一、环境
系统:CentOS 6.4x64最小化安装
R-Server eth0 192.168.3.72
eth1 10.1.1.72
R-Client eth0 10.1.1.74
L-Server eth0 192.168.3.71
eth1 172.16.10.71
L-Client eth0 172.16.10.74
注:所有在R-Client和L-Client都通过各自的网关ssh过去进行操作
二、R-Server和L-Server配置epel源和ntp时间同步
R-Server:
[root@R-Server ~]# rpm -ivh http://download.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm Retrieving http://download.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm warning: /var/tmp/rpm-tmp.xTUJx4: Header V3 RSA/SHA256 Signature, key ID 0608b895: NOKEY Preparing... ########################################### [100%] 1:epel-release ########################################### [100%] [root@R-Server ~]# sed -i 's@#b@b@g' /etc/yum.repos.d/epel.repo [root@R-Server ~]# sed -i 's@mirrorlist@#mirrorlist@g' /etc/yum.repos.d/epel.repo [root@R-Server ~]# yum -y install ntp [root@R-Server ~]# echo "*/10 * * * * /usr/sbin/ntpdate asia.pool.ntp.org &>/dev/null" >/var/spool/cron/root [root@R-Server ~]# ntpdate asia.pool.ntp.org 5 Jun 10:07:39 ntpdate[1563]: step time server 218.189.210.3 offset 157.466990 sec [root@R-Server ~]# hwclock -w
三、安装前系统初始化
R-Server和L-Server执行同样的操作
开启路由转发
[root@R-Server ~]# egrep "ip_forward|rp_filter" /etc/sysctl.conf net.ipv4.ip_forward = 1 net.ipv4.conf.default.rp_filter = 0 #确保这里的值是正确的
禁用icmp重定向
[root@R-Server ~]# sysctl -a | egrep "ipv4.*(accept|send)_redirects" | awk -F "=" '{print $1"= 0"}' >>/etc/sysctl.conf [root@R-Server ~]# sysctl -p net.ipv4.ip_forward = 1 net.ipv4.conf.default.rp_filter = 0 net.ipv4.conf.default.accept_source_route = 0 kernel.sysrq = 0 kernel.core_uses_pid = 1 net.ipv4.tcp_syncookies = 1 kernel.msgmnb = 65536 kernel.msgmax = 65536 kernel.shmmax = 68719476736 kernel.shmall = 4294967296 net.ipv4.conf.all.accept_redirects = 0 net.ipv4.conf.all.send_redirects = 0 net.ipv4.conf.default.accept_redirects = 0 net.ipv4.conf.default.send_redirects = 0 net.ipv4.conf.lo.accept_redirects = 0 net.ipv4.conf.lo.send_redirects = 0 net.ipv4.conf.eth0.accept_redirects = 0 net.ipv4.conf.eth0.send_redirects = 0 net.ipv4.conf.eth1.accept_redirects = 0 net.ipv4.conf.eth1.send_redirects = 0
四、安装openswan
R-Server和L-Server都进行同样的操作
#安装openswan基础环境及工具 [root@L-server ~]# yum install ipsec-tools gmp gmp-devel gawk flex bison gcc make -y #下载openswan [root@L-server ~]# wget https://download.openswan.org/openswan/old/openswan-2.6/openswan-2.6.38.tar.gz --no-check-certificate [root@L-server ~]# tar xf openswan-2.6.38.tar.gz [root@L-server ~]# cd openswan-2.6.38 [root@L-server openswan-2.6.38]# make programs [root@L-server openswan-2.6.38]# make install
五、认证和配置
5.1 RSA Signature(RSA数字签名)认证的配制
Openswan支持许多不同的认证方式,包括RSA keys、pre-shared keys或x.509证书方式。RSA Signature比较简单,我先介绍下所要使用的命令
生成一个新的RSA密钥对
ipsec newhostkey –output /etc/ipsec.secert
按left或right格式生成RSA Sig
ipsec showhostkey –left(或–right)
知道了上面的命令,我们就可以配置一个net-to-net,就是网关对网关的通讯。所在的Linux主机为通讯的网关,作为其子网的出口,对于子网的用户来所是透明的,远程的子网在通讯后可以像自己的局域网一样的访问。
L-Sserver:
#缩短rsa的生成时间 [root@L-Server ~]# rm -rf /dev/random [root@L-Server ~]# ln -s /dev/urandom /dev/random #生成key [root@L-Server ~]# ipsec newhostkey --output /etc/ipsec.secrets Generated RSA key pair using the NSS database [root@L-Server ~]# ipsec showhostkey --left
L-Sserver:
编辑/etc/ipsec.conf文件
[root@L-server ~]# egrep -v "^$|^#|^[[:space:]]+#" /etc/ipsec.conf version 2.0 # conforms to second version of ipsec.conf specification config setup dumpdir=/var/run/pluto/ nat_traversal=yes virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12 oe=off protostack=netkey conn net-to-net left=192.168.3.71 leftsubnet=172.16.10.0/24 leftrsasigkey=0sAQOBHsPOY0RRGG24PHLgqal2L4OBfvHcY3FWOIi1dZYbro+BF7JbRaAkYEoGJSY5T5gxRIhA4vRgigkGdy165C1VKxA+Xm8uRgUr/CrxtvTNLkw1aybql4j3JdSdExjmdf12BXQdPZTg0j+KUmMb7EOmH07njok9CZhnTNew7DYCoXnelQYJjjxehoCiLUdTQ60JG5ZZIn2F+VOmvKWq7s0pWk0m4KGG7iljMsRtQEcjesUwvEgxiOx5QjxPy2KB4WJNUN+mDFiBpbEiLhPQ5mF1yZbA4DuQHWrx73GSBuPPzovHxPDQMie9skINMqBC0uL9wzD+P62daAQnfOegzZ2O5hmQSqqHlJ5PWKF1dL1AqiDr leftnexthop=%defaultroute right=192.168.3.72 rightsubnet=10.1.1.0/24 rightrsasigkey=0sAQNvIi8K/UpB8MShEl4Jr1W9Ef9OXMiYpbUCON0o5siiD19ubVSZS1C5UW2r8Wapxo/mLFMfebsEUfaOpSx0wxsyfV3RbrYDmEI1DLoGR+Ki3MljSgF0+m8vqr4kIe5FL7FUYndQMlMbvgVP+RE4cdJ2EEsxDAY52oLAjsnl7AfDgXzCiMirxWMfMJwg6vAxA2SmYx/sUyawcsfKZXmwEfRgCsHsZcpqR39ulXrmK/o7nHsta9DJxOop6Gq8aUyOG/a3n5XfLhTkFnECfPPZq3LYknTN1HSYlpW4apoECvwfs/9eXqpzr3GeV5jiSbWU/ktV9e9dJM7sdR5QMR24F+7uDvbynH7OtMWjB1kaVm5yWm2L rightnexthop=%defaultroute auto=start #重启ipsec服务 [root@L-server ~]# /etc/init.d/ipsec restart ipsec_setup: Stopping Openswan IPsec... ipsec_setup: Starting Openswan IPsec U2.6.38/K2.6.32-358.el6.x86_64...
R-Sserver:
#从L-Server上复制ipsec.conf文件过来 [root@L-server ~]# scp /etc/ipsec.conf 192.168.3.72:/etc #重启ipsec服务 [root@R-server ~]# /etc/init.d/ipsec restart
注:openswan连通后***server也无法ping通对端内网ip地址(软件bug),openswan连通后,两端内网的机器可以相互通讯
转载于:https://blog.51cto.com/ly36843/1658387