配置L2TP IPsec VPN (CentOS 6.5)

提示：扫一扫查出行
【扫一扫了解最新限行尾号】
复制提示

1. 安装相关包

yum install -y ppp iptables make gcc gmp-devel xmlto bison flex libpcap-devel lsof vim-enhanced

2. 下载和安装Openswan

https://download.openswan.org/openswan/old/openswan-2.6/openswan-2.6.38.tar.gz

进入解压后的目录，

make programs install

3. 安装xl2tpd

https://download.openswan.org/xl2tpd/old/xl2tpd-1.2.4.tar.gz

4. 配置

(1) /etc/ipsec.conf

config setup nat_traversal=yes virtual_private=%v4:,%v4:,%v4: oe=off protostack=netkeyconn L2TP-PSK-NAT rightsubnet=vhost:%priv also=L2TP-PSK-noNATconn L2TP-PSK-noNAT authby=secret pfs=no auto=add keyingtries= rekey=no ikelifetime=8h keylife=1h type=transport left=$tmpip leftid=$tmpip leftprotoport=/ right=%any rightid=%any rightprotoport=/%any

(2) /etc/sysctl.conf

net.ipv4.ip_forward =net.ipv4.conf.default.rp_filter = 0

刷新配置

sysctl -p

(3) /etc/xl2tpd/xl2tpd.conf

[global]ipsec saref = yes[lns default]ip range = $iprange.-$iprange.local ip = $iprange.refuse chap = yesrefuse pap = yesrequire authentication = yesppp debug = yespppoptfile = /etc/ppp/options.xl2tpdlength bit = yes

(4) /etc/ppp/options.xl2tpd

require-mschap-v2ms-dns 8.8.8.8ms-dns 8.8.4.4asyncmapauthcrtsctslockhide-passwordmodemdebugname l2tpdproxyarplcp-lcp-

(5) /etc/ppp/chap-secrets

密码文件，格式1行1个用户，{username} * {password} *

client1 * *

(6) ipsec的服务密码

/etc/ipsec.secrets，在最下方添加

47.70.19.19 %any: PSK "serverPassword"

(7) /etc/sysconfig/iptables

*nat:PREROUTING ACCEPT [:]:POSTROUTING ACCEPT [:]:OUTPUT ACCEPT [:]-A POSTROUTING -s -j MASQUERADE-A POSTROUTING -s -j MASQUERADE-A POSTROUTING -s -j MASQUERADECOMMIT

(8)

touch /usr/bin/l2tpsetecho "#/bin/bash" >>/usr/bin/l2tpsetecho "for each in /proc/sys/net/ipv4/conf/*" >>/usr/bin/l2tpsetecho "do" >>/usr/bin/l2tpsetecho "echo 0 > \$each/accept_redirects" >>/usr/bin/l2tpsetecho "echo 0 > \$each/send_redirects" >>/usr/bin/l2tpsetecho "done" >>/usr/bin/l2tpsetchmod +x /usr/bin/l2tpset

5. 启动服务

service iptables restartservice ipsec restart/usr/bin/l2tpset/usr/local/sbin/xl2tpd

6. 验证配置

ipsec verify