## 使用strongswan和xl2tpd配置l2tp over ipsec和Xauth

使用strongswan和xl2tpd配置l2tp over ipsec和Xauth

yum install -y strongswan xl2tpd

编辑 /etc/strongswan/ipsec.conf

	uniqueids = no

conn %default
    ikelifetime=3600s
    keylife=28800s
    rekeymargin=3h
    keyingtries=1
    keyexchange=ikev2
    mobike=no
    type=tunnel

conn yourconnectionname
 keyexchange=ikev1
 authby=xauthpsk
 xauth=server
 left=%defaultroute
 leftsubnet=0.0.0.0/0
 leftfirewall=no
 right=%any
 rightsubnet=192.168.201.0/24
 rightsourceip=192.168.201.1/24  #虚拟地址可不改
 rightdns=8.8.8.8
 auto=route
    ike=3des-sha1-modp1024!
    esp=3des-sha1!
#type=transport


conn L2TP-PSK
        ikelifetime=24h
        keylife=24h
        rekeymargin=30m
        keyingtries=1
        rekey=no

        keyexchange=ikev1
        left=10.10.1.100   #本机IP
        leftsubnet=0.0.0.0/0
        leftprotoport=17/1701
        authby=secret
        leftfirewall=no
        right=%any
        rightprotoport=17/%any
        type=transport
        auto=add
    #ike=3des-sha1-modp1024
    #esp=3des-sha1
    ike=aes256-sha1-modp1024,aes128-sha1-modp1024,3des-sha1-modp1024!
    esp=aes256-sha256,aes256-sha1,3des-sha1

编辑/etc/strongswan/ipsec.secrets

: PSK "pskpassword"
username %any : XAUTH "password"

编辑/etc/xl2tpd/xl2tpd.conf

[lns default]
ip range = 192.168.1.128-192.168.1.254
local ip = 192.168.1.1    ;此为虚拟地址，可不改
require chap = yes
refuse pap = yes
require authentication = yes
name = LinuxVPNserver
ppp debug = yes
pppoptfile = /etc/ppp/options.xl2tpd
length bit = yes

编辑/etc/ppp/options.xl2tpd

require-mschap-v2
ipcp-accept-local
ipcp-accept-remote
ms-dns  8.8.8.8
noccp
auth
crtscts
idle 1800
mtu 1410
mru 1410
nodefaultroute
debug
lock