CentOS7部署l2tp/IPsec服务

时间：2023-03-09 13:09:49
CentOS7部署l2tp/IPsec服务

1、安装必要的工具

yum install vim net-tools wget unzip -y

2. 下载安装脚本

wget -O StackScript.zip http://files.cnblogs.com/files/think8848/StackScript.zip

3. 解压文件

unzip StackScript.zip

4. 执行安装文件

chmod +x StackScript

./StackScript

StackScript实际上市判断你的系统版本，然后下载安装脚本执行安装，centos安装的脚本如下：

#!/bin/sh

#

# Script for automatic setup of an IPsec VPN server on CentOS/RHEL 6 and 7.

# Works on any dedicated server or virtual private server (VPS) except OpenVZ.

#

# DO NOT RUN THIS SCRIPT ON YOUR PC OR MAC!

#

# The latest version of this script is available at:

# https://github.com/hwdsl2/setup-ipsec-vpn

#

# Copyright (C) 2015-2017 Lin Song <linsongui@gmail.com>

# Based on the work of Thomas Sarlandie (Copyright 2012)

#

# This work is licensed under the Creative Commons Attribution-ShareAlike 3.0

# Unported License: http://creativecommons.org/licenses/by-sa/3.0/

#

# Attribution required: please include my name in any derivative and let me

# know how you have improved it!

# =====================================================

# Define your own values for these variables

# - IPsec pre-shared key, VPN username and password

# - All values MUST be placed inside 'single quotes'

# - DO NOT use these special characters within values: \ " '

YOUR_IPSEC_PSK=''

YOUR_USERNAME=''

YOUR_PASSWORD=''

# Important notes:   https://git.io/vpnnotes

# Setup VPN clients: https://git.io/vpnclients

# =====================================================

export PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"

SYS_DT="$(date +%F-%T)"

exiterr()  { echo "Error: $1" >&2; exit 1; }

exiterr2() { exiterr "'yum install' failed."; }

conf_bk() { /bin/cp -f "$1" "$1.old-$SYS_DT" 2>/dev/null; }

bigecho() { echo; echo "## $1"; echo; }

check_ip() {

  IP_REGEX='^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$'

  printf '%s' "$1" | tr -d '\n' | grep -Eq "$IP_REGEX"

}

vpnsetup() {

if ! grep -qs -e "release 6" -e "release 7" /etc/redhat-release; then

  exiterr "This script only supports CentOS/RHEL 6 and 7."

fi

if [ -f /proc/user_beancounters ]; then

  exiterr "OpenVZ VPS is not supported. Try OpenVPN: github.com/Nyr/openvpn-install"

fi

if [ "$(id -u)" != 0 ]; then

  exiterr "Script must be run as root. Try 'sudo sh $0'"

fi

net_iface=${VPN_NET_IFACE:-'eth0'}

def_iface="$(route 2>/dev/null | grep '^default' | grep -o '[^ ]*$')"

[ -z "$def_iface" ] && def_iface="$(ip -4 route list 0/0 2>/dev/null | grep -Po '(?<=dev )(\S+)')"

def_iface_state=$(cat "/sys/class/net/$def_iface/operstate" 2>/dev/null)

if [ -n "$def_iface_state" ] && [ "$def_iface_state" != "down" ]; then

  if ! grep -qs raspbian /etc/os-release; then

    case "$def_iface" in

      wl*)

        exiterr "Wireless interface '$def_iface' detected. DO NOT run this script on your PC or Mac!"

        ;;

    esac

  fi

  net_iface="$def_iface"

fi

net_iface_state=$(cat "/sys/class/net/$net_iface/operstate" 2>/dev/null)

if [ -z "$net_iface_state" ] || [ "$net_iface_state" = "down" ] || [ "$net_iface" = "lo" ]; then

  printf "Error: Network interface '%s' is not available.\n" "$net_iface" >&2

  if [ -z "$VPN_NET_IFACE" ]; then

cat 1>&2 <<EOF

Unable to detect the default network interface. Manually re-run this script with:

  sudo VPN_NET_IFACE="your_default_interface_name" sh "$0"

EOF

  fi

  exit 1

fi

[ -n "$YOUR_IPSEC_PSK" ] && VPN_IPSEC_PSK="$YOUR_IPSEC_PSK"

[ -n "$YOUR_USERNAME" ] && VPN_USER="$YOUR_USERNAME"

[ -n "$YOUR_PASSWORD" ] && VPN_PASSWORD="$YOUR_PASSWORD"

if [ -z "$VPN_IPSEC_PSK" ] && [ -z "$VPN_USER" ] && [ -z "$VPN_PASSWORD" ]; then

  bigecho "VPN credentials not set by user. Generating random PSK and password..."

  VPN_IPSEC_PSK="$(LC_CTYPE=C tr -dc 'A-HJ-NPR-Za-km-z2-9' < /dev/urandom | head -c 16)"

  VPN_USER=vpnuser

  VPN_PASSWORD="$(LC_CTYPE=C tr -dc 'A-HJ-NPR-Za-km-z2-9' < /dev/urandom | head -c 16)"

fi

if [ -z "$VPN_IPSEC_PSK" ] || [ -z "$VPN_USER" ] || [ -z "$VPN_PASSWORD" ]; then

  exiterr "All VPN credentials must be specified. Edit the script and re-enter them."

fi

if printf '%s' "$VPN_IPSEC_PSK $VPN_USER $VPN_PASSWORD" | LC_ALL=C grep -q '[^ -~]\+'; then

  exiterr "VPN credentials must not contain non-ASCII characters."

fi

case "$VPN_IPSEC_PSK $VPN_USER $VPN_PASSWORD" in

  *[\\\"\']*)

    exiterr "VPN credentials must not contain these special characters: \\ \" '"

    ;;

esac

bigecho "VPN setup in progress... Please be patient."

# Create and change to working dir

mkdir -p /opt/src

cd /opt/src || exiterr "Cannot enter /opt/src."

bigecho "Installing packages required for setup..."

yum -y install wget bind-utils openssl \

  iproute gawk grep sed net-tools || exiterr2

bigecho "Trying to auto discover IP of this server..."

cat <<'EOF'

In case the script hangs here for more than a few minutes,

press Ctrl-C to abort. Then edit it and manually enter IP.

EOF

# In case auto IP discovery fails, enter server's public IP here.

PUBLIC_IP=${VPN_PUBLIC_IP:-''}

# Try to auto discover IP of this server

[ -z "$PUBLIC_IP" ] && PUBLIC_IP=$(dig @resolver1.opendns.com -t A -4 myip.opendns.com +short)

# Check IP for correct format

check_ip "$PUBLIC_IP" || PUBLIC_IP=$(wget -t 3 -T 15 -qO- http://ipv4.icanhazip.com)

check_ip "$PUBLIC_IP" || exiterr "Cannot detect this server's public IP. Edit the script and manually enter it."

bigecho "Adding the EPEL repository..."

epel_url="https://dl.fedoraproject.org/pub/epel/epel-release-latest-$(rpm -E '%{rhel}').noarch.rpm"

yum -y install epel-release || yum -y install "$epel_url" || exiterr2

bigecho "Installing packages required for the VPN..."

yum -y install nss-devel nspr-devel pkgconfig pam-devel \

  libcap-ng-devel libselinux-devel curl-devel \

  flex bison gcc make ppp xl2tpd || exiterr2

OPT1='--enablerepo=*server-optional*'

OPT2='--enablerepo=*releases-optional*'

if grep -qs "release 6" /etc/redhat-release; then

  yum -y remove libevent-devel

  yum "$OPT1" "$OPT2" -y install libevent2-devel fipscheck-devel || exiterr2

else

  yum -y install systemd-devel iptables-services || exiterr2

  yum "$OPT1" "$OPT2" -y install libevent-devel fipscheck-devel || exiterr2

fi

bigecho "Installing Fail2Ban to protect SSH..."

yum -y install fail2ban || exiterr2

bigecho "Compiling and installing Libreswan..."

SWAN_VER=3.22

swan_file="libreswan-$SWAN_VER.tar.gz"

swan_url1="https://github.com/libreswan/libreswan/archive/v$SWAN_VER.tar.gz"

swan_url2="https://download.libreswan.org/$swan_file"

if ! { wget -t 3 -T 30 -nv -O "$swan_file" "$swan_url1" || wget -t 3 -T 30 -nv -O "$swan_file" "$swan_url2"; }; then

  exiterr "Cannot download Libreswan source."

fi

/bin/rm -rf "/opt/src/libreswan-$SWAN_VER"

tar xzf "$swan_file" && /bin/rm -f "$swan_file"

cd "libreswan-$SWAN_VER" || exiterr "Cannot enter Libreswan source dir."

[ "$SWAN_VER" = "3.22" ] && sed -i '/^#define LSWBUF_CANARY/s/-2$/((char) -2)/' include/lswlog.h

cat > Makefile.inc.local <<'EOF'

WERROR_CFLAGS =

USE_DNSSEC = false

EOF

NPROCS="$(grep -c ^processor /proc/cpuinfo)"

[ -z "$NPROCS" ] && NPROCS=1

make "-j$((NPROCS+1))" -s base && make -s install-base

# Verify the install and clean up

cd /opt/src || exiterr "Cannot enter /opt/src."

/bin/rm -rf "/opt/src/libreswan-$SWAN_VER"

if ! /usr/local/sbin/ipsec --version 2>/dev/null | grep -qF "$SWAN_VER"; then

  exiterr "Libreswan $SWAN_VER failed to build."

fi

bigecho "Creating VPN configuration..."

L2TP_NET=${VPN_L2TP_NET:-'192.168.42.0/24'}

L2TP_LOCAL=${VPN_L2TP_LOCAL:-'192.168.42.1'}

L2TP_POOL=${VPN_L2TP_POOL:-'192.168.42.10-192.168.42.250'}

XAUTH_NET=${VPN_XAUTH_NET:-'192.168.43.0/24'}

XAUTH_POOL=${VPN_XAUTH_POOL:-'192.168.43.10-192.168.43.250'}

DNS_SRV1=${VPN_DNS_SRV1:-'8.8.8.8'}

DNS_SRV2=${VPN_DNS_SRV2:-'8.8.4.4'}

# Create IPsec (Libreswan) config

conf_bk "/etc/ipsec.conf"

cat > /etc/ipsec.conf <<EOF

version 2.0

config setup

  virtual-private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:!$L2TP_NET,%v4:!$XAUTH_NET

  protostack=netkey

  interfaces=%defaultroute

  uniqueids=no

conn shared

  left=%defaultroute

  leftid=$PUBLIC_IP

  right=%any

  encapsulation=yes

  authby=secret

  pfs=no

  rekey=no

  keyingtries=5

  dpddelay=30

  dpdtimeout=120

  dpdaction=clear

  ike=3des-sha1,3des-sha2,aes-sha1,aes-sha1;modp1024,aes-sha2,aes-sha2;modp1024,aes256-sha2_512

  phase2alg=3des-sha1,3des-sha2,aes-sha1,aes-sha2,aes256-sha2_512

  sha2-truncbug=yes

conn l2tp-psk

  auto=add

  leftprotoport=17/1701

  rightprotoport=17/%any

  type=transport

  phase2=esp

  also=shared

conn xauth-psk

  auto=add

  leftsubnet=0.0.0.0/0

  rightaddresspool=$XAUTH_POOL

  modecfgdns1=$DNS_SRV1

  modecfgdns2=$DNS_SRV2

  leftxauthserver=yes

  rightxauthclient=yes

  leftmodecfgserver=yes

  rightmodecfgclient=yes

  modecfgpull=yes

  xauthby=file

  ike-frag=yes

  ikev2=never

  cisco-unity=yes

  also=shared

EOF

# Specify IPsec PSK

conf_bk "/etc/ipsec.secrets"

cat > /etc/ipsec.secrets <<EOF

%any  %any  : PSK "$VPN_IPSEC_PSK"

EOF

# Create xl2tpd config

conf_bk "/etc/xl2tpd/xl2tpd.conf"

cat > /etc/xl2tpd/xl2tpd.conf <<EOF

[global]

port = 1701

[lns default]

ip range = $L2TP_POOL

local ip = $L2TP_LOCAL

require chap = yes

refuse pap = yes

require authentication = yes

name = l2tpd

pppoptfile = /etc/ppp/options.xl2tpd

length bit = yes

EOF

# Set xl2tpd options

conf_bk "/etc/ppp/options.xl2tpd"

cat > /etc/ppp/options.xl2tpd <<EOF

+mschap-v2

ipcp-accept-local

ipcp-accept-remote

ms-dns $DNS_SRV1

ms-dns $DNS_SRV2

noccp

auth

mtu 1280

mru 1280

proxyarp

lcp-echo-failure 4

lcp-echo-interval 30

connect-delay 5000

EOF

# Create VPN credentials

conf_bk "/etc/ppp/chap-secrets"

cat > /etc/ppp/chap-secrets <<EOF

"$VPN_USER" l2tpd "$VPN_PASSWORD" *

EOF

conf_bk "/etc/ipsec.d/passwd"

VPN_PASSWORD_ENC=$(openssl passwd -1 "$VPN_PASSWORD")

cat > /etc/ipsec.d/passwd <<EOF

$VPN_USER:$VPN_PASSWORD_ENC:xauth-psk

EOF

bigecho "Updating sysctl settings..."

if ! grep -qs "hwdsl2 VPN script" /etc/sysctl.conf; then

  conf_bk "/etc/sysctl.conf"

  if [ "$(getconf LONG_BIT)" = "64" ]; then

    SHM_MAX=68719476736

    SHM_ALL=4294967296

  else

    SHM_MAX=4294967295

    SHM_ALL=268435456

  fi

cat >> /etc/sysctl.conf <<EOF

# Added by hwdsl2 VPN script

kernel.msgmnb = 65536

kernel.msgmax = 65536

kernel.shmmax = $SHM_MAX

kernel.shmall = $SHM_ALL

net.ipv4.ip_forward = 1

net.ipv4.conf.all.accept_source_route = 0

net.ipv4.conf.all.accept_redirects = 0

net.ipv4.conf.all.send_redirects = 0

net.ipv4.conf.all.rp_filter = 0

net.ipv4.conf.default.accept_source_route = 0

net.ipv4.conf.default.accept_redirects = 0

net.ipv4.conf.default.send_redirects = 0

net.ipv4.conf.default.rp_filter = 0

net.ipv4.conf.$net_iface.send_redirects = 0

net.ipv4.conf.$net_iface.rp_filter = 0

net.core.wmem_max = 12582912

net.core.rmem_max = 12582912

net.ipv4.tcp_rmem = 10240 87380 12582912

net.ipv4.tcp_wmem = 10240 87380 12582912

EOF

fi

bigecho "Updating IPTables rules..."

# Check if IPTables rules need updating

ipt_flag=0

IPT_FILE="/etc/sysconfig/iptables"

if ! grep -qs "hwdsl2 VPN script" "$IPT_FILE" \

   || ! iptables -t nat -C POSTROUTING -s "$L2TP_NET" -o "$net_iface" -j MASQUERADE 2>/dev/null \

   || ! iptables -t nat -C POSTROUTING -s "$XAUTH_NET" -o "$net_iface" -m policy --dir out --pol none -j MASQUERADE 2>/dev/null; then

  ipt_flag=1

fi

# Add IPTables rules for VPN

if [ "$ipt_flag" = "1" ]; then

  service fail2ban stop >/dev/null 2>&1

  iptables-save > "$IPT_FILE.old-$SYS_DT"

  iptables -I INPUT 1 -p udp --dport 1701 -m policy --dir in --pol none -j DROP

  iptables -I INPUT 2 -m conntrack --ctstate INVALID -j DROP

  iptables -I INPUT 3 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

  iptables -I INPUT 4 -p udp -m multiport --dports 500,4500 -j ACCEPT

  iptables -I INPUT 5 -p udp --dport 1701 -m policy --dir in --pol ipsec -j ACCEPT

  iptables -I INPUT 6 -p udp --dport 1701 -j DROP

  iptables -I FORWARD 1 -m conntrack --ctstate INVALID -j DROP

  iptables -I FORWARD 2 -i "$net_iface" -o ppp+ -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

  iptables -I FORWARD 3 -i ppp+ -o "$net_iface" -j ACCEPT

  iptables -I FORWARD 4 -i ppp+ -o ppp+ -s "$L2TP_NET" -d "$L2TP_NET" -j ACCEPT

  iptables -I FORWARD 5 -i "$net_iface" -d "$XAUTH_NET" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

  iptables -I FORWARD 6 -s "$XAUTH_NET" -o "$net_iface" -j ACCEPT

  # Uncomment if you wish to disallow traffic between VPN clients themselves

  # iptables -I FORWARD 2 -i ppp+ -o ppp+ -s "$L2TP_NET" -d "$L2TP_NET" -j DROP

  # iptables -I FORWARD 3 -s "$XAUTH_NET" -d "$XAUTH_NET" -j DROP

  iptables -A FORWARD -j DROP

  iptables -t nat -I POSTROUTING -s "$XAUTH_NET" -o "$net_iface" -m policy --dir out --pol none -j MASQUERADE

  iptables -t nat -I POSTROUTING -s "$L2TP_NET" -o "$net_iface" -j MASQUERADE

  echo "# Modified by hwdsl2 VPN script" > "$IPT_FILE"

  iptables-save >> "$IPT_FILE"

fi

bigecho "Creating basic Fail2Ban rules..."

if [ ! -f /etc/fail2ban/jail.local ] ; then

cat > /etc/fail2ban/jail.local <<'EOF'

[ssh-iptables]

enabled  = true

filter   = sshd

action   = iptables[name=SSH, port=ssh, protocol=tcp]

logpath  = /var/log/secure

EOF

fi

bigecho "Enabling services on boot..."

if grep -qs "release 6" /etc/redhat-release; then

  chkconfig iptables on

  chkconfig fail2ban on

else

  systemctl --now mask firewalld 2>/dev/null

  systemctl enable iptables fail2ban 2>/dev/null

fi

if ! grep -qs "hwdsl2 VPN script" /etc/rc.local; then

  if [ -f /etc/rc.local ]; then

    conf_bk "/etc/rc.local"

  else

    echo '#!/bin/sh' > /etc/rc.local

  fi

cat >> /etc/rc.local <<'EOF'

# Added by hwdsl2 VPN script

(sleep 15

modprobe -q pppol2tp

service ipsec restart

service xl2tpd restart

echo 1 > /proc/sys/net/ipv4/ip_forward)&

EOF

fi

bigecho "Starting services..."

# Restore SELinux contexts

restorecon /etc/ipsec.d/*db 2>/dev/null

restorecon /usr/local/sbin -Rv 2>/dev/null

restorecon /usr/local/libexec/ipsec -Rv 2>/dev/null

# Reload sysctl.conf

sysctl -e -q -p

# Update file attributes

chmod +x /etc/rc.local

chmod 600 /etc/ipsec.secrets* /etc/ppp/chap-secrets* /etc/ipsec.d/passwd*

# Apply new IPTables rules

iptables-restore < "$IPT_FILE"

# Fix xl2tpd on CentOS 7, if kernel module "l2tp_ppp" is unavailable

if grep -qs "release 7" /etc/redhat-release; then

  if ! modprobe -q l2tp_ppp; then

    sed -i '/^ExecStartPre/s/^/#/' /usr/lib/systemd/system/xl2tpd.service

    systemctl daemon-reload

  fi

fi

# Restart services

modprobe -q pppol2tp

service fail2ban restart 2>/dev/null

service ipsec restart 2>/dev/null

service xl2tpd restart 2>/dev/null

cat <<EOF

================================================

IPsec VPN server is now ready for use!

Connect to your new VPN with these details:

Server IP: $PUBLIC_IP

IPsec PSK: $VPN_IPSEC_PSK

Username: $VPN_USER

Password: $VPN_PASSWORD

Write these down. You'll need them to connect!

Important notes:   https://git.io/vpnnotes

Setup VPN clients: https://git.io/vpnclients

================================================

EOF

}

## Defer setup until we have the complete script

vpnsetup "$@"

exit 0

5、安装完，会打印Server IP, IPseck PSK, Username, Password信息，我们可以换成自己配置的

//先修改PSK，将PSK后面的字符替换掉

    vim /etc/ipsec.secrets

// 修改用户名和密码 ，将用户名和密码修改为自已想要的字符

    vim /etc/ppp/chap-secrets

//重启IPsec和xl2tpd服务

    systemctl restart ipsec xl2tpd

6、现在可以尝试连接vpn了，连接方法如下：

　　win10 and win8

右键单击系统托盘中的无线/网络图标。

选择打开网络和共享中心。

点击设置一个新的连接或网络。

选择连接到工作区，然后单击下一步。

单击使用我的Internet连接（VPN）。

Your VPN Server IP在Internet地址栏中输入。

在目的地名称字段中输入任何你喜欢的，然后点击创建。

返回到网络和共享中心。在左侧，点击更改适配器设置。

右键单击新的VPN条目，然后选择“ 属性”。

单击安全选项卡。选择“使用IPsec的第2层隧道协议（L2TP / IPSec）”作为VPN的类型。

点击允许这些协议。一定要选择“挑战握手认证协议（CHAP）”复选框。

点击高级设置按钮。

选择使用预共享密钥进行验证，并输入Your VPN IPsec PSK的关键。

单击确定关闭高级设置。

单击确定以保存VPN连接详细信息。

　　win7，vista和xp

点击开始菜单并进入控制面板。

转到网络和Internet部分。

点击网络和共享中心。

点击设置一个新的连接或网络。

选择连接到工作区，然后单击下一步。

单击使用我的Internet连接（VPN）。

Your VPN Server IP在Internet地址栏中输入。

在目的地名称字段中输入任何你喜欢的东西。

检查现在不要连接; 只需设置它，以便以后可以连接复选框。

点击下一步。

Your VPN Username在用户名字段中输入。

Your VPN Password在密码字段中输入。

选中记住此密码复选框。

点击创建，然后关闭。

返回到网络和共享中心。在左侧，点击更改适配器设置。

右键单击新的VPN条目，然后选择“ 属性”。

单击选项选项卡，并取消选中包括Windows登录域。

单击安全选项卡。选择“使用IPsec的第2层隧道协议（L2TP / IPSec）”作为VPN的类型。

点击允许这些协议。一定要选择“挑战握手认证协议（CHAP）”复选框。

点击高级设置按钮。

选择使用预共享密钥进行验证，并输入Your VPN IPsec PSK的关键。

单击确定关闭高级设置。

单击确定以保存VPN连接详细信息。

　　注意：如果连接不上，需要更改注册表，点击查看详细

在cmd命令行执行

//对于Windows Vista，7，8.x和10

REG ADD HKLM\SYSTEM\CurrentControlSet\Services\PolicyAgent /v AssumeUDPEncapsulationContextOnSendRule /t REG_DWORD /d 0x2 /f

//仅适用于Windows XP

REG ADD HKLM\SYSTEM\CurrentControlSet\Services\IPSec /v AssumeUDPEncapsulationContextOnSendRule /t REG_DWORD /d 0x2 /f

//虽然不常见，但某些Windows系统禁用IPsec加密，导致连接失败。要重新启用它，请运行以下命令并重新启动您的PC

REG ADD HKLM\SYSTEM\CurrentControlSet\Services\RasMan\Parameters /v ProhibitIpSec /t REG_DWORD /d 0x0 /f

　　OS X

打开系统偏好设置并转到网络部分。

点击窗口左下角的+按钮。

从“ 接口”下拉菜单中选择“ VPN ” 。

从“ VPN类型”下拉菜单中选择“ IPSec上的L2TP”。

输入你喜欢的服务名称。

点击创建。

输入Your VPN Server IP的服务器地址。

输入Your VPN Username的帐户名称。

点击认证设置按钮。

在“ 用户验证”部分中，选择“ 密码”单选按钮并进入Your VPN Password。

在“ 机器验证”部分中，选择“ 共享机密”单选按钮并进入Your VPN IPsec PSK。

点击OK。

选中菜单栏中显示VPN状态复选框。

单击“ 高级”按钮，确保选中“ 发送所有通过VPN连接的通信”复选框。

单击“ TCP / IP”选项卡，并确保“ 配置IPv6”部分中的“ 仅限本地链接”。

单击确定关闭高级设置，然后单击应用以保存VPN连接信息。

　　Android

启动设置应用程序。

点击无线和网络部分中的更多...。

点击VPN。

点击添加VPN配置文件或屏幕右上方的+图标。

在名称字段中输入您喜欢的任何内容。

在类型下拉菜单中选择L2TP / IPSec PSK。

Your VPN Server IP在服务器地址栏中输入。

输入Your VPN IPsec PSK的预共享的IPSec密钥场。

点按保存。

点击新的VPN连接。

Your VPN Username在用户名字段中输入。

Your VPN Password在密码字段中输入。

选中保存帐户信息复选框。

点击连接。

　　ios

进入设置 - >常规 - > VPN。

点击添加VPN配置...。

点按类型。选择L2TP并返回。

点按“ 说明”，然后输入您喜欢

点击服务器并输入Your VPN Server IP。

点击帐户并输入Your VPN Username。

点击密码并输入Your VPN Password。

点击秘密并进入Your VPN IPsec PSK。

确保发送所有通信开关打开。

点按完成。

滑动VPN开关。

　　Linux

#####要设置VPN客户端，请首先安装以下软件包####

# Ubuntu & Debian

apt-get update

apt-get -y install strongswan xl2tpd

# CentOS & RHEL

yum -y install epel-release

yum -y install strongswan xl2tpd

# Fedora

yum -y install strongswan xl2tpd

#####创建VPN变量（用实际值替换）####

VPN_SERVER_IP='your_vpn_server_ip'

VPN_IPSEC_PSK='your_ipsec_pre_shared_key'

VPN_USER='your_vpn_username'

VPN_PASSWORD='your_vpn_password'

#####配置strongSwan#####

cat > /etc/ipsec.conf <<EOF

# ipsec.conf - strongSwan IPsec configuration file

# basic configuration

config setup

  # strictcrlpolicy=yes

  # uniqueids = no

# Add connections here.

# Sample VPN connections

conn %default

  ikelifetime=60m

  keylife=20m

  rekeymargin=3m

  keyingtries=1

  keyexchange=ikev1

  authby=secret

  ike=aes128-sha1-modp1024,3des-sha1-modp1024!

  esp=aes128-sha1-modp1024,3des-sha1-modp1024!

conn myvpn

  keyexchange=ikev1

  left=%defaultroute

  auto=add

  authby=secret

  type=transport

  leftprotoport=17/1701

  rightprotoport=17/1701

  right=$VPN_SERVER_IP

EOF

cat > /etc/ipsec.secrets <<EOF

: PSK "$VPN_IPSEC_PSK"

EOF

chmod 600 /etc/ipsec.secrets

# For CentOS/RHEL & Fedora ONLY

mv /etc/strongswan/ipsec.conf /etc/strongswan/ipsec.conf.old 2>/dev/null

mv /etc/strongswan/ipsec.secrets /etc/strongswan/ipsec.secrets.old 2>/dev/null

ln -s /etc/ipsec.conf /etc/strongswan/ipsec.conf

ln -s /etc/ipsec.secrets /etc/strongswan/ipsec.secrets

#####Configure xl2tpd#####

cat > /etc/xl2tpd/xl2tpd.conf <<EOF

[lac myvpn]

lns = $VPN_SERVER_IP

ppp debug = yes

pppoptfile = /etc/ppp/options.l2tpd.client

length bit = yes

EOF

cat > /etc/ppp/options.l2tpd.client <<EOF

ipcp-accept-local

ipcp-accept-remote

refuse-eap

require-chap

noccp

noauth

mtu 1280

mru 1280

noipdefault

defaultroute

usepeerdns

connect-delay 5000

name $VPN_USER

password $VPN_PASSWORD

EOF

chmod 600 /etc/ppp/options.l2tpd.client

VPN客户端设置现在完成。按照以下步骤进行连接。

注意：每次尝试连接到VPN时都必须重复以下所有步骤

###创建xl2tpd控制文件：###

mkdir -p /var/run/xl2tpd

touch /var/run/xl2tpd/l2tp-control

###重新启动服务###

service strongswan restart

service xl2tpd restart

###启动IPsec连接###

# Ubuntu & Debian

ipsec up myvpn

# CentOS/RHEL & Fedora

strongswan up myvpn

###启动L2TP连接###

echo "c myvpn" > /var/run/xl2tpd/l2tp-control

运行ifconfig并检查输出。你现在应该看到一个新的界面ppp0

检查您现有的默认路由

ip route

在输出中找到这一行：default via X.X.X.X ...。写下这个网关IP，用于下面的两个命令

从新的默认路由中排除您的VPN服务器的IP（用实际值替换）

route add YOUR_VPN_SERVER_IP gw X.X.X.X

如果您的VPN客户端是远程服务器，则还必须从新的默认路由中排除本地PC的公共IP，以防止您的SSH会话被断开（用实际值替换）：

route add YOUR_LOCAL_PC_PUBLIC_IP gw X.X.X.X

添加一个新的默认路由，以开始通过VPN服务器路由流量：

route add default dev ppp0

VPN连接现在完成。确认您的流量正在正确路由：

wget -qO- http://ipv4.icanhazip.com; echo

上述命令应该返回Your VPN Server IP

要通过VPN服务器停止路由流量

route del default dev ppp0

断开连接

# Ubuntu & Debian

echo "d myvpn" > /var/run/xl2tpd/l2tp-control

ipsec down myvpn

# CentOS/RHEL & Fedora

echo "d myvpn" > /var/run/xl2tpd/l2tp-control

strongswan down myvpn

7、这一个帐户明显不够用了，所以还是要找如何能多人共享方法，经过一阵折腾，终于找到方法了

1. 在 /etc/ppp/chap-secrets 中添加第二个用户，格式为： "username" l2tpd "password" * 

2. 执行 openssl passwd -1 "password" 得到一串MD5加密的字符串，如： $1$5NwpneO7$YD82DhVJxCQpQ4zahB1N01 

3. 复制这一段字符串到 /etc/ipsec.d/passwd 中，新行如下： username:$1$5NwpneO7$YD82DhVJxCQpQ4zahB1N01:xauth-psk ，红色是手工添加的。

4. systemctl restart ipsec xl2tpd

8、vpn使用的端口，注意开放

(注意是：udp):500， 4500， 1701

9、这个脚本安装vpn的时候会添加很多iptables的规则，然而我并没有用它的规则，因为进入文件/etc/sysconfig/iptables,把里面的内容删除了

，然后自己添加一条规则

iptables -t nat -A POSTROUTING -s 192.168.42.0/24 -o eth0 -j MASQUERADE

如果不添加这条规则，会导致客户端连接vpn 之后无法连接外网，加上后，客户单会通过vpn 服务器连接外网

CentOS7部署l2tp/IPsec服务

相关文章