不同机房vpc使用openswan打通内网

其他 2020-01-07 18:50:50 阅读次数: 0

1、测试环境：

北京6云主机：120.92.51.75/10.0.3.13     VPC：10.0.0.0/16 Ren-test

上海2云主机：42.157.163.120/192.168.3.3    VPC：zxs_vpc

2、下载安装openwan：
1、安装依赖包：
# yum -y install gmp-devel  bison flex gcc
 
2、下载安装openswan
https://download.openswan.org/openswan/
# wget https://download.openswan.org/openswan/openswan-2.6.43.1.tar.gz
# tar zxf openswan-2.6.43.1.tar.gz
# cd openswan-2.6.43.1
# make programs
# sudo make install
 
3、启动openswan
# /etc/init.d/ipsec start     # 启动
# netstat -lnput |grep pluto  # 查看监听端口
 
4、基础环境，内核参数等配置修改
# ipsec verify     # 基础环境依赖、状态查看
 
① 解决，更新如下配置：
echo 0 > /proc/sys/net/ipv4/conf/all/rp_filter;
echo 0 > /proc/sys/net/ipv4/conf/default/rp_filter;
echo 0 > /proc/sys/net/ipv4/conf/eth0/rp_filter;
echo 0 > /proc/sys/net/ipv4/conf/eth1/rp_filter;
echo 0 > /proc/sys/net/ipv4/conf/lo/rp_filter;
 
② 配置服务器路由转发功能等操作
# vi /etc/sysctl.conf
net.ipv4.ip_forward = 1  # 开启转发
net.ipv4.conf.default.rp_filter = 0
# 关闭icmp重定向
# sysctl -a | egrep "ipv4.*(accept|send)_redirects" | awk -F "=" '{print$1"= 0"}' >> /etc/sysctl.conf
# sysctl -p
 
③ 检查最终效果
# ipsec verify
#北京6云主机配置：

[root@vm10-0-3-13 ]# cat /etc/issue
CentOS release 6.9 (Final)
[root@vm10-0-3-13 ~]# curl myip.ksyun.com
{"eip":"120.92.51.75"}
[root@vm10-0-3-13 ~]# cat /etc/sysctl.conf
net.ipv4.ip_forward = 1
net.ipv4.conf.default.rp_filter = 0
net.ipv4.conf.default.accept_source_route = 0
kernel.sysrq = 0
kernel.core_uses_pid = 1
net.ipv4.tcp_syncookies = 1
net.bridge.bridge-nf-call-ip6tables = 0
net.bridge.bridge-nf-call-iptables = 0
net.bridge.bridge-nf-call-arptables = 0
kernel.msgmnb = 65536
kernel.msgmax = 65536
kernel.shmmax = 68719476736
kernel.shmall = 4294967296
net.ipv4.tcp_keepalive_time = 1200
net.ipv4.ip_local_port_range = 1024 65535
 
net.ipv4.conf.all.rp_filter = 0
net.ipv4.conf.default.rp_filter = 0
net.ipv4.conf.eth0.rp_filter = 0
net.ipv4.conf.eth1.rp_filter = 0
net.ipv4.conf.all.arp_announce = 2
net.ipv4.conf.default.arp_announce = 2
net.ipv4.conf.eth0.arp_announce = 2
net.ipv4.conf.eth1.arp_announce = 2
 
net.ipv6.conf.all.disable_ipv6 = 0
net.ipv6.conf.default.disable_ipv6 = 0
net.ipv6.conf.lo.disable_ipv6 = 0
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv4.conf.default.send_redirects = 0
net.ipv4.conf.lo.accept_redirects = 0
net.ipv4.conf.lo.send_redirects = 0
net.ipv4.conf.eth0.accept_redirects = 0
net.ipv4.conf.eth0.send_redirects = 0
net.ipv4.conf.eth1.accept_redirects = 0
net.ipv4.conf.eth1.send_redirects = 0
[root@vm10-0-3-13 ~]# cat /etc/ipsec.d/ksyun.conf
conn BJ-to-SH
        ike=3des-sha1
        authby=secret
        phase2=esp
        phase2alg=3des-sha1
        compress=no
        type=tunnel
        pfs=yes
 
        leftid=42.157.163.120
        left=42.157.163.120
        leftsubnet=192.168.0.0/16
        leftnexthop=%defaultroute       
 
        rightid=120.92.51.75
        right=10.0.3.13
        rightsubnet=10.0.0.0/16
        rightnexthop=%defaultroute
        auto=start
[root@vm10-0-3-13 ~]# cat /etc/ipsec.secrets
#include /etc/ipsec.d/*.secrets
0.0.0.0 0.0.0.0 : PSK "kingsoft"
[root@vm10-0-3-13 ~]# ip addr show
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether fa:16:3e:0c:35:df brd ff:ff:ff:ff:ff:ff
    inet 10.0.3.13/24 brd 10.0.3.255 scope global eth0
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether fa:16:3e:3e:72:2f brd ff:ff:ff:ff:ff:ff
    inet 10.0.2.208/24 brd 10.0.2.255 scope global eth1
[root@vm10-0-3-13 ~]# ip route show
10.0.2.0/24 dev eth1  proto kernel  scope link  src 10.0.2.208
10.0.3.0/24 dev eth0  proto kernel  scope link  src 10.0.3.13
169.254.0.0/16 dev eth0  scope link  metric 1002
169.254.0.0/16 dev eth1  scope link  metric 1003
default via 10.0.3.1 dev eth0
[root@vm10-0-3-13 log]# tail -20 /var/log/pluto.log
Jul 25 15:30:57: listening for IKE messages
Jul 25 15:30:57: adding interface eth1/eth1 10.0.2.208:500
Jul 25 15:30:57: adding interface eth1/eth1 10.0.2.208:4500
Jul 25 15:30:57: adding interface eth0/eth0 10.0.3.13:500
Jul 25 15:30:57: adding interface eth0/eth0 10.0.3.13:4500
Jul 25 15:30:57: adding interface lo/lo 127.0.0.1:500
Jul 25 15:30:57: adding interface lo/lo 127.0.0.1:4500
Jul 25 15:30:57: | setup callback for interface lo:4500 fd 23
Jul 25 15:30:57: | setup callback for interface lo:500 fd 22
Jul 25 15:30:57: | setup callback for interface eth0:4500 fd 21
Jul 25 15:30:57: | setup callback for interface eth0:500 fd 20
Jul 25 15:30:57: | setup callback for interface eth1:4500 fd 19
Jul 25 15:30:57: | setup callback for interface eth1:500 fd 18
Jul 25 15:30:57: loading secrets from "/etc/ipsec.secrets"
Jul 25 15:30:57: "BJ-to-SH" #1: initiating Main Mode
Jul 25 15:30:57: "BJ-to-SH" #1: ignoring Vendor ID payload [Openswan(xeleranized)]
Jul 25 15:30:57: "BJ-to-SH" #1: received Vendor ID payload [Dead Peer Detection]
Jul 25 15:30:57: "BJ-to-SH" #1: received Vendor ID payload [RFC 3947]
Jul 25 15:30:57: "BJ-to-SH" #1: enabling possible NAT-traversal with method RFC 3947 (NAT-Traversal)
Jul 25 15:30:57: "BJ-to-SH" #1: transition from state STATE_MAIN_I1 to state STATE_MAIN_I2
Jul 25 15:30:57: "BJ-to-SH" #1: STATE_MAIN_I2: sent MI2, expecting MR2
Jul 25 15:30:57: "BJ-to-SH" #1: NAT-Traversal: Result using RFC 3947 (NAT-Traversal) sender port 500: I am behind NAT+peer behind NAT
Jul 25 15:30:57: "BJ-to-SH" #1: transition from state STATE_MAIN_I2 to state STATE_MAIN_I3
Jul 25 15:30:57: "BJ-to-SH" #1: STATE_MAIN_I3: sent MI3, expecting MR3
Jul 25 15:30:57: "BJ-to-SH" #1: received Vendor ID payload [CAN-IKEv2]
Jul 25 15:30:57: "BJ-to-SH" #1: Main mode peer ID is ID_IPV4_ADDR: '42.157.163.120'
Jul 25 15:30:57: "BJ-to-SH" #1: transition from state STATE_MAIN_I3 to state STATE_MAIN_I4
Jul 25 15:30:57: "BJ-to-SH" #1: STATE_MAIN_I4: ISAKMP SA established {auth=PRESHARED_KEY cipher=oakley_3des_cbc_192 integ=sha group=MODP2048}
Jul 25 15:30:57: "BJ-to-SH" #2: initiating Quick Mode PSK+ENCRYPT+TUNNEL+PFS+UP+IKEV1_ALLOW+IKEV2_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW {using isakmp#1 msgid:8d92af45 proposal=3DES(3)_000-SHA1(2)_000 pfsgroup=OAKLEY_GROUP_MODP2048}
Jul 25 15:30:57: "BJ-to-SH" #2: transition from state STATE_QUICK_I1 to state STATE_QUICK_I2
Jul 25 15:30:57: "BJ-to-SH" #2: STATE_QUICK_I2: sent QI2, IPsec SA established tunnel mode {ESP/NAT=>0x32aaec51 <0x73d0c6c9 xfrm=3DES_0-HMAC_SHA1 NATOA=none NATD=42.157.163.120:4500 DPD=passive}
上海2云主机配置：

[root@vm192-168-3-9 ~]# cat /etc/issue
\S
Kernel \r on an \m
[root@vm192-168-3-9 ~]# curl myip.ksyun.com
{"eip":"42.157.163.120"}
[root@vm192-168-3-9 ~]# cat /etc/ipsec.d/ksyun.conf
conn SH-to-BJ
        ike=3des-sha1
        authby=secret
        phase2=esp
        phase2alg=3des-sha1
        compress=no
        type=tunnel
        pfs=yes
 
        leftid=42.157.163.120
        left=192.168.3.9
        leftsubnet=192.168.0.0/16
        leftnexthop=%defaultroute
 
        rightid=120.92.51.75
        right=120.92.51.75
        rightsubnet=10.0.0.0/16
        rightnexthop=%defaultroute
        auto=start
[root@vm192-168-3-9 ~]# cat /etc/ipsec.secrets
0.0.0.0 0.0.0.0 : PSK "kingsoft"
[root@vm192-168-3-9 ~]# ip addr show
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether fa:16:3e:7d:86:8f brd ff:ff:ff:ff:ff:ff
    inet 192.168.3.9/24 brd 192.168.3.255 scope global eth0
       valid_lft forever preferred_lft forever
[root@vm192-168-3-9 ~]# ip route show
default via 192.168.3.1 dev eth0
169.254.0.0/16 dev eth0 scope link metric 1002
192.168.3.0/24 dev eth0 proto kernel scope link src 192.168.3.9
[root@vm192-168-3-9 ~]# tail -20 /var/log/messages
Jul 25 15:07:32 vm192-168-3-9 ipsec_setup: Starting Openswan IPsec U2.6.43/K3.10.0-862.14.4.el7.x86_64...
Jul 25 15:07:32 vm192-168-3-9 ipsec_setup: Using NETKEY(XFRM) stack
Jul 25 15:07:32 vm192-168-3-9 kernel: IPv6: esp6_init: can't add xfrm type
Jul 25 15:07:32 vm192-168-3-9 kernel: IPv6: ah6_init: can't add xfrm type
Jul 25 15:07:32 vm192-168-3-9 kernel: AVX2 instructions are not detected.
Jul 25 15:07:33 vm192-168-3-9 kernel: AVX2 or AES-NI instructions are not detected.
Jul 25 15:07:33 vm192-168-3-9 ipsec_setup: ...Openswan IPsec started
Jul 25 15:07:33 vm192-168-3-9 pluto: adjusting ipsec.d to /etc/ipsec.d
Jul 25 15:07:33 vm192-168-3-9 ipsec__plutorun: 002 added connection description "SH-to-BJ"
Jul 25 15:07:33 vm192-168-3-9 ipsec__plutorun: 002 listening for IKE messages
Jul 25 15:07:33 vm192-168-3-9 ipsec__plutorun: 002 adding interface eth0/eth0 192.168.3.9:500
Jul 25 15:07:33 vm192-168-3-9 ipsec__plutorun: 002 adding interface eth0/eth0 192.168.3.9:4500
Jul 25 15:07:33 vm192-168-3-9 ipsec__plutorun: 002 adding interface lo/lo 127.0.0.1:500
Jul 25 15:07:33 vm192-168-3-9 ipsec__plutorun: 002 adding interface lo/lo 127.0.0.1:4500
Jul 25 15:07:33 vm192-168-3-9 ipsec__plutorun: 002 loading secrets from "/etc/ipsec.secrets"
[root@vm192-168-3-9 ~]# 可以配置/etc/ipsec.conf中logfile=/var/log/pluto.log或plutostderrlog=/var/log/pluto.log开启openwan日志
added connection description "SH-to-BJ"
listening for IKE messages
adding interface eth0/eth0 192.168.3.9:500
adding interface eth0/eth0 192.168.3.9:4500
adding interface lo/lo 127.0.0.1:500
adding interface lo/lo 127.0.0.1:4500
loading secrets from "/etc/ipsec.secrets"
packet from 120.92.51.75:500: received Vendor ID payload [Dead Peer Detection]
packet from 120.92.51.75:500: ignoring Vendor ID payload [FRAGMENTATION]
packet from 120.92.51.75:500: received Vendor ID payload [RFC 3947] method set to=115
packet from 120.92.51.75:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03] meth=108, but already using method 115
packet from 120.92.51.75:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n] meth=106, but already using method 115
packet from 120.92.51.75:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02] meth=107, but already using method 115
"SH-to-BJ" #1: responding to Main Mode
"SH-to-BJ" #1: transition from state STATE_MAIN_R0 to state STATE_MAIN_R1
"SH-to-BJ" #1: STATE_MAIN_R1: sent MR1, expecting MI2
"SH-to-BJ" #1: NAT-Traversal: Result using draft-ietf-ipsec-nat-t-ike (MacOS X): both are NATed
"SH-to-BJ" #1: transition from state STATE_MAIN_R1 to state STATE_MAIN_R2
"SH-to-BJ" #1: STATE_MAIN_R2: sent MR2, expecting MI3
"SH-to-BJ" #1: Main mode peer ID is ID_IPV4_ADDR: '120.92.51.75'
"SH-to-BJ" #1: transition from state STATE_MAIN_R2 to state STATE_MAIN_R3
"SH-to-BJ" #1: new NAT mapping for #1, was 120.92.51.75:500, now 120.92.51.75:4500
"SH-to-BJ" #1: STATE_MAIN_R3: sent MR3, ISAKMP SA established {auth=OAKLEY_PRESHARED_KEY cipher=oakley_3des_cbc_192 prf=oakley_sha group=modp2048}
"SH-to-BJ" #1: the peer proposed: 192.168.0.0/16:0/0 -> 10.0.0.0/16:0/0
"SH-to-BJ" #2: responding to Quick Mode proposal {msgid:d6c02a77}
"SH-to-BJ" #2:     us: 192.168.0.0/16===192.168.3.9<192.168.3.9>[42.157.163.120]---192.168.3.1
"SH-to-BJ" #2:   them: 192.168.3.1---120.92.51.75<120.92.51.75>===10.0.0.0/16
"SH-to-BJ" #2: transition from state STATE_QUICK_R0 to state STATE_QUICK_R1
"SH-to-BJ" #2: STATE_QUICK_R1: sent QR1, inbound IPsec SA installed, expecting QI2
"SH-to-BJ" #2: transition from state STATE_QUICK_R1 to state STATE_QUICK_R2
"SH-to-BJ" #2: STATE_QUICK_R2: IPsec SA established tunnel mode {ESP=>0xd85f23ba <0x232e6a69 xfrm=3DES_0-HMAC_SHA1 NATOA=none NATD=120.92.51.75:45
00 DPD=none}

3、VPC控制台路由配置：

北京6 VPC：

 上海2 VPC：

参考文档：https://www.172173.com/openswan.html#2-5-%E9%AA%8C%E8%AF%81%E7%8E%AF%E5%A2%83

zxs_vpc

猜你喜欢

转载自www.cnblogs.com/zhangmingda/p/12163053.html
今日推荐
基于大语言模型的开源知识库问答系统 MaxKB GitHub Star 数量突破 5,000 个！
美国拟限制 AI 大模型出口中国和俄罗斯
苹果将与 OpenAI 达成协议，将 ChatGPT 应用于 iPhone
openKylin 社区生态委员会第六次会议圆满召开
阿里云正式发布通义千问 2.5
Python 3.13 发布首个 Beta：实验性自由线程模式和 JIT、改进交互式解释器
Stack Overflow 拿我的代码去训练 AI 大模型，还封了我的账号
Pop!_OS 的 COSMIC 桌面完成 App Store 上架工作
报告：Django 仍然是 74% 开发者的首选
《2024 年一季度互联网投融资运行情况》研究报告
15 年前上了“FFmpeg 耻辱柱”，今天他还得谢谢咱——腾讯QQPlayer一雪前耻？
TIOBE 5 月榜单：Fortran “复活”进入 Top 10
周排行
BPM为企业带来的实际利益
好程序员web前端分享css常用属性缩写
Java文件下载（excel）
css样式的动态添加及显示和隐藏等零碎用法
axios全局配置以及拦截器
使用Logstash来实时同步MySQL和log日志数据到ES
C++获取当前时间（年月日、时分秒、毫秒）
Odoo产品分析 (四) -- 工具板块(11) -- 网站即时聊天(1)
Java环境配置正确，但是java、javac、java -version均返回“不是内部或外部命令，也不是可运行的程序或批处理文件”？
01 官网下载各种CentOS教程（超详细版）
每日归档
更多
2024-05-14(0)
2024-05-13(18)
2024-05-12(0)
2024-05-11(38)
2024-05-10(38)
2024-05-09(35)
2024-05-08(42)
2024-05-07(14)
2024-05-06(40)
2024-05-05(0)

代码天地 © 2018 codetd.com

境外服务器   最新电视剧2022