L2TP · linux · 看云

[TOC] https://segmentfault.com/a/1190000006125737 # 搭建VPN ## 安裝gcc openswan xltpd 配置ipsec ~~~ sudo yum install gcc epel-release openswan -y ~~~ xl2tpd必須放在下面單獨安裝，因為CentOS原本的yum源里面是沒有xl2tpd的，要安裝epel后才有。 ~~~ sudo yum install xl2tpd -y ~~~ 安裝完上面的東西后修改ipsec.conf配置文件 ~~~ sudo vim /etc/ipsec.conf ~~~ 配置文件的內容可以直接用下面的替換，并用VPS實例的公網IP地址替換left=your.vps.ip.addr中的your.vps.ip.addr ~~~ # /etc/ipsec.conf - Libreswan IPsec configuration file #This file: /etc/ipsec.conf # # Enable when using this configuration file with openswan instead of libreswan version 2 # # Manual: ipsec.conf.5 # basic configuration config setup protostack=netkey virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12 nat_traversal=yes conn L2TP-PSK-NAT rightsubnet=vhost:%priv also=L2TP-PSK-noNAT conn L2TP-PSK-noNAT authby=secret pfs=no auto=add keyingtries=3 rekey=no ikelifetime=8h keylife=1h type=transport left=your.vps.ip.addr leftprotoport=17/1701 right=%any rightprotoport=17/%any ~~~ 接著修改ipsec.secrets配置文件，設置預共享密鑰 ~~~ sudo vim /etc/ipsec.secrets ~~~ 配置文件的內容如下，用VPS實例的公網IP地址替換left=your.vps.ip.addr中的your.vps.ip.addr 用你自己設定的密碼替換your.pre_shared_key ~~~ include /etc/ipsec.d/*.secrets your.vps.ip.addr %any: PSK "your.pre_shared_key" ~~~ 修改/etc/sysctl.conf配置文件,添加內容如下 ~~~ net.ipv4.ip_forward = 1 net.ipv4.conf.all.rp_filter = 0 net.ipv4.conf.default.rp_filter = 0 net.ipv4.conf.eth0.rp_filter = 0 net.ipv4.conf.eth1.rp_filter = 0 net.ipv4.conf.all.send_redirects = 0 net.ipv4.conf.default.send_redirects = 0 net.ipv4.conf.all.accept_redirects = 0 net.ipv4.conf.default.accept_redirects = 0 ~~~ 創建腳本并以管理員權限運行 ~~~ vim modify.sh ~~~ modify.sh中的內容如下 ~~~ for each in /proc/sys/net/ipv4/conf/* do echo 0 > $each/accept_redirects echo 0 > $each/send_redirects done ~~~ 保存并退出modify.sh, 執行modify.sh ~~~ sudo sh modify.sh ~~~ 此時再執行如下命令應該會看到輸出一系列的0 ~~~ for each in /proc/sys/net/ipv4/conf/*; do cat $each/accept_redirects; cat $each/send_redirects; done ~~~ 重啟ipsec ~~~ systemctl restart ipsec ==== AUTHENTICATING FOR org.freedesktop.systemd1.manage-units === Authentication is required to manage system services or units. Authenticating as: root Password: 輸入root用戶的密碼 ==== AUTHENTICATION COMPLETE === ~~~ 檢驗ipsec的配置 ~~~ sudo ipsec verify ~~~ 此時系統的輸出如果是這樣就說明到此為止都是正確的 ~~~ Verifying installed system and configuration files Version check and ipsec on-path [OK] Libreswan 3.15 (netkey) on 3.10.0-327.28.3.el7.x86_64 Checking for IPsec support in kernel [OK] 　NETKEY: Testing XFRM related proc values 　　　　ICMP default/send_redirects [OK] 　　　　ICMP default/accept_redirects [OK] 　　　　XFRM larval drop [OK] Pluto ipsec.conf syntax [OK] Hardware random device [N/A] Two or more interfaces found, checking IP forwarding [OK] Checking rp_filter [OK] Checking that pluto is running [OK] Pluto listening for IKE on udp 500 [OK] Pluto listening for IKE/NAT-T on udp 4500 [OK] Pluto ipsec.secret syntax [OK] Checking 'ip' command [OK] Checking 'iptables' command [OK] Checking 'prelink' command does not interfere with FIPSChecking for obsolete > ipsec.conf options [OK] Opportunistic Encryption [DISABLED] ~~~ 如果看到下面這樣的輸出 ~~~ Checking rp_filter [ENABLED] /proc/sys/net/ipv4/conf/eth0/rp_filter [ENABLED] /proc/sys/net/ipv4/conf/eth1/rp_filter [ENABLED] ~~~ 那么就根據提供的路徑，修改文件的內容為0 ~~~ sudo sh -c "echo 0 > /proc/sys/net/ipv4/conf/eth0/rp_filter" sudo sh -c "echo 0 > /proc/sys/net/ipv4/conf/eth1/rp_filter" ~~~ 重新檢驗ipsec的配置，即可得到正確的輸出 ~~~ sudo ipsec verify ~~~ 接著配置VPN登陸的賬號和密碼 ~~~ sudo vim /etc/ppp/chap-secrets ~~~ 內容如下, 替換your.account為你要設置的賬號，替換your.password為你要設置的密碼 ~~~ # Secrets for authentication using CHAP # client server secret IP addresses your.account l2tpd your.password * ~~~ 到這里我們已經完成一部分了，可以測試一下到此為止是否一切順利，我們通過客戶端VPN連接測試是否正常，這里我使用windows系統的VPN功能進行測試。 ![](https://box.kancloud.cn/ad2495f6fbefda53aa423380629d0a6b_594x758.png) 保存配置并連接，此時還是連不上的，但是服務器端我們可以查看連接日志 ~~~ sudo vim /var/log/secure ~~~ 在打開的日志文件中搜索 ~~~ IPsec SA established ~~~ 或者 ~~~ IPSec connection established ~~~ 如果能搜索到這樣的字樣，則說明到此為止一切順利 # 安裝和配置xl2tpd 安裝xl2tp ~~~ cd /use/src sudo wget http://downloads.sourceforge.net/project/rp-l2tp/rp-l2tp/0.4/rp-l2tp-0.4.tar.gz sudo tar zxf rp-l2tp-0.4.tar.gz cd rp-l2tp-0.4 sudo ./configure sudo make sudo make install sudo cp handlers/l2tp-control /usr/local/sbin/ sudo mkdir /var/run/xl2tpd/ sudo ln -s /usr/local/sbin/l2tp-control /var/run/xl2tpd/l2tp-control sudo yum install xl2tpd sudo vim /etc/xl2tpd/xl2tpd.conf ~~~ xl2tpd.conf中的內容如下, 其中x和y代表客戶端的ip地址范圍,不要將local ip的值包含在內 ~~~ [global] ipsec saref = yes [lns default] ip range = 10.0.10.x-10.0.10.y local ip = 10.0.10.1 refuse chap = yes refuse pap = yes require authentication = yes ppp debug = yes pppoptfile = /etc/ppp/options.xl2tpd length bit = yes ~~~ 編輯options.xl2tps ~~~ sudo vim /etc/ppp/options.xl2tpd ~~~ options.xl2tpd文件的內容如下, 其中ms-dns推薦使用Google的DNS ~~~ require-mschap-v2 ms-dns 8.8.8.8 ms-dns 8.8.4.4 asyncmap 0 auth crtscts lock hide-password debug name l2tpd proxyarp lcp-echo-interval 30 lcp-echo-failure 4 noccp connect-delay 5000 ~~~ 防火墻開啟端口 ~~~ sudo vim /usr/lib/firewalld/services/l2tpd.xml ~~~ 文件內容如下 ~~~ <?xml version="1.0" encoding="utf-8"?> <service> <short>l2tpd</short> <description>L2TP IPSec</description> <port protocol="udp" port="500"/> <port protocol="udp" port="4500"/> <port protocol="udp" port="1701"/> </service> ~~~ 設置并重啟防火墻 ~~~ sudo firewall-cmd --reload sudo firewall-cmd --permanent --add-service=l2tpd sudo firewall-cmd --permanent --add-service=ipsec sudo firewall-cmd --permanent --add-masquerade sudo firewall-cmd --permanent --direct --add-rule ipv4 filter FORWARD 0 -p tcp -i ppp+ -j TCPMSS --syn --set-mss 1356 sudo firewall-cmd --reload ~~~ 現在以debug模式啟動xl2tpd ~~~ sudo xl2tpd -D ~~~ 此時可以在控制臺看到輸出，客戶端再次連接VPN，就可以連接上并訪問網絡了, 百度搜索ip會顯示你的IP地址為你VPS實例的IP地址。如果一切都正常，就設置開機自啟 ~~~ systemctl enable ipsec xl2tpd systemctl restart ipsec xl2tpd ~~~ # 流量監控如果想要統計CentOS的流量適用情況，推薦使用vnstat ~~~ sudo yum install vnstat 然后創建要統計的網卡的數據庫 sudo vnstat --create -i eth0 Creating database for interface "eth0"... Info: -> A new database has been created. Restart the vnStat daemon if it is currently running in order to start monitoring "eth0". 可以看到eth0網卡的數據庫已經建立，可以通過一下命令獲取統計結果 vnstat // 輸出本月和本日的統計信息 vnstat -l //顯示實時網絡狀態 vnstat --help //查看vnstat所有支持參數可以通過修改配置文件來修改寫入數據庫的頻率和顯示時的流量單位 sudo vim /etc/ ~~~ 修改UnitMode 0為UnitMode 1，就會以KB/MB/GB/TB為單位。 # 一鍵安裝 https://teddysun.com/448.html/comment-page-21 root 用戶登錄后，運行以下命令： ~~~ wget --no-check-certificate https://raw.githubusercontent.com/teddysun/across/master/l2tp.sh chmod +x l2tp.sh ./l2tp.sh ~~~