openswan安装配置手册(RSA)

下载地址:www.openswan.org/download
下载源码包:openswan-2.6.32.tar.gz
64 位CentOS 5.8 系统环境
1,解压编译安装openswan
tar -xvf openswan-2.6.32.tar.gz
cd openswan-2.6.32
make programs
make install

ipsec --version
Linux Openswan 2.6.32 (netkey)
See `ipsec --copyright' for copyright information.

2,修改系统配置文件
echo “0” > /selinux/enforce (service selinux stop)
sysctl -a | egrep "ipv4.*(accept|send)_redirects" | awk -F "=" '{print $1"= 0"}' >> /etc/sysctl.conf
vi /etc/sysctl.conf   将下面两项
net.ipv4.ip_forward = 0
net.ipv4.conf.default.rp_filter = 1
改为
net.ipv4.ip_forward = 1
net.ipv4.conf.default.rp_filter = 0
执行以下命令使设置生效
sysctl -p 

3,配置SA,CA和SB,CB的ip地址
CA: 192.168.11.25
SA: eth0 192.168.11.215, eth1 192.168.13.215
CB: 192.168.15.191
SB: eth0 192.168.15.214, eth1 192.168.13.214

4,在SA和SB下分别执行以下命令,配置NAT表,为数组包加伪装
在SA上执行以下命令
iptables -t nat -A POSTROUTING -o eth1 -s 192.168.11.0/24 ! -d 192.168.15.0/24 -j MASQUERADE
在SB上执行以下命令
iptables -t nat -A POSTROUTING -o eth1 -s 192.168.15.0/24 ! -d 192.168.11.0/24 -j MASQUERADE  

5,生成RSA密钥
SA:ipsec newhostkey --output /etc/ipsec.secrets
ipsec showhostkey --left
SB:ipsec newhostkey --output /etc/ipsec.secrets
ipsec showhostkey --right
6,配置/etc/ipsec.conf文件
SA:vim /etc/ipsec.conf

conn net-net
auto=add (start)

	left=192.168.13.215
	leftsubnet=192.168.11.0/24
	leftid=@192.168.13.215
	leftrsasigkey=0sAQN6LeaT4+zbXLzVbQ4F3YOZd5G47vMf4OiCNXkWgDe5r2AAA0+sIMp5C//fEDk8WUvH3t8FuwLW1bDdXO6ZNQejdAia074cvyhNn0Ru2RIQRS8JaDI1lRUmogK24uP+gm9pVA+UJKX5ipzLHvjO19xhnyvH6Yomhz2Eop6LYlx5IEkanLvG6yXhPrY7xPk4zoONkmKtx0Vj/jkxWby66fnc06eyAVY1yvw3xZ6IUnWw0Lg8WCZ/O06K1gvZ0WUJuyARnNYbO3hAQQ1DUM8KiKL0NtiTnNAYMv6e4p9yB+nJv3BgZrxZbq8YB5icif9zIango3QGDrK6I4C9Yvre3WSsjM4dBgCRV3SrsNqhzjrdUn3Z
	leftnexthop=%defaultroute

	right=192.168.13.214
	rightsubnet=192.168.15.0/24
rightid=@192.168.13.214
	rightrsasigkey=0sAQOM9iwp+nY6LBTZmuVCT1xod9SILPiWFJ+orYCvssYe2c0HWpsQH5lt5YffJ5JC7KxBHBrVEZvbJ+m+L3k6720VzFTbtB4/sOsP9PdNFz7JJk8dba55IP9+Op6FlZAcW7NbdL7xlL0KZoPekswd9JfzZ+TcHmwnfkLvO0pghjzZCRYi3CJO5nEoD2x8EDq4o+8D/D46f72UNWweCO4kqrPeHpF22sxUhAG3Ul2PGc9f76sNjUfVbGUGi9XX4MUotw/0blp2xYHPxVh/U7DbOG4rqChW3LF1yo6+atQUSMa2XvihXYwjfFEfP+uZH4Uku2KK4At6ZTdxx97Z+oxlkUapSp/jz4qQAK1NnOjl3PYyw40h
	rightnexthop=%defaultroute

SB:与SA所执行操作完全相同
service ipsec restart (service ipsec status)
7,启动openswan虚拟vpn
在SA和SB上分别执行以下命令,启动ipsec
ipsec auto --add net-net
ipsec auto --up net-net
8 验证ipsec是否配置成功
在网络层进行通信(飞秋),在SA或SB上tcpdump命令抓包验证
tcpdump –i eth0 host 192.168.11.11 and 192.168.15.15