OpenSwan在CentOS6.4上的编译安装与配置

1，运行以下命令

sysctl -a | egrep "ipv4.*(accept|send)_redirects" | awk -F "=" '{print $1"= 0"}' >> /etc/sysctl.conf 

sed -i "s/net.ipv4.ip_forward = 0/net.ipv4.ip_forward = 1/g" /etc/sysctl.conf

sed -i "s/net.ipv4.conf.default.rp_filter = 1/net.ipv4.conf.default.rp_filter = 0/g" /etc/sysctl.conf

modprobe bridge

sysctl -p

2，安装编译工具

yum install -y make gcc autoconf gmp-devel bison flex lsof

3，安装openswan

wget http://download.openswan.org/openswan/openswan-2.6.39.tar.gz

tar zxvf openswan-2.6.39

make programs

make install

4，修改配置ipsec.conf

version 2.0

config setup

        dumpdir=/var/run/pluto/

        nat_traversal=yes

        virtual_private=%v4:10.0.0.0/8,%v4:172.16.0.0/12,%v4:192.168.0.0/16

        oe=off

        protostack=netkey

        plutostderrlog=/var/log/ipsec.log

conn 1to2

        type=tunnel

        authby=secret

        pfs=yes

        ike=3des-md5;modp1024

        phase2alg=3des-md5;modp1024

        left=10.1.1.1

        leftsubnet=192.168.1.0/24

        right=10.1.1.2

        rightsubnet=192.168.2.0/24

        auto=start

5，修改密钥文件ipsec.secrets

10.1.1.1 10.1.1.2: PSK "test"

6，验证

service ipsec start

ipsec verify

ipsec auto --status

7，添加路由

PC1（192.168.1.2）

route add -net 192.168.2.0 netmask 255.255.255.0 gw 192.168.1.1

PC2（192.168.2.2）

route add -net 192.168.1.0 netmask 255.255.255.0 gw 192.168.2.1

 

FY：安装klips核

安装内核

yum install kernel-devel

yum install rpm-build redhat-rpm-config unifdef rng-tools

yum install patchutils xmlto asciidoc elfutils binutils-libelf-devel newt-devel python-devel hmaccalc perl-ExtUtils-Embed elfutils-libelf-devel binutils-devel

rpm -i http://vault.centos.org/6.4/updates/Source/SPackages/kernel-2.6.32-358.18.1.el6.src.rpm 2>&1 | grep -v mockb

cd ~/rpmbuild/SPECS

预备源代码文件

rpmbuild -bp --target=$(uname -m) kernel.spec

编译

rpmbuild -bb --target=$(uname -m) kernel.spec 2> prep-err.log | tee prep-out.log

编译出的内核 rpm 文件可以在 ~/rpmbuild/RPMS/`uname -m`/ 目录内找到

安装并重启

rpm -ivh kernel-*.rpm

 

klips编译

make programs

make module

make install

make minstall

cp /root/openswan-2.6.39/modobj26/ipsec.ko /lib/modules/$(uname -m)/kernel/net/ipsec