使用L2TP+IPSec搭建VPN(避坑)
出于对自动脚本的不信任,决定手动搭建一个L2TP/IPSEC,参考许多网络资料,踩了不少坑,历时半个多小时排除错误,在这里整理一下搭建步骤
贴心提示
在搭建前可以提前在客户端(Windows/Android/ios)的配置界面参考下L2TP/IPSEC连接需要哪些必要参数,这样在做配置的时候心里就知道这个参数/密钥是做什么用的,以下列出连接所必须的参数
- L2TP/IPSec必备参数
- 服务器地址
- 共享密钥
- 账户
- 密码
- L2TP/IPSec类型(使用密码的PSK类型,类型选择L2TP/IPSec PSK即可)
必要设置
内容 | 说明 |
---|---|
openswan(IPSec) | 设置密钥的工具 |
ppp | 设置用户名和密码 |
xl2tpd | 由它来提供L2TP服务 |
sysctl | 系统配置设置网卡允许转发流量请求 |
iptables | 防火墙,负责转发流量(firewalld也行,本文不提供Firewalld设置参考) |
安装VPN
依赖安装
yum update
yum install -y make gcc gmp-devel xmlto bison flex xmlto libpcap-devel lsof vim-enhanced man
openswan与ppp安装配置与运行
安装
yum -y install openswan ppp
配置IPSec:修改/etc/ipsec.conf,可参考以下设置文件,注意更改left与leftid为你的服务器IP
config setup nat_traversal=yes virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12 oe=off protostack=netkey conn L2TP-PSK-NAT rightsubnet=vhost:%priv also=L2TP-PSK-noNAT conn L2TP-PSK-noNAT authby=secret pfs=no auto=add keyingtries=3 rekey=no # 这三项关乎到iPhone/Android等移动端能否正常连接 dpddelay=30 dpdtimeout=120 dpdaction=clear ikelifetime=8h keylife=1h type=transport left=[你的服务器IP地址] leftid=[你的服务器IP地址] # 这项关乎到iPhone/Android等移动端能否正常连接 leftnexthop=%defaultroute leftprotoport=17/1701 right=%any rightprotoport=17/%any # 这两项关乎到iPhone/Android等移动端能否正常连接 rightnexthop=%defaultroute forceencaps=yes
设置共享密钥:修改/etc/ipsec.secrets
[你的服务器IP地址] %any: PSK "[你的共享密钥]"
配置账户/密码,修改/etc/ppp/chap-secrets
账户 * 密码 *
运行openswan与ppp
ipsec setup restart systemctl enable ipsec # 开机自启
xl2tpd的安装配置与运行
尝试直接安装xl2tpd
yum install xl2tpd
不出意外应该失败,直接从fedoraproject.org下载安装包并安装(如果链接失效,请访问dl.fedoraproject.org/pub/epel/手动查找xl2tpd安装包并手动安装)
wget https://dl.fedoraproject.org/pub/epel/6/x86_64/Packages/x/xl2tpd-1.3.8-1.el6.x86_64.rpm yum install xl2tpd-1.3.8-1.el6.x86_64.rpm
对xl2tpd进行配置,修改/etc/xl2tpd/xl2tpd.conf,写入下面的配置
[global] ipsec saref = yes listen-addr = [你的服务器IP地址] [lns default] ip range = 192.168.1.2-192.168.1.100 local ip = 192.168.1.1 refuse chap = yes refuse pap = yes require authentication = yes ppp debug = yes pppoptfile = /etc/ppp/options.xl2tpd length bit = yes
对xl2tpd进行配置,修改/etc/ppp/options.xl2tpd,继续写入下面的配置(如已存在的配置信息记得要修改,避免出现多次设置同一个值)
mtu 1400 noccp connect-delay 5000 require-mschap-v2 ms-dns 8.8.8.8 ms-dns 8.8.4.4 asyncmap 0 auth crtscts lock hide-password modem debug name l2tpd proxyarp lcp-echo-interval 30 lcp-echo-failure 4
启动xl2tpd
systemctl restart xl2tpd systemctl enable xl2tpd
sysctl与iptables设置
设置sysctl允许转发,修改/etc/sysctl.conf文件,找到下面几个选项并更改值(如不存在则直接写道文件末尾)
net.ipv4.ip_forward = 1 net.ipv4.conf.default.rp_filter = 0 net.ipv4.conf.default.accept_source_route = 0 net.ipv4.conf.all.send_redirects = 0 net.ipv4.conf.default.send_redirects = 0 net.ipv4.conf.all.log_martians = 0 net.ipv4.conf.default.log_martians = 0 net.ipv4.conf.all.accept_redirects = 0 net.ipv4.conf.default.accept_redirects = 0 net.ipv4.icmp_ignore_bogus_error_responses = 1
刷新sysctl配置
sysctl -p
配置防火墙允许转发流量,这里先关闭防火墙
iptables -A INPUT -m policy --dir in --pol ipsec -j ACCEPT iptables -A FORWARD -m policy --dir in --pol ipsec -j ACCEPT iptables -t nat -A POSTROUTING -m policy --dir out --pol none -j MASQUERADE iptables -A FORWARD -i ppp+ -p all -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT iptables -A INPUT -m policy --dir in --pol ipsec -p udp --dport 1701 -j ACCEPT iptables -A INPUT -p udp --dport 500 -j ACCEPT iptables -A INPUT -p udp --dport 4500 -j ACCEPT iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -o eth0 -j MASQUERADE service iptables save service iptables restart
运行测试VPN
启动VPN
ipsec setup restart
运行测试,没有出现failed,则说明VPN运行正常
[root@chancel-vps log]# ipsec verify Verifying installed system and configuration files Version check and ipsec on-path [OK] Libreswan 3.25 (netkey) on 3.10.0-514.el7.x86_64 Checking for IPsec support in kernel [OK] NETKEY: Testing XFRM related proc values ICMP default/send_redirects [OK] ICMP default/accept_redirects [OK] XFRM larval drop [OK] Pluto ipsec.conf syntax [OK] Two or more interfaces found, checking IP forwarding [OK] Checking rp_filter [OK] Checking that pluto is running [OK] Pluto listening for IKE on udp 500 [OK] Pluto listening for IKE/NAT-T on udp 4500 [OK] Pluto ipsec.secret syntax [OBSOLETE] 003 WARNING: using a weak secret (PSK) Checking 'ip' command [OK] Checking 'iptables' command [OK] Checking 'prelink' command does not interfere with FIPS [OK] Checking for obsolete ipsec.conf options [OBSOLETE KEYWORD] Warning: ignored obsolete keyword 'nat_traversal' Warning: ignored obsolete keyword 'oe'
其他问题
VPN连接成功,但无法访问外网?
- 原因
- 出现这种情况,多半是iptables的设置不正确,因为iptables -A这种操作会追加规则到iptables的配置文件中,但如果你的配置里已经通过REJECT结束规则匹配,则追加的配置无效。
- 解决方案
- 编辑/etc/sysconfig/iptables,把VPN的防火墙相关设置提前到REJECT前,或者将REJECT设置放到文件末尾
NOTE:如果有其他问题,欢迎留言讨论
参考资料
唐霜 - L2TP/IPSEC搭建VPN详细教程 Blog Behind GFW - android、iphone、ipad连接不上L2TP解决方案