CentOS6.8搭建IPsecVPN

主要配置参考：

http://blog.51cto.com/cuixiang/1651027

苹果手机连不上参考：

https://2.botu.me/post/2994.html

服务器为阿里云香港ECS，安装系统为：CentOS6.8x64

一、安装及配置L2tpd服务器

#yum install openswan ppp xl2tpd

#vim /etc/ipsec.conf
config setup
    nat_traversal=yes
    virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12
    oe=off
    protostack=netkey
 
conn L2TP-PSK-NAT
    rightsubnet=vhost:%priv
    also=L2TP-PSK-noNAT
 
conn L2TP-PSK-noNAT
    authby=secret
    pfs=no
    auto=add
    keyingtries=3
    rekey=no
    ikelifetime=8h
    keylife=1h
    type=transport
    left=xx.xx.xx.xx 你的服务器公网IP
    leftprotoport=17/1701
    right=%any
    rightprotoport=17/%any

#vim /etc/ipsec.secrets
xx.xx.xx.xx %any: PSK "预留密码"

#vim /etc/sysctl.conf
添加如下内容：
net.ipv4.ip_forward = 1
net.ipv4.conf.default.rp_filter = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0
net.ipv4.conf.all.log_martians = 0
net.ipv4.conf.default.log_martians = 0
net.ipv4.conf.default.accept_source_route = 0
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv4.icmp_ignore_bogus_error_responses = 1

#sysctl -p

#service ipsec start
#ipsec verify

遇到这个错误：

Two or more interfaces found, checking IP forwarding [FAILED]

只要 cat /proc/sys/net/ipv4/ip_forward 返回结果是1就没事

#vim /etc/xl2tpd/xl2tpd.conf
修改如下内容：
[global]
ipsec saref = yes
listen-addr = xx.xx.xx.xx ;服务器公网IP
[lns default]
ip range = 172.16.0.2-172.16.0.100 ;这里是VPN client的内网ip地址范围
local ip = 172.16.0.1               ;这里是VPN server的内网地址
refuse chap = yes
refuse pap = yes
require authentication = yes
ppp debug = yes
pppoptfile = /etc/ppp/options.xl2tpd
length bit = yes

#vim /etc/ppp/options.xl2tpd
修改为如下内容：
require-mschap-v2
ms-dns 8.8.8.8
ms-dns 8.8.4.4
asyncmap 0
auth
crtscts
lock
hide-password
modem
debug
name l2tpd
proxyarp
lcp-echo-interval 30
lcp-echo-failure 4
mtu 1400
noccp
connect-delay 5000

#vim /etc/ppp/chap-secrets
vpnuser * vpnpass *
改为你自己的用户名和密码

#service xl2tpd start

开放端口及转发
#iptables -t nat -A POSTROUTING -m policy --dir out --pol none -j MASQUERADE
#iptables -A FORWARD -i ppp+ -p all -m state --state NEW,ESTABLISHED,RELATED    -j ACCEPT
#iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
#iptables -t nat -A POSTROUTING -s 172.16.0.0/24 -o eth1 -j MASQUERADE

#service iptables save

#chkconfig ipsec on
#chkconfig xl2tpd on

二、连接

WIN7连接：

安卓连接：

苹果连接：

访问谷歌：

CentOS6.8搭建IPsecVPN

猜你喜欢