L2tp/Ipsec的搭建与使用

1.直接上活，如果看到了这篇文章肯定兜了解了是干嘛的，不懂得直接百度吧！这里主要用来在家办公使用。

2.主机是否支持pptp，返回结果为yes就表示通过。

    modprobe ppp-compress-18 && echo yes

3.是否开启了TUN，有的虚拟机主机需要开启，返回结果为cat: /dev/net/tun: File descriptor in bad state。就表示通过。

   cat /dev/net/tun

4.安装EPEL源（CentOS7官方源中已经去掉了xd）

   yum install -y epel-release

5.安装xd和libreswan(openswan已经停止维护)

   yum install -y xd libreswan lsof

6.编辑xd配置文件并修改

[root@localhost ~]# cat /etc/xd/xd.conf
;
; This is a minimal sample xd configuration file for use
; with L2TP over IPsec.
;
; The idea is to provide an L2TP daemon to which remote Windows L2TP/IPsec
; clients connect. In this example, the internal (protected) network
; is 192.168.1.0/24.  A special IP range within this network is reserved
; for the remote clients: 192.168.1.128/25
; (i.e. 192.168.1.128 ... 192.168.1.254)
;
; The listen-addr parameter can be used if you want to bind the L2TP daemon
; to a specific IP address instead of to all interfaces. For instance,
; you could bind it to the interface of the internal LAN (e.g. 192.168.1.98
; in the example below). Yet another IP address (local ip, e.g. 192.168.1.99)
; will be used by xd as its address on pppX interfaces.

[global]
; listen-addr = 192.168.1.98
;
; requires openswan-2.5.18 or higher - Also does not yet work in combination
; with kernel mode as present in linux 2.6.23+
; ipsec saref = yes
; Use refinfo of 22 if using an SAref kernel patch based on openswan 2.6.35 or
;  when using any of the SAref kernel patches for kernels up to 2.6.35.
; saref refinfo = 30
;
; force userspace = yes
;
; debug tunnel = yes

[lns default]
ip range = 192.168.x.xxx-192.168.x.xxx
local ip = 192.168.x.xxx
require chap = yes
refuse pap = yes
require authentication = yes
name = LinuxVPNserver
ppp debug = yes
pppoptfile = /etc/ppp/options.xd
length bit = yes

7.编辑pppoptfile文件

   [root@localhost ~]# cat /etc/ppp/options.xd
ipcp-accept-local
ipcp-accept-remote
ms-dns  202.106.0.20
ms-dns  114.114.114.114
# ms-wins 192.168.1.2
# ms-wins 192.168.1.4
name xd
#noccp
auth
#crtscts
idle 1800
mtu 1410
mru 1410
nodefaultroute
debug
#lock
proxyarp
connect-delay 5000
refuse-pap
refuse-mschap
require-mschap-v2
persist
logfile /var/log/xd.log

8.编辑ipsec配置文件并修改

[root@localhost ~]# cat /etc/ipsec.conf
# /etc/ipsec.conf - Libreswan IPsec configuration file
#
# see 'man ipsec.conf' and 'man pluto' for more information
#
# For example configurations and documentation, see https://libreswan.org/wiki/

config setup
    # Normally, pluto logs via syslog.
    #logfile=/var/log/pluto.log
    #
    # Do not enable debug options to debug configuration issues!
    #
    # plutodebug="control parsing"
    # plutodebug="all crypt"
    plutodebug=netkey
    #
    # NAT-TRAVERSAL support
    # exclude networks used on server side by adding %v4:!a.b.c.0/24
    # It seems that T-Mobile in the US and Rogers/Fido in Canada are
    # using 25/8 as "private" address space on their wireless networks.
    # This range has never been announced via BGP (at least up to 2015)
    dumpdir=/var/run/pluto/
        virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:25.0.0.0/8,%v4:100.64.0.0/10,%v6:fd00::/8,%v6:fe80::/10
    #virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:25.0.0.0/8,%v4:100.64.0.0/10,%v6:fd00::/8,%v6:fe80::/10

# if it exists, include system wide crypto-policy defaults
# include /etc/crypto-policies/back-ends/libreswan.config

# It is best to add your IPsec connections as separate files in /etc/ipsec.d/
include /etc/ipsec.d/*.conf

9.编辑-ipsec.conf配置文件并修改

[root@localhost ~]# cat /etc/ipsec.d/-ipsec.conf
conn L2TP-PSK-NAT
    rightsubnet=0.0.0.0/0
    dpddelay=10
    dpdtimeout=20
    dpdaction=clear
    forceencaps=yes
    also=L2TP-PSK-noNAT
conn L2TP-PSK-noNAT
    authby=secret
    pfs=no
    auto=add
    keyingtries=3
    rekey=no
    ikelifetime=8h
    keylife=1h
    type=transport
    left=192.168.5.111
    leftprotoport=17/1701
    right=%any
    rightprotoport=17/%any

10.设置预共享密钥PSK

    [root@localhost ~]# cat /etc/ipsec.d/default.secrets
     %any  %any  : PSK "xxxxxxxxx"

11.设置用户名密码

     [root@localhost ~]# cat /etc/ppp/chap-secrets
      # Secrets for authentication using CHAP
      # client    server    secret            IP addresses
      用户名    *       密码       * 

12.CentOS7 防火墙设置   

firewall-cmd --permanent --add-service=ipsec      # 放行ipsec服务，安装时会自定生成此服务
firewall-cmd --permanent --add-port=1701/udp      # x 的端口，默认1701. 
firewall-cmd --permanent --add-port=4500/udp 
firewall-cmd --permanent --add-masquerade      # 启用NAT转发功能。必须启用此功能
firewall-cmd --reload      # 重载配置

13.系统内核设置

   net.ipv4.ip_forward = 1
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.rp_filter = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv4.conf.default.rp_filter = 0
net.ipv4.conf.default.send_redirects = 0
net.ipv4.conf.eth0.accept_redirects = 0
net.ipv4.conf.eth0.rp_filter = 0
net.ipv4.conf.eth0.send_redirects = 0
net.ipv4.conf.eth1.accept_redirects = 0
net.ipv4.conf.eth1.rp_filter = 0
net.ipv4.conf.eth1.send_redirects = 0
net.ipv4.conf.eth2.accept_redirects = 0
net.ipv4.conf.eth2.rp_filter = 0
net.ipv4.conf.eth2.send_redirects = 0
net.ipv4.conf.ip_vti0.accept_redirects = 0
net.ipv4.conf.ip_vti0.rp_filter = 0
net.ipv4.conf.ip_vti0.send_redirects = 0
net.ipv4.conf.lo.accept_redirects = 0
net.ipv4.conf.lo.rp_filter = 0
net.ipv4.conf.lo.send_redirects = 0
net.ipv4.conf.ppp0.accept_redirects = 0
net.ipv4.conf.ppp0.rp_filter = 0
net.ipv4.conf.ppp0.send_redirects = 0

 

sysctl -p    # 加载内核参数使生效

14.启动ipsec服务

   systemctl enable ipsec.service     # 设为开机启动

   systemctl start ipsec.service     # 启动服务

15.ipsec verify     # 检查命令

    遇到问题解决办法（灵活运用）

    echo 0 > /proc/sys/net/ipv4/conf/eth3/rp_filter 我这里是eth3

16.启动x服务

     systemctl enable xd.service      # 设为卡机启动

     systemctl start xd.service      # 启动x

17.搭建完毕  至于客户端连接 遇到问题百度即可 哈哈

18.脚本下载地址https://blog.51cto.com/5001660/2296490