正文
CentOS6.5部署L2TP over IPSec
提示：扫一扫查出行【扫一扫了解最新限行尾号】
复制提示
一、环境介绍：
1、CentOS 6.5 （要求双网卡做软路由，如果只是做VPN可以单网卡）
a、外网IP：192.168.0.133/ b、内网IP：10.10.10.1/
2、Window 10 主机一台做为一台内网测试软路由使用；
a、内网IP：10.10.10.10/
二、开始前的网络测试：
1、CentOS 6.5（以下简称VPN-Server）测试：
a、测试外网网络是否联通；
# ping www.baidu.com
b、测试内网网络：
# ping 10.10.10.10
2、Windows 10 （以下简称Client）测试：
a、测试是否可以联通VPN-Server:
# ping 10.10.10.1
b、测试是否可以上网（现在不能上网）：
# ping www.baidu.com
三、开始安装部署：
以下操作在VPN-Server上操作：
1、安装epel源：
# cd /etc/yum.repos.d/ # wget http://mirrors.163.com/.help/CentOS6-Base-163.repo # yum -y install epel-release
2、安装必须的软件（openswan、ppp、xl2tpd)；
openswan：提供IPSec加密
ppp：提供密码认证
xl2tpd：提供VPN服务
# yum -y install openswan ppp xl2tpd
3、修改ipsec的配置文件：
# cd /etc/ipsec.d/
# ls ./*.conf|xargs -I {} mv {} {}.bak
# vim L2TP.conf conn L2TP-PSK-NAT
rightsubnet=vhost:%priv
also=L2TP-PSK-noNAT conn L2TP-PSK-noNAT
authby=secret
pfs=no
auto=add
keyingtries=3
rekey=no
ikelifetime=8h
keylife=1h
type=transport
left=192.168.0.133
leftprotoport=17/1701
right=%any
rightprotoport=17/%any
4、配置ipsec的密钥：
# vim /etc/ipsec.d/L2TP.secrets 192.168.0.133 %any: PSK "YourPsk"
注：IP为你的服务器外网IP，“YourPsk”修改为你想要的密钥
5、修改Forward转发：
# vim /etc/sysctl.conf net.ipv4.ip_forward =
net.ipv4.conf.default.rp_filter =
net.ipv4.conf.all.send_redirects =
net.ipv4.conf.default.send_redirects =
net.ipv4.conf.all.log_martians =
net.ipv4.conf.default.log_martians =
net.ipv4.conf.default.accept_source_route =
net.ipv4.conf.all.accept_redirects =
net.ipv4.conf.default.accept_redirects =
net.ipv4.icmp_ignore_bogus_error_responses = 1 # sysctl -p
6、验证ipsec的运行状态
# service ipsec start
# ipsec verify
Checking your system to see if IPsec got installed and started correctly:
Version check and ipsec on-path [OK]
Linux Openswan U2.6.32/K2.6.32-431.el6.x86_64 (netkey)
Checking for IPsec support in kernel [OK]
SAref kernel support [N/A]
NETKEY: Testing for disabled ICMP send_redirects [OK]
NETKEY detected, testing for disabled ICMP accept_redirects [OK]
Checking that pluto is running [OK]
Pluto listening for IKE on udp 500 [OK]
Pluto listening for NAT-T on udp 4500 [OK]
Checking for 'ip' command [OK]
Checking /bin/sh is not /bin/dash [OK]
Checking for 'iptables' command [OK]
Opportunistic Encryption Support [DISABLED]
注：只要没有Faild就可以了
7、编辑/etc/xl2tpd/xl2tpd.conf
# vim /etc/xl2tpd/xl2tpd.conf
[global]
ipsec saref = yes
listen-addr = 192.168.0.133
[lns default]
ip range = 10.10.10.100-10.10.10.200
local ip = 10.10.10.1
refuse chap = yes
refuse pap = yes
require authentication = yes
ppp debug = yes
pppoptfile = /etc/ppp/options.xl2tpd
length bit = y
8、编辑 /etc/ppp/options.xl2tpd
# vim /etc/ppp/options.xl2tpd
require-mschap-v2
ms-dns 223.5.5.5
ms-dns 114.114.114.114
asyncmap 0
auth
crtscts
lock
hide-password
modem
debug
name l2tpd
proxyarp
lcp-echo-interval 30
lcp-echo-failure 4
8、编辑 /etc/ppp/chap-secrets （此配置文件是设置VPN的用户名,密码）
# vim /etc/ppp/chap-secrets
# Secrets for authentication using CHAP
# client server secret IP addresses
admin * admin *
9、启动相应的服务：
# service xl2tpd start
# service ipsec start
10、iptables修改：
# iptables -A FORWARD -s 10.0.0.0/ -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j TCPMSS --set-mss 1356
# iptables -t nat -A POSTROUTING -s 10.0.0.0/8 -j SNAT --to-source 192.168.0.133
# iptables -I INPUT -p udp -m udp -m state --state NEW --dport 1701 -j ACCEPT
# iptables -I INPUT -p udp -m udp -m state --state NEW --dport 500 -j ACCEPT
# iptables -I INPUT -p udp -m udp -m state --state NEW --dport 500 -j ACCEPT
# iptables -I INPUT -p esp -j ACCEPT
# /etc/init.d/iptables save
# /etc/init.d/iptables restart
修改后的iptables 例子：
# Generated by iptables-save v1.4.7 on Tue Jan ::
*filter
:INPUT ACCEPT [:]
:FORWARD ACCEPT [:]
:OUTPUT ACCEPT [:]
-A INPUT -p esp -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p udp -m udp --dport -m state --state NEW -j ACCEPT
-A INPUT -p udp -m udp --dport -m state --state NEW -j ACCEPT
-A INPUT -p udp -m udp --dport -m state --state NEW -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -s 10.0.0.0/ -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j TCPMSS --set-mss
COMMIT
# Completed on Tue Jan ::
# Generated by iptables-save v1.4.7 on Tue Jan ::
*nat
:PREROUTING ACCEPT [:]
:POSTROUTING ACCEPT [:]
:OUTPUT ACCEPT [:]
-A POSTROUTING -s 10.0.0.0/ -j SNAT --to-source 192.168.0.133
COMMIT
# Completed on Tue Jan ::
到此VPN-Server的部署已经全部完成；可以在Client机器上测试是否可以上网，然后在其它要中拨号试下是否成功！
