CentOS7搭建L2TP over IPsec

CentOS7搭建L2TP over IPsec

一、检测服务器是否搭建

先看看你的主机是否支持pptp，返回结果为yes就表示通过。

modprobe ppp-compress-18 && echo yes

是否开启了TUN，有的虚拟机主机需要开启

cat /dev/net/tun
cat: /dev/net/tun: File descriptor in bad state # 表示通过

二、正式搭建命令

安装epel软件源

yum install -y epel-release

安装依赖

yum install -y make gcc gmp-devel xmlto bison flex xmlto libpcap-devel lsof vim-enhanced man xl2tpd libreswan nano

编辑pppoptfile文件

vim /etc/ppp/options.xl2tpd

添加:require-mschap-v2

require-mschap-v2
ipcp-accept-local
ipcp-accept-remote
ms-dns 8.8.8.8
ms-dns 1.1.1.1
# ms-dns 192.168.1.1
# ms-dns 192.168.1.3
# ms-wins 192.168.1.2
# ms-wins 192.168.1.4
noccp
auth
#obsolete: crtscts
idle 1800
mtu 1410
mru 1410
nodefaultroute
debug
#obsolete: lock
proxyarp
connect-delay 5000
# To allow authentication against a Windows domain EXAMPLE, and require the
# user to be in a group "VPN Users". Requires the samba-winbind package
# require-mschap-v2
# plugin winbind.so
# ntlm_auth-helper '/usr/bin/ntlm_auth --helper-protocol=ntlm-server-1 --require-membership-of="EXAMPLE\\VPN Users"'
# You need to join the domain on the server, for example using samba:
# http://rootmanager.com/ubuntu-ipsec-l2tp-windows-domain-auth/setting-up-openswan-xl2tpd-with-native-windows-clients-lucid.html

修改L2tp的配置文件

vim /etc/xl2tpd/xl2tpd.conf

;

; This is a minimal sample xl2tpd configuration file for use

; with L2TP over IPsec.

;

; The idea is to provide an L2TP daemon to which remote Windows L2TP/IPsec

; clients connect. In this example, the internal (protected) network

; is 192.168.1.0/24. A special IP range within this network is reserved

; for the remote clients: 192.168.1.128/25

; (i.e. 192.168.1.128 ... 192.168.1.254)

;

; The listen-addr parameter can be used if you want to bind the L2TP daemon

; to a specific IP address instead of to all interfaces. For instance,

; you could bind it to the interface of the internal LAN (e.g. 192.168.1.98

; in the example below). Yet another IP address (local ip, e.g. 192.168.1.99)

; will be used by xl2tpd as its address on pppX interfaces.

[global]

listen-addr = 192.168.5.243 #改成自己的网卡IP

;

; requires openswan-2.5.18 or higher - Also does not yet work in combination

; with kernel mode l2tp as present in linux 2.6.23+

ipsec saref = yes #去掉；注释号

; Use refinfo of 22 if using an SAref kernel patch based on openswan 2.6.35 or

; when using any of the SAref kernel patches for kernels up to 2.6.35.

; saref refinfo = 30

;

; force userspace = yes

;

; debug tunnel = yes

[lns default]

ip range = 192.168.1.100-192.168.1.200 #分配给VPN客户端的IP，这个可以随便用，但是后面对应的要改

local ip = 192.168.1.99 #本地的IP网段一致不要被分配就行

require chap = yes

refuse pap = yes

require authentication = yes

name = LinuxVPNserver

ppp debug = yes

pppoptfile = /etc/ppp/options.xl2tpd

length bit = yes

添加账号密码

vim /etc/ppp/chap-secrets

使用tab键分割

# Secrets for authentication using CHAP 
#client		server	secret		IP addresses
test            *       123456          *

创建预共享密钥

vim /etc/ipsec.d/ipsec.secrets

替换公网IP

#include /etc/ipsec.d/*.secrets 
公网IP  %any: PSK "123456"

修改内核参数

vim /etc/sysctl.conf

net.ipv4.ip_forward = 1
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.rp_filter = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv4.conf.default.rp_filter = 0
net.ipv4.conf.default.send_redirects = 0
net.ipv4.conf.eth0.accept_redirects = 0
net.ipv4.conf.eth0.rp_filter = 0
net.ipv4.conf.eth0.send_redirects = 0
net.ipv4.conf.lo.accept_redirects = 0
net.ipv4.conf.lo.rp_filter = 0
net.ipv4.conf.lo.send_redirects = 0

注：注意将eth0换成自己的网卡

加载内核参数

sysctl -p

建立ipsec 与 l2tp 服务关联的配置文件

vim /etc/ipsec.d/l2tp_psk.conf

修改left值为网卡IP

conn L2TP-PSK-NAT
    rightsubnet=vhost:%priv
    also=L2TP-PSK-noNAT
conn L2TP-PSK-noNAT
    authby=secret
    pfs=no
    auto=add
    keyingtries=3
    dpddelay=30
    dpdtimeout=120
    dpdaction=clear
    rekey=no
    ikelifetime=8h
    keylife=1h
    type=transport
    left=10.20.120.2
    leftprotoport=17/1701
    right=%any
    rightprotoport=17/%any

iptables安装配置

yum install -y iptables
yum install -y iptables-services
systemctl stop firewalld
systemctl mask firewalld
iptables -L -n
iptables -P INPUT ACCEPT
iptables -F
iptables -X
iptables -Z
iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -o eth0 -j MASQUERADE
iptables -I FORWARD -s 192.168.1.0/24 -j ACCEPT
iptables -I FORWARD -d 192.168.1.0/24 -j ACCEPT
 
iptables -A INPUT -p udp -m policy --dir in --pol ipsec -m udp --dport 1701 -j ACCEPT
iptables -A INPUT -p udp -m udp --dport 1701 -j ACCEPT
iptables -A INPUT -p udp -m udp --dport 500 -j ACCEPT
iptables -A INPUT -p udp -m udp --dport 4500 -j ACCEPT
iptables -A INPUT -p esp -j ACCEPT
iptables -A INPUT -m policy --dir in --pol ipsec -j ACCEPT
 
iptables -A FORWARD -i ppp+ -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
 
service iptables save
/bin/systemctl restart iptables.service

启动

systemctl start ipsec
systemctl enable ipsec
ipsec verify
systemctl start xl2tpd
systemctl enable xl2tpd
systemctl status xl2tpd

使用预共享密钥的L2TP/IPsec
服务器地址：
预共享密钥：123456
账号一：test
密码：123456