Ubuntu20.04 搭建L2TP+IPsec客户端

1 安装

安装和strongswan。

sudo apt install xd
sudo apt install strongswan

2 ipsec配置

1）编辑**/etc/ipsec.conf**

conn my
    auto=add
    authby=secret
    type=transport
    left=%defaultroute
    leftprotoport=17/1701
    rightprotoport=17/1701
    # 服务器公网地址
    right=10.25.X.X
    forceencaps=yes
    keyexchange=ikev2
    ike=chacha20poly1305-sha512-curve25519-prfsha512
    esp=chacha20poly1305-sha512

2）编辑**/etc/ipsec.secrets** , 设置ipsec的预共享秘钥,

# This file holds shared secrets or RSA private keys for authentication.

# RSA private key for this host, authenticating it to any other host
# which knows the public part.
: PSK "123456"

配置完后修改权限

chmod 600 /etc/ipsec.secrets

3 配置

编辑**/etc/xd/xd.conf**

[lac my]
# 用户名
name = root
# 服务器地址
lns = 10.25.X.X
ppp debug = yes
# 
pppoptfile = /etc/ppp/options.d.client
length bit = yes

4 ppp配置

编辑PPP配置文件(例如上文中的**/etc/ppp/options.d.client**)。

ipcp-accept-local
ipcp-accept-remote
refuse-eap
require-chap
noccp
noauth
mtu 1280
mru 1280
noipdefault
defaultroute
usepeerdns
connect-delay 5000
# 用户名
name "root"
# 密码
password "root"

配置完后修改权限

chmod 600 /etc/ppp/options.d.client

5 启动脚本

# 创建xd控制文件
mkdir -p /var/run/xd
touch /var/run/xd/-control

# 停止已开启的VPN连接
echo "d my" > /var/run/xd/-control
ipsec down my

# 重启ipsec
ipsec restart
service xd restart

# 启动
ipsec up my
echo "c my" > /var/run/xd/-control

sleep 10

# 添加指向服务器私有地址的路由
route add -net 192.168.100.0 netmask 255.255.255.0 gw 192.168.100.210