Centos 6 安装 L2TP+IPSec 完整教程

发表于

L2TP相比PPTP是另外一种隧道协议方式，部分网络下PPTP无法连接，可以尝试L2TP，一般而言在PC上，两者使用体验没什么不同，技术原理上的不同请参照这里.建议PC电脑上优先使用PPTP，无法使用可以尝试L2TP，移动端推荐使用L2TP；

部署IPsec

安装必备依赖包

1
yum install make gcc gmp-devel bison flex lsof

安装Openswan

1
2
3
4
wget https://download.openswan.org/openswan/old/openswan-2.6/openswan-2.6.38.tar.gz  
tar -zxvf openswan-2.6.38.tar.gz  
cd openswan-2.6.38  
make programs install

编辑配置文件/etc/ipsec.conf,将protostack=auto，修改为：protostack=netkey，并在最后追加以下内容

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
conn L2TP-PSK-NAT  
    rightsubnet=vhost:%priv
    also=L2TP-PSK-noNAT
conn L2TP-PSK-noNAT  
    authby=secret
    pfs=no
    auto=add
    keyingtries=3
    rekey=no
    ikelifetime=8h
    keylife=1h
    type=transport
    left=10.144.67.116
    leftprotoport=17/1701
    right=%any
    rightprotoport=17/%any
    dpddelay=40
    dpdtimeout=130
    dpdaction=clear
    leftnexthop=%defaultroute
    rightnexthop=%defaultroute

设置共享密钥PSK 编辑配置文件/etc/ipsec.secrets

1
10.144.67.116 %any: PSK "redhat"

修改包转发设置

1
2
3
4
5
6
7
for a in /proc/sys/net/ipv4/conf/*; do  
   echo 0 > $a/accept_redirects; 
   echo 0 > $a/send_redirects; 
done
sed -i 's/net.ipv4.ip_forward = 0/net.ipv4.ip_forward = 1/g' /etc/sysctl.conf  
sysctl -p

重启IPSec

1
service ipsec restart

查看系统IPSec安装和启动的正确性

1
ipsec verify
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
Checking your system to see if IPsec got installed and started correctly:  
Version check and ipsec on-path                                 [OK]  
Linux Openswan U2.6.38/K2.6.32-504.30.3.el6.x86_64 (netkey)  
Checking for IPsec support in kernel                            [OK]  
 SAref kernel support                                           [N/A]
 NETKEY:  Testing XFRM related proc values                      [OK]
        [OK]
        [OK]
Checking that pluto is running                                  [OK]  
 Pluto listening for IKE on udp 500                             [OK]
 Pluto listening for NAT-T on udp 4500                          [OK]
Checking for 'ip' command                                       [OK]  
Checking /bin/sh is not /bin/dash                               [OK]  
Checking for 'iptables' command                                 [OK]  
Opportunistic Encryption Support                                [DISABLED]  
一般情况下没有报[FAILED]就可以了。但是如果转发已经确认配置了.

部署L2TP(使用xl2tpd和rp-l2tp) xl2tpd最新版已经包含了l2tp-control，rp-l2tp可不需要安装

安装依赖软件

1
yum install libpcap-devel ppp policycoreutils

安装xl2tpd和rp-l2tp

1
2
3
4
5
6
7
8
wget http://sourceforge.net/projects/rp-l2tp/files/rp-l2tp/0.4/rp-l2tp-0.4.tar.gz  
tar -zxvf rp-l2tp-0.4.tar.gz  
cd rp-l2tp-0.4  
./configure
make  
cp handlers/l2tp-control /usr/local/sbin/  
mkdir /var/run/xl2tpd/  
ln -s /usr/local/sbin/l2tp-control /var/run/xl2tpd/l2tp-control

安装xl2tpd

1
2
3
4
wget https://download.openswan.org/xl2tpd/xl2tpd-1.3.0.tar.gz  
tar zxf xl2tpd-1.3.0.tar.gz  
cd xl2tpd-1.3.0  
make && make install

建立xl2tpd配置文件

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
mkdir /etc/xl2tpd  
cat >  /etc/xl2tpd/xl2tpd.conf <<EOF  
[global]
ipsec saref = yes
[lns default]
ip range = 10.82.88.2-10.82.88.254  
local ip = 10.82.88.1  
refuse chap = yes  
refuse pap = yes  
require authentication = yes  
ppp debug = yes  
pppoptfile = /etc/ppp/options.xl2tpd  
length bit = yes  
EOF

配置ppp 建立options.xl2tpd文件

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
cat > /etc/ppp/options.xl2tpd <<EOF  
ms-dns 8.8.8.8  
ms-dns 8.8.4.4  
asyncmap 0  
auth  
crtscts  
lock  
hide-password  
modem  
debug  
name l2tpd  
proxyarp  
lcp-echo-interval 30  
lcp-echo-failure 4  
EOF

设置拨号用户名和密码

1
echo "username l2tpd password *" > /etc/ppp/chap-secrets

最后添加iptables转发规则并保存重启

1
2
iptables --table nat --append POSTROUTING --jump MASQUERADE  
service iptabls save

以debug方式启动l2tp，查看有无错误

1
2
3
xl2tpd -D  
如果可以正常连接请ctrl+c退出，再直接后台启动
xl2tpd

默认不支持service启动和重启,需要的话，我们添加一个启动脚本/etc/init.d/xl2tpd

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
#!/bin/sh
#
# xl2tpd This shell script takes care of starting and stopping l2tpd.
#
# chkconfig: - 80 30
# de script ion: Layer 2 Tunnelling Protocol Daemon (RFC 2661)
#
# processname: xl2tpd
# config: /etc/xl2tpd/xl2tpd.conf
# pidfile: /var/run/xl2tpd.pid
#Servicename
SERVICE=xl2tpd  
# Source function library.
. /etc/rc.d/init.d/functions
# Source networking configuration.
. /etc/sysconfig/network
if [ ${NETWORKING} = "no" ]  
then  
exit 0  
fi  
[ -x /usr/local/sbin/$SERVICE ] || exit 0
RETVAL=0  
start() {  
echo -n "Starting $SERVICE: "  
if [ ! -d /var/run/xl2tpd ]  
then  
mkdir /var/run/xl2tpd  
fi  
daemon /usr/local/sbin/$SERVICE  
RETVAL=$?  
[ $RETVAL -eq 0 ] && touch /var/lock/subsys/$SERVICE
echo ""  
return $RETVAL  
}
stop() {  
echo -n "Stopping $SERVICE: "  
killproc $SERVICE  
RETVAL=$?  
echo  
[ $RETVAL -eq 0 ] && rm -f /var/lock/subsys/$SERVICE
return $RETVAL  
}
restart() {  
stop  
start  
}
# See how we were called.
case "$1" in  
start)  
start  
;;
stop)  
stop  
;;
status)  
status $SERVICE  
RETVAL=$?  
;;
restart|reload)  
restart  
;;
condrestart)  
[ -f /var/lock/subsys/$SERVICE ] && restart || :
;;
*)
echo "Usage: $SERVICE {start|stop|status|restart|reload|condrestart}"  
exit 1  
esac

添加到系统并设置开机启动

1
2
3
4
chmod +x /etc/init.d/xl2tpd  
chkconfig --add /etc/init.d/xl2tpd  
chkconfig xl2tpd on  
service xl2tpd start|stop|restart|status

检查端口是否正常启动

1
2
netstat -an|grep 1701  
udp        0      0 0.0.0.0:1701                0.0.0.0:*

原文