搭建L2TP/IPSec VPN

目录

  1. 1. 安装
  2. 2. 配置IPSec
  3. 3. 更改系统参数
  4. 4. 启动IPSec
  5. 5. 配置xl2tpd

之前曾经介绍过SoftEthern VPN的搭建,最近换了新的VPS,需要重新搭建VPN,由于除了iOS以外的其他平台都可以用ShadowSocks的梯子,就想搭建一个最简单的无需安装第三方App的VPN给iOS使用。想到系统自带的VPN可以连接L2TP over IPSec,就决定搭一个L2TP的VPN。

由于新VPS装的是CentOS 6,所以CentOS 7风格的命令就写在注释里了。

安装

先安装openswanxl2tpd

yum install openswan xl2tpd

如果没有ppp也要安装。

配置IPSec

/etc/ipsec.d中新建一个vpn.conf文件,内容如下:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
conn L2TP-PSK-NAT
rightsubnet=vhost:%priv
also=L2TP-PSK-noNAT

conn L2TP-PSK-noNAT
authby=secret
pfs=no
auto=add
keyingtries=3
rekey=no
ikelifetime=8h
keylife=1h
type=transport
left=YOUR_PUBLIC_IP_ADDRESS
leftprotoport=17/1701
right=%any
rightprotoport=17/%any

其中left的值改为VPS的公网IP。

再新建一个vpn.secrets文件,里面写一行:

1
YOUR_PUBLIC_IP_ADDRESS %any: PSK "YOUR_PRE_SHARED_KEY"

前面还是公网IP,后面引号里面是自己设置的预共享密钥。

更改系统参数

编辑/etc/sysctl.conf文件,修改或添加成以下配置:

1
2
3
4
5
6
7
8
9
10
net.ipv4.ip_forward = 1
net.ipv4.conf.default.rp_filter = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0
net.ipv4.conf.all.log_martians = 0
net.ipv4.conf.default.log_martians = 0
net.ipv4.conf.default.accept_source_route = 0
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv4.icmp_ignore_bogus_error_responses = 1

sysctl -p命令使更改生效。

然后用以下脚本将/proc/sys/net/ipv4/conf下配置的值都改为0

1
2
3
4
5
for each in /proc/sys/net/ipv4/conf/*
do
echo 0 > $each/accept_redirects
echo 0 > $each/send_redirects
done

启动IPSec

启动IPSec并加入开机启动:

service ipsec start        #systemctl start ipsec
chkconfig ipsec on        #systemctl enable ipsec

然后用ipsec verify检查一下是否配置正确,正常如下:

Version check and ipsec on-path                           [OK]
Libreswan 3.15 (netkey) on 4.12.9-1.el6.elrepo.x86_64
Checking for IPsec support in kernel                      [OK]
 NETKEY: Testing XFRM related proc values
     ICMP default/send_redirects                          [OK]
     ICMP default/accept_redirects                        [OK]
     XFRM larval drop                                     [OK]
Pluto ipsec.conf syntax                                   [OK]
Hardware random device                                    [N/A]
Two or more interfaces found, checking IP forwarding      [OK]
Checking rp_filter                                        [OK]
Checking that pluto is running                            [OK]
 Pluto listening for IKE on udp 500                       [OK]
 Pluto listening for IKE/NAT-T on udp 4500                [OK]
 Pluto ipsec.secret syntax                                [OK]
Checking 'ip' command                                     [OK]
Checking 'iptables' command                               [OK]
Checking 'prelink' command does not interfere with FIPSChecking for obsolete ipsec.conf options                  [OK]
Opportunistic Encryption                                  [DISABLED]

如果有异常请检查之前的配置。

配置xl2tpd

编辑/etc/xl2tpd/xl2tpd.conf配置如下:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
[global]
listen-addr = YOUR_PUBLIC_IP_ADDRESS
ipsec saref = yes

[lns default]
ip range = 192.168.1.128-192.168.1.254
local ip = 192.168.1.99
require chap = yes
refuse pap = yes
require authentication = yes
name = LinuxVPNserver
ppp debug = yes
pppoptfile = /etc/ppp/options.xl2tpd
length bit = yes

其实主要注意监听地址和几个yes就行了,其他基本不用动。

然后编辑/etc/ppp/options.xl2tpd配置如下:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
ipcp-accept-local
ipcp-accept-remote
ms-dns 8.8.8.8
ms-dns 8.8.4.4
noccp
auth
crtscts
idle 1800
mtu 1410
mru 1410
nodefaultroute
debug
lock
proxyarp
connect-delay 5000

/etc/ppp/chap-secrets里添加帐号密码:

1
2
3
# client	server	secret			IP addresses
username1 * password1 *
username2 * password2 *

按照对应格式填上帐号密码即可。

启动xl2tpd并加入开机启动:

service xl2tpd start        #systemctl start xl2tpd
chkconfig xl2tpd on        #systemctl enable xl2tpd

最后在本地设备上填上地址、预共享密钥、用户名、密码就可以连接了。