Centos 6.5 下配置L2tp Vpn
阿新 • • 發佈：2018-12-14
Linux（Centos）下配置L2tp Vpn。 1.安裝環境包
yum install -y make gcc gmp-devel xmlto bison flex xmlto libpcap-devel lsof vim-enhanced man
2.安裝
yum install openswan ppp xl2tpd
3.配置 （1）編輯 /etc/ipsec.conf
vi /etc/ipsec.conf config setup nat_traversal=yes virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12 oe=off protostack=netkey conn L2TP-PSK-NAT rightsubnet=vhost:%priv also=L2TP-PSK-noNAT conn L2TP-PSK-noNAT authby=secret pfs=no auto=add keyingtries=3 rekey=no ikelifetime=8h keylife=1h type=transport left=114.114.114.114 (伺服器公網IP) leftprotoport=17/1701 right=%any rightprotoport=17/%any
（2）編輯/etc/ipsec.secrets
vi /etc/ipsec.secrets include /etc/ipsec.d/*.secrets 114.114.114.114 %any: PSK "YourPsk" ###YourPsk為預共享金鑰。
（3） 修改/新增 /etc/sysctl.conf並生效
vim /etc/sysctl.conf 在/etc/sysctl.conf的末尾加上如下內容。 net.ipv4.ip_forward = 1 net.ipv4.conf.default.rp_filter = 0 net.ipv4.conf.all.send_redirects = 0 net.ipv4.conf.default.send_redirects = 0 net.ipv4.conf.all.log_martians = 0 net.ipv4.conf.default.log_martians = 0 net.ipv4.conf.default.accept_source_route = 0 net.ipv4.conf.all.accept_redirects = 0 net.ipv4.conf.default.accept_redirects = 0 net.ipv4.icmp_ignore_bogus_error_responses = 1
生效上面的修改使用如下命令
sysctl -p
（4）驗證ipsec執行狀態
ipsec restart ipsec verify [[email protected] ~]# ipsec verify Checking your system to see if IPsec got installed and started correctly: Version check and ipsec on-path [OK] Linux Openswan U2.6.32/K2.6.32-431.23.3.el6.x86_64 (netkey) Checking for IPsec support in kernel [OK] SAref kernel support [N/A] NETKEY: Testing for disabled ICMP send_redirects [OK] NETKEY detected, testing for disabled ICMP accept_redirects [OK] Checking that pluto is running [OK] Pluto listening for IKE on udp 500 [OK] Pluto listening for NAT-T on udp 4500 [OK] Two or more interfaces found, checking IP forwarding [OK] Checking NAT and MASQUERADEing [OK] Checking for 'ip' command [OK] Checking /bin/sh is not /bin/dash [OK] Checking for 'iptables' command [OK] Opportunistic Encryption Support [DISABLED]
（5） 編輯 /etc/xl2tpd/xl2tpd.conf 這一步可以跳過 ip range 客戶端獲取的IP範圍，local ip VPN伺服器端的IP
vim /etc/xl2tpd/xl2tpd.conf [lns default] ip range = 192.168.100.10-192.168.100.200 local ip = 192.168.100.1 require chap = yes refuse pap = yes require authentication = yes name = LinuxVPNserver ppp debug = yes pppoptfile = /etc/ppp/options.xl2tpd length bit = yes
（6）配置使用者名稱,密碼:編輯 /etc/ppp/chap-secrets
vim /etc/ppp/chap-secrets username 寫登入vpn的使用者名稱，userpass 寫登入vpn的密碼 # Secrets for authentication using CHAP # client server secret IP addresses username * "userpass" *
（7）重啟xl2tp
service xl2tpd restart
（8）新增自啟動
chkconfig xl2tpd on chkconfig iptables on chkconfig ipsec on
設定完成。
Windows下設定VPN連線客戶端
撥入後，伺服器可以看到ppp0介面
額外需求：
1、配置單獨的l2tp日誌記錄
這裡可以利用syslog來配置，在/etc/rsyslog.d/ 下新建20-xl2tpd.conf檔案，內容如下：
[[email protected] rsyslog.d]# cat 20-xl2tpd.conf if $programname == 'xl2tpd' then /var/log/xl2tpd.log &~
這裡可以利用syslog來配置，在/etc/rsyslog.d/ 下新建20-pptpd.conf檔案，內容如下：
[[email protected] rsyslog.d]# cat 20-pptpd.conf if $programname == 'pppd' then /var/log/xl2tpd.log &~
但是這樣只能在日誌中看到客戶端的公網IP地址、私網IP等資訊，卻無法看到是哪個使用者登入的，這不利於做審計工作，所以需要能將連線使用者的資訊也寫入到日誌中，解決方法如下：
在/etc/ppp/ip-up 指令碼中加入
echo "Start_Time: `date -d today +%F_%T`" >> /var/log/xl2tpd.log ##登入時間戳 echo "username: $PEERNAME" >> /var/log/xl2tpd.log ##使用者名稱
在/etc/ppp/ip-down 指令碼中加入
echo "Stop_Time: `date -d today +%F_%T`" >> /var/log/xl2tpd.log ##斷開時間戳 echo "username: $PEERNAME" >> /var/log/xl2tpd.log ##使用者名稱
重啟rsyslog服務
service rsyslog restart
最終的日誌資訊如下，客戶端的公網IP、獲取的內網IP、使用者名稱、時間等重要資訊都被記錄下來了。
cat /var/log/xl2tpd.log Nov 5 13:47:57 server17 xl2tpd[24509]: control_finish: Peer requested tunnel 29 twice, ignoring second one. Nov 5 13:47:58 server17 xl2tpd[24509]: Connection established to 202.202.202.202, 1701. Local: 36071, Remote: 29 (ref=0/0). LNS session is 'default' Nov 5 13:47:58 server17 xl2tpd[24509]: result_code_avp: result code not appropriate for Incoming-Call-Request. Ignoring. Nov 5 13:47:58 server17 xl2tpd[24509]: Call established with 202.202.202.202, Local: 3764, Remote: 1, Serial: 0 Nov 5 13:47:58 server17 pppd[16218]: pppd 2.4.5 started by root, uid 0 Nov 5 13:47:58 server17 pppd[16218]: using channel 28 Nov 5 13:47:58 server17 pppd[16218]: Using interface ppp0 Nov 5 13:47:58 server17 pppd[16218]: Connect: ppp0 /dev/pts/0 Nov 5 13:47:58 server17 pppd[16218]: sent [LCP ConfReq id=0x1 ] Nov 5 13:47:58 server17 pppd[16218]: rcvd [LCP ConfReq id=0x0 ] Nov 5 13:47:58 server17 pppd[16218]: sent [LCP ConfRej id=0x0 ] Nov 5 13:47:58 server17 pppd[16218]: rcvd [LCP ConfAck id=0x1 ] Nov 5 13:47:58 server17 pppd[16218]: rcvd [LCP ConfReq id=0x1 ] Nov 5 13:47:58 server17 pppd[16218]: sent [LCP ConfAck id=0x1 ] Nov 5 13:47:58 server17 pppd[16218]: sent [CHAP Challenge id=0xfd , name = "LinuxVPNserver"] Nov 5 13:47:58 server17 pppd[16218]: rcvd [LCP Ident id=0x2 magic=0x5597000a "MSRASV5.20"] Nov 5 13:47:58 server17 pppd[16218]: rcvd [LCP Ident id=0x3 magic=0x5597000a "MSRAS-0-WWW-PC"] Nov 5 13:47:58 server17 pppd[16218]: rcvd [LCP Ident id=0x4 magic=0x5597000a "\[email protected]?\37777777642\37777777705A\37777777642\37777777623\021\37777777764\37777777656;t$"] Nov 5 13:47:58 server17 pppd[16218]: rcvd [CHAP Response id=0xfd , name = "wujr"] Nov 5 13:47:58 server17 pppd[16218]: sent [CHAP Success id=0xfd "Access granted"] Nov 5 13:47:58 server17 pppd[16218]: sent [IPCP ConfReq id=0x1 ] Nov 5 13:47:58 server17 pppd[16218]: rcvd [IPV6CP ConfReq id=0x5 ] Nov 5 13:47:58 server17 pppd[16218]: Unsupported protocol 'IPv6 Control Protocol' (0x8057) received Nov 5 13:47:58 server17 pppd[16218]: sent [LCP ProtRej id=0x2 80 57 01 05 00 0e 01 0a b8 71 8f aa 3d c3 d8 78] Nov 5 13:47:58 server17 pppd[16218]: rcvd [IPCP ConfReq id=0x6 ] Nov 5 13:47:58 server17 pppd[16218]: sent [IPCP ConfRej id=0x6 ] Nov 5 13:47:58 server17 pppd[16218]: rcvd [IPCP ConfRej id=0x1 ] Nov 5 13:47:58 server17 pppd[16218]: sent [IPCP ConfReq id=0x2 ] Nov 5 13:47:58 server17 pppd[16218]: rcvd [IPCP ConfReq id=0x7 ] Nov 5 13:47:58 server17 pppd[16218]: sent [IPCP ConfNak id=0x7 ] Nov 5 13:47:58 server17 pppd[16218]: rcvd [IPCP ConfAck id=0x2 ] Nov 5 13:47:58 server17 pppd[16218]: rcvd [IPCP ConfReq id=0x8 ] Nov 5 13:47:58 server17 pppd[16218]: sent [IPCP ConfAck id=0x8 ] Nov 5 13:47:58 server17 pppd[16218]: Cannot determine ethernet address for proxy ARP Nov 5 13:47:58 server17 pppd[16218]: local IP address 192.168.100.1 Nov 5 13:47:58 server17 pppd[16218]: remote IP address 192.168.100.10 Nov 5 13:47:58 server17 pppd[16218]: Script /etc/ppp/ip-up started (pid 16225) Start_Time: 2015-11-05_13:47:58 username: test Nov 5 13:47:58 server17 pppd[16218]: Script /etc/ppp/ip-up finished (pid 16225), status = 0x0
2、使用VPN伺服器公網做為客戶端網際網路出口（跳板機、代理） 使用iptables實現，增加規則
iptables -t nat -A POSTROUTING -o eth1 -s 192.168.100.0/24 -j MASQUERADE （eth1為公網網絡卡）
3、訪問VPN伺服器所在的內網其它伺服器 使用iptables實現，增加規則
iptables -t nat -A POSTROUTING -s 192.168.100.0/24 -o eth0 -j MASQUERADE （eth0為私網網絡卡）h
--------------------- 本文來自 ASIH 的CSDN 部落格 ，全文地址請點選：https://blog.csdn.net/hanzheng260561728/article/details/51235807?utm_source=copy