一、环境
CentOS6.6 x64
EPEL扩展源

二、安装PPTP
1、加载支持模块

#modprobe ppp-compress-18 && echo MPPE is ok


2、安装epel源

#rpm -ivh http://mirrors.yun-idc.com/epel/6/x86_64/epel-release-6-8.noarch.rpm
或
#yum install epel-release

3、开启包转发

#sysctl -w net.ipv4.ip_forward=1


4、安装pptpd软件包

#yum install pptpd -y

5、修改pptpd中dns配置
#vim /etc/ppp/options.pptpd
ms-dns 8.8.8.8
ms-dns 8.8.4.4

6、添加用户名及密码

vim /etc/ppp/chap-secrets
username1    pptpd    passwd1    *
username2    pptpd    passwd2    *
说明：
 其中第一第三列分别是用户名和密码；第二列应该和上面的文件/etc/ppp/options.pptpd中name后指定的服务名称一致；最后一列限制客户端IP地址，星号表示没有限制。
7、修改pptpd.conf
#vim /etc/pptpd.conf
option /etc/ppp/options.pptpd      #指定使用/etc/ppp/options.pptpd中的配置
logwtmp          # #表示使用WTMP日志
localip 10.10.20.1          #可以随意填写IP,此处将是网关     
remoteip 10.10.20.200-210       #分配给客户端的一段ip
listen 172.16.16.93            #侦听的ip

8、启动守护进程
#service pptpd start

9、针对pptpd服务iptables规则

iptables -A INPUT -i eth1 -p gre -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 1723 -j ACCEPT
iptables -A OUTPUT -p tcp -m tcp --sport 1723 -j ACCEPT
iptables -A OUTPUT -p gre -j ACCEPT
iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE

9、重启防火墙
#service iptables restart

三、安装L2TP
1、安装依赖包

#yum install -y ppp iptables make gcc gmp-devel xmlto bison flex xmlto libpcap-devel lsof


2、下载并安装openswan扩展包

#wget https://download.openswan.org/openswan/openswan-2.6.47.1.tar.gz   #如果没有请下载最近的软件包
#tar zxvf openswan-2.6.47.1.tar.gz
#cd openswan-2.6.47.1
#make programs install

2、安装xl2tpd

#yum install xl2tpd -y

3、修改ipsec.conf
ipsec.conf配置文件以下是我的ip 172.16.16.93（请换上你的公网ip）
cat /etc/ipsec.conf
-----------------------
# /etc/ipsec.conf - Openswan IPsec configuration file

# This file:  /usr/local/share/doc/openswan/ipsec.conf-sample
#
# Manual:     ipsec.conf.5


version 2.0 # conforms to second version of ipsec.conf specification

# basic configuration
config setup
 # Do not set debug options to debug configuration issues!
 # plutodebug / klipsdebug = "all", "none" or a combation from below:
 # "raw crypt parsing emitting control klips pfkey natt x509 dpd private"
 # eg:
 # plutodebug="control parsing"
 # Again: only enable plutodebug or klipsdebug when asked by a developer
 #
 # enable to get logs per-peer
 # plutoopts="--perpeerlog"
 #
 # Enable core dumps (might require system changes, like ulimit -C)
 # This is required for abrtd to work properly
 # Note: incorrect SElinux policies might prevent pluto writing the core
 dumpdir=/var/run/pluto/
 #
 # NAT-TRAVERSAL support, see README.NAT-Traversal
 nat_traversal=yes
 # exclude networks used on server side by adding %v4:!a.b.c.0/24
 # It seems that T-Mobile in the US and Rogers/Fido in Canada are
 # using 25/8 as "private" address space on their 3G network.
 # This range has not been announced via BGP (at least upto 2010-12-21)
 virtual_private=%v4:10.10.20.0/24,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:25.0.0.0/8,%v6:fd00::/8,%v6:fe80::/10
 # OE is now off by default. Uncomment and change to on, to enable.
 oe=off
 # which IPsec stack to use. auto will try netkey, then klips then mast
 protostack=netkey
 # Use this to log to a file, or disable logging on embedded systems (like openwrt)
 #plutostderrlog=/dev/null

# Add connections here

# sample ××× connection
# for more examples, see /etc/ipsec.d/examples/
#conn sample
#  # Left security gateway, subnet behind it, nexthop toward right.
#  left=10.0.0.1
#  leftsubnet=172.16.0.0/24
#  leftnexthop=10.22.33.44
#  # Right security gateway, subnet behind it, nexthop toward left.
#  right=10.12.12.1
#  rightsubnet=192.168.0.0/24
#  rightnexthop=10.101.102.103
#  # To authorize this connection, but not actually start it,
#  # at startup, uncomment this.
#  #auto=add
conn L2TP-PSK-NAT
    rightsubnet=vhost:%priv
    also=L2TP-PSK-noNAT

conn L2TP-PSK-noNAT
    authby=secret
    pfs=no
    auto=add
    keyingtries=3
    rekey=no
    ikelifetime=8h
    keylife=1h
    type=transport
    left=172.16.16.93
    leftprotoport=17/1701
    right=%any
---------------------
4、设置ipsec预共享密钥
#vim /etc/ipsec.secrets
172.16.16.93 %any: PSK "123.com"
172.16.16.93改成你的公网ip,没有固定ip,用***动态域名   "123.c0m"换成你自己的


5、修改内核配置文件

#/etc/sysctl.conf中添加如下

net.ipv4.ip_forward = 1
net.ipv4.conf.default.rp_filter = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0
net.ipv4.conf.all.log_martians = 0
net.ipv4.conf.default.log_martians = 0
net.ipv4.conf.default.accept_source_route = 0
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv4.icmp_ignore_bogus_error_responses = 1


#sysctl -p
6、启动ipsec服务
#service ipsec start
7、检查ipsec服务
#ipsec verify
Checking if IPsec got installed and started correctly:

Version check and ipsec on-path                    [OK]
Openswan U2.6.47.1/K2.6.32-573.26.1.el6.x86_64 (netkey)
See `ipsec --copyright' for copyright information.
Checking for IPsec support in kernel               [OK]
 NETKEY: Testing XFRM related proc values
         ICMP default/send_redirects               [OK]
         ICMP default/accept_redirects             [OK]
         XFRM larval drop                          [OK]
Hardware random device check                       [N/A]
Two or more interfaces found, checking IP forwarding [OK]
Checking rp_filter                                 [ENABLED]
 /proc/sys/net/ipv4/conf/lo/rp_filter              [ENABLED]
 /proc/sys/net/ipv4/conf/eth0/rp_filter            [ENABLED]
 /proc/sys/net/ipv4/conf/eth1/rp_filter            [ENABLED]
Checking that pluto is running                     [OK]
 Pluto listening for IKE on udp 500                [OK]
 Pluto listening for IKE on tcp 500                [NOT IMPLEMENTED]
 Pluto listening for IKE/NAT-T on udp 4500         [OK]
 Pluto listening for IKE/NAT-T on tcp 4500         [NOT IMPLEMENTED]
 Pluto listening for IKE on tcp 10000 (cisco)      [NOT IMPLEMENTED]
Checking NAT and MASQUERADEing                     [TEST INCOMPLETE]
Checking 'ip' command                              [IP XFRM BROKEN]
Checking 'iptables' command                        [OK]

ipsec verify: encountered errors

说明：出现以信息表示正常

8、配置xl2tpd.conf
#vim /etc/xl2tpd/xl2tpd.conf
--------------------
; This is a minimal sample xl2tpd configuration file for use
; with L2TP over IPsec.
;
; The idea is to provide an L2TP daemon to which remote Windows L2TP/IPsec
; clients connect. In this example, the internal (protected) network
; is 192.168.1.0/24.  A special IP range within this network is reserved
; for the remote clients: 192.168.1.128/25
; (i.e. 192.168.1.128 ... 192.168.1.254)
;
; The listen-addr parameter can be used if you want to bind the L2TP daemon
; to a specific IP address instead of to all interfaces. For instance,
; you could bind it to the interface of the internal LAN (e.g. 192.168.1.98
; in the example below). Yet another IP address (local ip, e.g. 192.168.1.99)
; will be used by xl2tpd as its address on pppX interfaces.

[global]
listen-addr = 1172.16.16.93
;
; requires openswan-2.5.18 or higher - Also does not yet work in combination
; with kernel mode l2tp as present in linux 2.6.23+
ipsec saref = yes
; Use refinfo of 22 if using an SAref kernel patch based on openswan 2.6.35 or
;  when using any of the SAref kernel patches for kernels up to 2.6.35.
; saref refinfo = 30
;
; force userspace = yes
;
; debug tunnel = yes

[lns default]
ip range = 10.10.20.100-10.10.20.120      #客户端获取的ip地址范围
local ip = 10.10.20.1                                 #网关ip
require chap = yes
refuse pap = yes
require authentication = yes
name = Linux×××server
ppp debug = yes
pppoptfile = /etc/ppp/options.xl2tpd
length bit = yes

9、修改options.xl2tpd
#vim /etc/ppp/options.xl2tpd
ipcp-accept-local
ipcp-accept-remote
ms-dns 8.8.8.8
ms-dns  114.114.114.114
noccp
auth
crtscts
idle 1800
mtu 1410
mru 1410
nodefaultroute
debug
lock
proxyarp
connect-delay 5000
logfile /var/log/xl2tpd.log

10、添加L2TP账号
#vim /etc/ppp/chap-secrets
username  * passwd *   
第一个*表示既支持L2TP 也可以支持PPTP   第二个*既可以指定 ip也可以不指定ip


四、防火墙规则

#cat /etc/sysconfig/iptabels

# Generated by iptables-save v1.4.7 on Tue Apr 11 18:22:14 2017
*filter
:INPUT DROP [144:39853]
:FORWARD DROP [13:520]
:OUTPUT DROP [4:478]
-A INPUT -i eth1 -p gre -j ACCEPT
-A INPUT -s 10.168.118.0/24 -j ACCEPT
-A INPUT -s 10.10.20.0/24 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --sport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --sport 443 -m state --state NEW,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --dport 1723 -j ACCEPT-A INPUT -p udp --dport 500 -j ACCEPT
-A INPUT -p udp --dport 1701 -j ACCEPT-A INPUT -p udp --dport 4500 -j ACCEPT
-A INPUT -p tcp -m tcp --sport 25 -m state --state ESTABLISHED -j ACCEPT
-A INPUT -p icmp -m state --state RELATED,ESTABLISHED -j ACCEPT-A INPUT -p udp -m udp --sport 53 -j ACCEPT
-A FORWARD -s 10.10.20.0/24 -j ACCEPT
-A FORWARD -d 10.10.20.0/24 -j ACCEPT-A FORWARD -i ppp+ -o eth1 -j ACCEPT
-A FORWARD -i eth1 -o ppp+ -j ACCEPT
-A OUTPUT -d 10.168.118.0/24 -j ACCEPT
-A OUTPUT -d 10.10.20.0/24 -j ACCEPT
-A OUTPUT -p gre -j ACCEPT
-A OUTPUT -p udp -m udp --dport 53 -j ACCEPT
-A OUTPUT -p udp -m udp --dport 123 -j ACCEPT
-A OUTPUT -p icmp -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A OUTPUT -p udp -m udp --sport 500 -j ACCEPT
-A OUTPUT -p udp -m udp --sport 1701 -j ACCEPT
-A OUTPUT -p udp -m udp --sport 4500 -j ACCEPT
-A OUTPUT -p tcp -m tcp --sport 1723 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 25 -j ACCEPT
-A OUTPUT -m state --state ESTABLISHED -j ACCEPT
COMMIT
# Completed on Tue Apr 11 18:22:14 2017
# Generated by iptables-save v1.4.7 on Tue Apr 11 18:22:14 2017
*nat
:PREROUTING ACCEPT [22:1140]
:POSTROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A POSTROUTING -o eth1 -j MASQUERADE
-A POSTROUTING -o eth1 -j MASQUERADE
-A POSTROUTING -s 10.10.20.0/24 -o eth1 -j MASQUERADECOMMIT
# Completed on Tue Apr 11 18:22:14 2017


五、说明

苹果手机使用l2tp时记得填写预共享密钥123.com(本例);ubuntu 上建立点到点协议pptp时需要在高级中启用MPPE加密



六、参考文档:
http://wzlinux.blog.51cto.com/8021085/1735374
http://dingxuan.info/blog/post/setup-l2tp-***-server-with-ipsec-in-centos6.php