking that pluto is running [OK]
Pluto listening for IKE on udp 500 [OK]
Pluto listening for NAT-T on udp 4500 [OK]
Two or more interfaces found, checking IP forwarding [OK]
Checking NAT and MASQUERADEing [OK]
Checking for ‘ip‘ command [OK]
Checking /bin/sh is not /bin/dash [OK]
Checking for ‘iptables‘ command [OK]
Opportunistic Encryption Support [DISABLED]
[root@network-201 ~]#
还有需要开启ip_forward功能。
之后vpn功能生效。
但是目前i版本还有3个bug需要解决：
1.创建防火墙后，在创建vpn，会在router的iptables中的vpn链中加入防火墙规则，但是如果删掉防火墙后，该规则被没有在vpn中删除，导致网络不通。
2.删除vpn后，router中的iptables规则的vpn链中对应的规则并没有删除。
以上两个问题都只有在重启了l3和vpn服务后才会删除。
3.每次创建一个vpn都会把以前的vpn进程重启，但是由于没有删除其pid文件，导致该进程无法启动。也就是说创建一个新的vpn，会影响之前创建的vpn。
郑重声明：本站内容如果来自互联网及其他传播媒体，其版权均属原媒体及文章作者所有。转载目的在于传递更多信息及用于网络分享，并不代表本站赞同其观点和对其真实性负责，也不构成任何其他建议。
