近年来最累的一次折腾。有必要好好记录一下。跟了网上N个教程,有好几个都走不通。最后自己彻底整理了一次。把自己的经验和配置分享出来。

首先隆重感谢一下至今素未谋面的老熊,真是好人啊。06年的时候就在plesk服务器换ip的事上,帮了我好大的忙。没想到这次在我卡在第6步,最绝望的时候,这只熊的婀娜身影再一次出现在了我的生活中。还在漆黑的深夜中陪伴在我的身边。以下隆重公布一下他的QQ,造福广大网友!QQ: 499******* (后几位号码,为符合当地莫名其妙的“相关法规”,被系统自动屏蔽。。。)

其次要感谢老熊的同事,百忙中写好的防火墙规则,让我10分钟之内,就被兴奋得昏了头的我,给无情覆盖了。以至于下次人家重写之后,很自觉的在/root下给留了个备份。zan


1. 先安装openswan
yum install -y ppp iptables make gcc gmp-devel xmlto bison flex xmlto libpcap-devel lsof
wget http://download.openswan.org/openswan/openswan-2.6.38.tar.gz
tar zxvf openswan-2.6.38.tar.gz
cd openswan-2.6.38
make programs install


gkp说“安装 openswan,记得别用2.6.26,宁可用2.6.24。他和xl2tpd存在严重兼容性bug”


2. 安装xl2tpd

在centos 6官方的yum源中,没有这个软件包。需要安装fedora的epel源。
rpm -Uvh http://mirrors.ustc.edu.cn/fedora/epel/6/x86_64/epel-release-6-7.noarch.rpm
#CentOS 5用这个地址:  rpm -Uvh http://mirrors.ustc.edu.cn/fedora/epel/5/i386/epel-release-5-4.noarch.rpm
yum install xl2tpd -y


如果上面这个安装地址如果不对了。参照这个fedora epel的faq页(https://fedoraproject.org/wiki/EPEL/FAQ/zh-cn#How_can_I_install_the_packages_from_the_EPEL_software_repository.3F

安装其他一些linux软件源,参照这页:http://www.esojourn.org/blog/post/repo-sources.php


编辑 /etc/ipsec.conf 注意$esojourn.org替换成你机器的ip。这个IP应该是你的公网IP,不是本机内网IP。


# /etc/ipsec.conf - Openswan IPsec configuration file

# This file:  /usr/local/share/doc/openswan/ipsec.conf-sample
#
# Manual:     ipsec.conf.5


version 2.0     # conforms to second version of ipsec.conf specification

# basic configuration
config setup
        # Do not set debug options to debug configuration issues!
        # plutodebug / klipsdebug = "all", "none" or a combation from below:
        # "raw crypt parsing emitting control klips pfkey natt x509 dpd private"
        # eg:
        # plutodebug="control parsing"
        # Again: only enable plutodebug or klipsdebug when asked by a developer
        #
        # enable to get logs per-peer
        # plutoopts="--perpeerlog"
        #


        # Enable core dumps (might require system changes, like ulimit -C)
        # This is required for abrtd to work properly
        # Note: incorrect SElinux policies might prevent pluto writing the core
        dumpdir=/var/run/pluto/
        #
        # NAT-TRAVERSAL support, see README.NAT-Traversal
        nat_traversal=yes
        # exclude networks used on server side by adding %v4:!a.b.c.0/24
        # It seems that T-Mobile in the US and Rogers/Fido in Canada are
        # using 25/8 as "private" address space on their 3G network.
        # This range has not been announced via BGP (at least upto 2010-12-21)
        virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:25.0.0.0/8,%v6:fd00::/8,%v6:fe80::/10
        # OE is now off by default. Uncomment and change to on, to enable.
        oe=off
        # which IPsec stack to use. auto will try netkey, then klips then mast

        protostack=netkey
        #这里注释说可以用auto,但实际上不行。还得老老实实写netkey

        # Use this to log to a file, or disable logging on embedded systems (like openwrt)
        #plutostderrlog=/dev/null

# Add connections here

# sample VPN connection
# for more examples, see /etc/ipsec.d/examples/
#conn sample
#               # Left security gateway, subnet behind it, nexthop toward right.
#               left=10.0.0.1
#               leftsubnet=172.16.0.0/24
#               leftnexthop=10.22.33.44
#               # Right security gateway, subnet behind it, nexthop toward left.
#               right=10.12.12.1
#               rightsubnet=192.168.0.0/24
#               rightnexthop=10.101.102.103
#               # To authorize this connection, but not actually start it,
#               # at startup, uncomment this.
#               #auto=add

conn L2TP-PSK-NAT
    rightsubnet=vhost:%priv
    also=L2TP-PSK-noNAT

conn L2TP-PSK-noNAT
    authby=secret
    pfs=no
    auto=add
    keyingtries=3
    rekey=no
    ikelifetime=8h
    keylife=1h
    type=transport
    left=$esojourn.org  #这里写公网IP,没固定IP的就到花生壳弄个动态域名解析。
    leftid=$esojourn.org
    leftprotoport=17/1701
    right=%any

修改ipsec密钥
vi  /etc/ipsec.secrets

www.esojourn.org %any: PSK "myps"
#www.esojourn.org改成公网ip,没固定IP的,就到花生壳弄个动态域名解析。http://www.oray.com/peanuthull/
#myps改成密码


3. 修改/etc/sysctl.conf,开启路由功能
vi /etc/sysctl.conf

星云说
将下面两项找到:
net.ipv4.ip_forward = 0
net.ipv4.conf.default.rp_filter = 1

改为:
net.ipv4.ip_forward = 1
net.ipv4.conf.default.rp_filter = 0

之后先让修改后的配置生效,再测试一下,
sysctl -p
service ipsec start
ipsec verify


如果行了就这样了,但实际上,我反复测试之后,干脆在sysctl.conf最下面,加了这一段。加好后别忘了再sysctl -p一下。


#added for xl2tpd
net.ipv4.ip_forward = 1
net.ipv4.conf.default.rp_filter = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0
net.ipv4.conf.all.log_martians = 0
net.ipv4.conf.default.log_martians = 0
net.ipv4.conf.default.accept_source_route = 0
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv4.icmp_ignore_bogus_error_responses = 1


如果ipsec verify返回这样,就可以了。

Checking your system to see if IPsec got installed and started correctly:
Version check and ipsec on-path                                 [OK]
Linux Openswan U2.6.24/K2.6.32.16-linode28 (netkey)
Checking for IPsec support in kernel                            [OK]
NETKEY detected, testing for disabled ICMP send_redirects       [OK]
NETKEY detected, testing for disabled ICMP accept_redirects     [OK]
Checking for RSA private key (/etc/ipsec.secrets)               [OK]
Checking that pluto is running                                  [OK]
Pluto listening for IKE on udp 500                              [OK]
Pluto listening for NAT-T on udp 4500                           [OK]
Two or more interfaces found, checking IP forwarding            [OK]
Checking NAT and MASQUERADEing
Checking for 'ip' command                                       [OK]
Checking for 'iptables' command                                 [OK]
Opportunistic Encryption Support                                [DISABLED]


我的经验中,这里可能会出这么几个故障:
第一:
SAref kernel support                                           [N/A]

这样的话, /etc/xl2tpd/xl2tpd.conf这个文件里
[global]
ipsec saref = no


第二:
Two or more interfaces found, checking IP forwarding            [FAILED]
Checking NAT and MASQUERADEing                                  [OK]
ip转发检查失败。

Paul和Steve说:只要 cat /proc/sys/net/ipv4/ip_forward 返回结果是1就没事。这个我已经证实了。

第三:返回结果里,就没有Two or more interfaces found, checking IP forwarding和Checking NAT and MASQUERADEing这两项。碰上这个我也没办法了。重装了系统,又瞎折腾一通之后就好了。

[ 2012-7-6 ]
第四:更新加入一个新的情况
Checking for IPsec support in kernel                            [OK]
SAref kernel support                                           [N/A]
NETKEY:  Testing XFRM related proc values                      [OK]
        [OK]
        [FAILED]

  Please enable /proc/sys/net/core/xfrm_larval_drop
  or NETKEY will cause non-POSIX compliant long time-outs

Checking that pluto is running                                  [OK]

出这毛病,照着说明,
echo 1 > /proc/sys/net/core/xfrm_larval_drop
vi /etc/bashrc

然后把“echo 1 > /proc/sys/net/core/xfrm_larval_drop”这句加进去。以后每次开机自动执行一下。

4. 编辑 /etc/xl2tpd/xl2tpd.conf
vi /etc/xl2tpd/xl2tpd.conf

; This is a minimal sample xl2tpd configuration file for use
; with L2TP over IPsec.
;
; The idea is to provide an L2TP daemon to which remote Windows L2TP/IPsec
; clients connect. In this example, the internal (protected) network
; is 192.168.1.0/24.  A special IP range within this network is reserved
; for the remote clients: 192.168.1.128/25
; (i.e. 192.168.1.128 ... 192.168.1.254)
;
; The listen-addr parameter can be used if you want to bind the L2TP daemon
; to a specific IP address instead of to all interfaces. For instance,
; you could bind it to the interface of the internal LAN (e.g. 192.168.1.98
; in the example below). Yet another IP address (local ip, e.g. 192.168.1.99)
; will be used by xl2tpd as its address on pppX interfaces.

[global]
listen-addr = esojourn.org  
;这里写内网IP。或者加;注释掉也问题不大。
;
; requires openswan-2.5.18 or higher - Also does not yet work in combination
; with kernel mode l2tp as present in linux 2.6.23+
; ipsec saref = yes
ipsec saref = no
;这里一般都让写yes,但如果刚才你的ipsec verify中,有报SAref kernel support[N/A]的话,这里就写no。


; Use refinfo of 22 if using an SAref kernel patch based on openswan 2.6.35 or
;  when using any of the SAref kernel patches for kernels up to 2.6.35.
; ipsec refinfo = 30
;
; forceuserspace = yes
;
; debug tunnel = yes

[lns default]
ip range = 192.168.7.128-192.168.7.254
;这里写vpn client的ip段
local ip = 192.168.7.1

require chap = yes
refuse pap = yes
require authentication = yes
name = LinuxVPNserver
ppp debug = yes
pppoptfile = /etc/ppp/options.xl2tpd
length bit = yes


5. 修改 /etc/ppp/options.xl2tpd

vi /etc/ppp/options.xl2tpd
require-mschap-v2
ipcp-accept-local
ipcp-accept-remote
ms-dns  8.8.4.4
ms-dns  8.8.8.8
noccp
auth
crtscts
idle 1800
mtu 1410
mru 1410
nodefaultroute
debug
lock
proxyarp
connect-delay 5000


vi /etc/ppp/chap-secrets
#文件格式
# user server password ip
username * userpass * #改成你的用户名 密码


6. 最关键的iptables配置
做完上面这堆步骤之后,客户端建个连接就可以验证进入vpn主机了。但是无法访问内外网。我就是在这里卡了一个多星期。网上的资料,有的没说这一步。有的说了也没说全。我发个权威的吧。

iptables -t nat -A POSTROUTING -s 192.168.7.0/24 -o eth0 -j MASQUERADE
iptables -I FORWARD -s 192.168.7.0/24 -j ACCEPT
iptables -I FORWARD -d 192.168.7.0/24 -j ACCEPT
iptables-save
service iptables restart

192.168.7.0/24根据实际情况替换。

vi /etc/sysconfig/iptables 看到的应该是类似这样。
最上面先是nat规则,下面是filter规则。
下面filter表里,先把VPN要用到的udp端口1701,500,4500都打开。要用openvp的话,还要开1194。
另外filter表里,一定要有FORWARD规则。这点在网上好几个教程里都没说!坑死人。


#下面规则做参考啊,新手别完全照抄。
*nat
:PREROUTING ACCEPT [39:3503]
:POSTROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A POSTROUTING -s 192.168.7.0/24 -o eth0 -j MASQUERADE
COMMIT
# Completed on Thu Jun 28 15:50:40 2012
# Generated by iptables-save v1.4.7 on Thu Jun 28 15:50:40 2012
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [121:13264]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 53 -j ACCEPT
-A INPUT -p udp -m state --state NEW -m udp --dport 53 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 1194 -j ACCEPT
-A INPUT -p udp -m state --state NEW -m udp --dport 1701 -j ACCEPT
-A INPUT -p udp -m state --state NEW -m udp --dport 500 -j ACCEPT
-A INPUT -p udp -m state --state NEW -m udp --dport 4500 -j ACCEPT

-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -d 192.168.7.0/24 -j ACCEPT
-A FORWARD -s 192.168.7.0/24 -j ACCEPT
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT
# Completed on Thu Jun 28 15:50:40 2012


最后
service xl2tpd restart
service iptables restart
chkconfig xl2tpd on
chkconfig iptables on
chkconfig ipsec on



最后编辑: Sonic 编辑于2012/07/06 18:23
Tags: , ,
网摘-网事 | 评论(16) | 引用(0) | 阅读(66065)
Share |
1
2013/01/30 00:14
[root@localhost openswan-2.6.38]# sysctl -pnet.ipv4.ip_forward = 1net.ipv4.conf.default.rp_filter = 0net.ipv4.conf.default.accept_source_route = 0kernel.sysrq = 0kernel.core_uses_pid = 1error: "net.bridge.bridge-nf-call-ip6tables" is an unknown keyerror: "net.bridge.bridge-nf-call-iptables" is an unknown keyerror: "net.bridge.bridge-nf-call-arptables" is an unknown keykernel.msgmnb = 65536kernel.msgmax = 65536kernel.shmmax = 4294967295kernel.shmall = 268435456[root@localhost openswan-2.6.38]# service ipsec startfailed to start openswan IKE daemon - the following error occured:can not load config '/etc/ipsec.conf': /etc/ipsec.conf:71: syntax error, unexpected STRING, expecting EOL [#▒▒▒▒д▒▒▒▒IP▒▒û▒̶▒IP▒ľ͵▒▒▒▒▒▒Ū▒▒̬▒▒▒▒▒▒▒][root@localhost openswan-2.6.38]#[root@localhost openswan-2.6.38]#[root@localhost openswan-2.6.38]# ipsec verifyChecking your system to see if IPsec got installed and started correctly:Version check and ipsec on-path                                 [OK]Linux Openswan U2.6.32/K(no kernel code presently loaded)Checking for IPsec support in kernel                            [FAILED] SAref kernel support                                           [N/A]Checking that pluto is running                                  [FAILED]  whack: Pluto is not running (no "/var/run/pluto/pluto.ctl")Checking for 'ip' command                                       [OK]Checking /bin/sh is not /bin/dash                               [OK]Checking for 'iptables' command                                 [OK]Opportunistic Encryption Support                                [DISABLED]  can not load config '/etc/ipsec.conf': /etc/ipsec.conf:71: syntax error, unexpected STRING, expecting EOL [#▒▒▒▒д▒▒▒▒IP▒▒û▒̶▒IP▒ľ͵▒▒▒▒▒▒Ū▒▒̬▒▒▒▒▒▒▒]
游客
2012/11/26 17:22
可以拨号   但检测ip发现,ip没变..
Eddie
2012/11/09 12:13
# service ipsec start
failed to start openswan IKE daemon - the following error occured:
5566
2012/11/02 15:22
非常感谢能抽出时间,希望能与您交流一下
5566
2012/11/01 16:29
映射我也做了,做了映射后目的IP地址不是要变化的么,这样不是和NAT一样了,会不会有影响,现在的情况是WIN7连报809错误,是不是客户端不支持NAT穿越的原因呢,日志上也看不出什么,还有就是iptables,我看楼主的文章说是不开iptables也可以连上,我现在就连不上。希望楼主有时间能帮一下我,我的QQ:284693977,非常感谢您。
Sonic 回复于 2012/11/01 18:02
映射到linux服务器的相应端口。跟NAT还是不一样的。今天马上要下班了,明天休假一天。如果能等得及,下周和你联系吧。
5566
2012/10/31 15:46
请教一下博主,这个试验的网络环境是什么样的呢,VPN服务器是放在内网下的吗,我按照这个做的,在内网可以连接成功,可是放到外网环境就连不上来,路由器上做了映射。
Sonic 回复于 2012/11/01 10:40
我的工作环境是在外网。你的路由上 端口1701,500,4500都要映射。要用openvp的话,还要开1194。另外,再看一下放到外网后,本机的iptables是不是要做调整。
fdsa
2012/10/29 21:59
这个是我的规则怎么就不好用呢?而且这个防火墙一关就可以联网。*filter:FORWARD ACCEPT [0:0]:INPUT ACCEPT [0:0]:RH-Firewall-1-INPUT - [0:0]:OUTPUT ACCEPT [0:0]-A INPUT -j RH-Firewall-1-INPUT-A FORWARD -j RH-Firewall-1-INPUT-A RH-Firewall-1-INPUT -i lo -j ACCEPT-A RH-Firewall-1-INPUT -i eth0 -j ACCEPT-A RH-Firewall-1-INPUT -p icmp --icmp-type any -j ACCEPT-A RH-Firewall-1-INPUT -p 50 -j ACCEPT-A RH-Firewall-1-INPUT -p 51 -j ACCEPT-A RH-Firewall-1-INPUT -p udp -d 224.0.0.251 --dport 5353 -j ACCEPT-A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 631 -j ACCEPT-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT-A RH-Firewall-1-INPUT -p tcp -m state -m tcp --dport 10000 --state NEW -j ACCEPT-A RH-Firewall-1-INPUT -p tcp -m state -m tcp --dport 22 --state NEW -j ACCEPT-A INPUT -p udp -m state -m udp --dport 1701 --state NEW -j ACCEPT-A INPUT -p udp -m state -m udp --dport 500 --state NEW -j ACCEPT-A INPUT -p udp -m state -m udp --dport 4500 --state NEW -j ACCEPT-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited-A FORWARD -s 10.0.99.0/24 -j ACCEPT-A FORWARD -d 10.0.99.0/24 -j ACCEPTCOMMIT*mangle:FORWARD ACCEPT [0:0]:INPUT ACCEPT [0:0]:OUTPUT ACCEPT [0:0]:PREROUTING ACCEPT [0:0]:POSTROUTING ACCEPT [0:0]COMMIT*nat:OUTPUT ACCEPT [0:0]:PREROUTING ACCEPT [0:0]:POSTROUTING ACCEPT [0:0]-A POSTROUTING -s 10.0.99.0/24 -o eth0 -j MASQUERADECOMMIT# Completed
Sonic 回复于 2012/11/01 10:44
抱歉,暂时没时间仔细看你的iptables设置。防火墙的NAT规则设置是挺晕的。建议多花点时间,把这一块的基础知识学好。我自己这一块也还不是很有经验。有问题欢迎再留言,我们一起探讨。
L
2012/10/14 20:15
博主,你好,我按照你的教程配置之后 客户端是xp,vpn能连接但是查看/var/log/secure发现ipsec没有起到作用,这是什么情况?
Sonic 回复于 2012/10/16 18:07
log里怎么写的?
gongcheng324 Email
2012/09/25 08:34
博主,请教一个问题。执行过 xl2tpd -D 后出现如下代码正常么?正常的话为何 netstat -an 中没有监听 1701 呢
/]# xl2tpd -D
xl2tpd[12565]: IPsec SAref does not work with L2TP kernel mode yet, enabling forceuserspace=yes
xl2tpd[12565]: setsockopt recvref[22]: Protocol not available
xl2tpd[12565]: This binary does not support kernel L2TP.
xl2tpd[12565]: xl2tpd version xl2tpd-1.2.4 started on 207-226-138-166.static.pccwglobal.net PID:12565
xl2tpd[12565]: Written by Mark Spencer, Copyright (C) 1998, Adtran, Inc.
xl2tpd[12565]: Forked by Scott Balmos and David Stipp, (C) 2001
xl2tpd[12565]: Inherited by Jeff McAdams, (C) 2002
xl2tpd[12565]: Forked again by Xelerance (www.xelerance.com) (C) 2006
xl2tpd[12565]: Listening on IP address 0.0.0.0, port 1701
Marcus
2012/09/06 23:19
请问 双ip 可以实现 两个ip都能用l2tp拨通吗?
Sonic 回复于 2012/10/16 18:09
这个还真没试过。查一下官方文档里有没有提到双IP监听吧。或者把两个IP都写进配置文件里试试看。
franck
2012/08/31 20:48
问一下,你这个案子是又网卡的l2tp vpn吗?单网卡的可以实现吗?
Sonic 回复于 2012/09/05 12:46
是单网卡实现的。
fishhanfan
2012/08/31 17:21
请教:启动ipsec的时候会提示出错,但没有具体的出错信息,只是一行空行。
# service ipsec start
failed to start openswan IKE daemon - the following error occured:
Sonic 回复于 2012/09/05 12:47
安装的时候有没有错误提示?
Marcus Homepage
2012/08/28 10:24
请问 如果vps 有两个ip连接vpn后显示的ip 为拨入时的ip应该怎么配置?按照以上的配置 貌似不能链接
Hong Email
2012/08/05 19:23
请问链接的时候 错误718 怎么处理啊?
Sonic 回复于 2012/08/13 17:05
错误 718 。问题:验证用户名时远程计算机超时没有响应,断开连接。你用的验证方式是什么?如果是用xl2tpd做的VPN服务器,可以把你的配置文件贴出来看看。
passion
2012/07/27 00:04
有联系方式么,想和你交流一下!
Sonic 回复于 2012/07/30 12:08
请留言交流吧。也把信息分享给后来者。
分页: 1/2 第一页 1 2 下页 最后页