必威体育Betway必威体育官网
当前位置：首页 > IT技术

内网服务器搭建l2tp/ipsec VPN服务器实现远程访问

时间:2019-06-16 03:43:13来源:IT技术作者:seo实验室小编阅读:78次「手机版」
　

l2tp

这里先对VPN的实现法法做一个介绍：

(一)安装VPN:

1.vpn组成及作用

openswan：提供ipsec服务，设置预共享密钥 

ppp：拨号软件，提供用户名和密码用于拨号 

xl2tpd:提供l2tp服务

2.安装前准备（ppp及其他依赖包）

yum install -y ppp iptables make gcc gmp-devel xmlto bison flex libpcap-devel lsof vim-enhanced

3.下载安装openswan-2.6.38.tar.gz

#tar -xf  openswan-2.6.38.tar.gz

#cd openswan-2.6.38

#make programs install

修改ipsec相关配置，跟下面一模一样，left部分改成服务器ip。

config setup
    nat_traversal=yes
    virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12
    oe=off
    protostack=netkey

conn L2TP-PSK-NAT
    rightsubnet=vhost:%priv
    also=L2TP-PSK-noNAT

conn L2TP-PSK-noNAT
    authby=secret
    pfs=no
    auto=add
    keyingtries=3
    rekey=no
    ikelifetime=8h
    keylife=1h
    type=transport
    left=vpn服务器ip
	leftid=vpn服务器ip
    leftprotoport=17/1701
    right=%any
	rightid=%any
    rightprotoport=17/%any

L2TP比PPTP多了一个密钥项，这也是它比PPTP更安全的原因之一。这个密钥其实就是一个密码，不同于用户的登录密码，它相当于一个设备之间通信的密钥。它的配置文件是/etc/ipsec.secrets

vim /etc/ipsec.secrets
vpn服务器ip  %any:  PSK "秘钥"

启动服务：/etc/init.d/ipsec start

4、设置sysctl

vim /etc/sysctl.conf

net.ipv4.ip_forward = 1
net.ipv4.conf.default.rp_filter = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0
net.ipv4.conf.all.log_martians = 0
net.ipv4.conf.default.log_martians = 0
net.ipv4.conf.default.accept_source_route = 0
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv4.icmp_ignore_bogus_ERROR_responses = 1

配置生效：sysctl -p

5、修改内核参数

vim /usr/bin/l2tpset

#/bin/bash
for each in /proc/sys/net/ipv4/conf/*
do
echo 0 > $each/accept_redirects
echo 0 > $each/send_redirects
done
~

/usr/bin/l2tpset

6、安装：rp-l2tp-0.4.tar.gz

#tar -xf rp-l2tp-0.4.tar.gz

#cd rp-l2tp-0.4

#./configure

#make

#cp handlers/l2tp-control /usr/local/sbin/

#mkdir -p /var/run/xl2tpd/

#ln -s /usr/local/sbin/l2tp-control /var/run/xl2tpd/l2tp-control

7、安装xl2tpd-1.2.4.tar.gz

#cd xl2tpd-1.2.4

#make install

#mkdir -p /etc/xl2tpd

修改配置

vim /etc/xl2tpd/xl2tpd.conf 

[global]
ipsec saref = yes
[lns default]
ip range = $iprange.2-$iprange.254
local ip = $iprange.1
refuse chap = yes
refuse pap = yes
require authentication = yes
ppp debug = yes
pppoptfile = /etc/ppp/options.xl2tpd
length bit = yes

vim /etc/ppp/options.xl2tpd

require-mschap-v2
ms-dns 8.8.8.8
ms-dns 8.8.4.4
asyncmap 0
auth
crtscts
lock
hide-password
modem
debug
name l2tpd
proxyarp
lcp-echo-Interval 30
lcp-echo-failure 4

运行程序：/usr/local/sbin/xl2tpd

8、修改增加账号信息

vim /etc/ppp/chap-secrets

9.其他配置

iptables --table nat --APPend POSTROUTING --jump masquerade

10、设置开机启动

iptables --table nat --append POSTROUTING --jump MASQUERADE

/etc/init.d/ipsec restart

/usr/bin/l2tpset

/usr/local/sbin/xl2tpd

（二）在出网设备上做ip和端口映射，将vpn数据包映射到vpn服务器。下满的规则仅供参考，安具体情况来配置。

iptables -A INPUT -i eth0 -p udp -m multiport –dports 500,4500,1701 -m comment –comment “ipsec” -j ACCEPT 

iptables -A FORWARD -i ppp+ -p tcp -m tcp –tcp-flags FIN,SYN,RST,ACK SYN -j TCPMSS –set-mss 1356

到此就配置完了，可以用手机开无线，给电脑链接，然后播VPN进行测试。

方法二：此方法适合新手不想研究太透，或者老手已经不需要了解安装过程使用。

在服务器root目录编写一键安装脚本,代码如下 ：

vim l2tp.sh

#!/bin/bash
PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin:~/bin
export PATH
#===============================================================================================
#   SYSTEM REQUIRED:  centos-5 (32bit/64bit) or CentOS-6 (32bit/64bit)
#   DESCRIPTION:  install L2TP
#   VERSION:   1.0
#   AUTHOR:    teddysun
#===============================================================================================
# Make sure only root can run our script
if [[ $EUID -ne 0 ]]; then
   echo "Error: This script must be run as root" 1>&2
   exit 1
fi

tmpip=`ifconfig |grep 'inet' | grep -Evi '(inet6|127.0.0.1)' | awk '{print $2}' | cut -d: -f2 | tail -1`

echo "Please input IP-Range:"
read -p "(Default Range: 10.1.2):" iprange
if [ "$iprange" = "" ]; then
	iprange="10.1.2"
fi

echo "Please input PSK:"
read -p "(Default PSK: vpn):" mypsk
if [ "$mypsk" = "" ]; then
	mypsk="vpn"
fi

clear
get_char()
{
SAVEDSTTY=`stty -g`
stty -echo
stty cbreak
dd if=/dev/tty bs=1 count=1 2> /dev/null
stty -raw
stty echo
stty $SAVEDSTTY
}
echo ""
echo "ServerIP:"
echo "$tmpip"
echo ""
echo "Server Local IP:"
echo "$iprange.1"
echo ""
echo "Client Remote IP Range:"
echo "$iprange.2-$iprange.254"
echo ""
echo "PSK:"
echo "$mypsk"
echo ""
echo "Press any key to start...or Press Ctrl+c to cancel"
char=`get_char`
clear

mknod /dev/random c 1 9
#install some necessary tools
yum install -y ppp iptables make gcc gmp-devel xmlto bison flex libpcap-devel lsof vim-enhanced
#
cur_dir=`pwd`
mkdir -p $cur_dir/l2tp
cd $cur_dir/l2tp
#download openswan-2.6.38.tar.gz
if [ -s openswan-2.6.38.tar.gz ]; then
  echo "openswan-2.6.38.tar.gz [found]"
else
  echo "openswan-2.6.38.tar.gz not found!!!download now......"
  if ! wget https://download.openswan.org/openswan/old/openswan-2.6/openswan-2.6.38.tar.gz;then
    echo "failed to download openswan-2.6.38.tar.gz, please download it to $cur_dir directory manually and rerun the install script."
	exit 1
  fi
fi
#download rp-l2tp-0.4.tar.gz
if [ -s rp-l2tp-0.4.tar.gz ]; then
  echo "rp-l2tp-0.4.tar.gz [found]"
else
  echo "rp-l2tp-0.4.tar.gz not found!!!download now......"
  if ! wget https://jaist.dl.sourceforge.net/project/rp-l2tp/rp-l2tp/0.4/rp-l2tp-0.4.tar.gz;then
    echo "Failed to download rp-l2tp-0.4.tar.gz, please download it to $cur_dir directory manually and rerun the install script."
	exit 1
  fi
fi
#download xl2tpd-1.2.4.tar.gz
if [ -s xl2tpd-1.2.4.tar.gz ]; then
  echo "xl2tpd-1.2.4.tar.gz [found]"
else
  echo "xl2tpd-1.2.4.tar.gz not found!!!download now......"
  if ! wget https://download.openswan.org/xl2tpd/old/xl2tpd-1.2.4.tar.gz;then
    echo "Failed to download xl2tpd-1.2.4.tar.gz, please download it to $cur_dir directory manually and rerun the install script."
	exit 1
  fi
fi
#untar all files
rm -rf $cur_dir/l2tp/untar
mkdir -p $cur_dir/l2tp/untar
echo "============================untar all files,please wait a moment...======================="
for file in `ls *.tar.gz` ;
do
tar -zxf $file -C $cur_dir/l2tp/untar
done
echo "============================untar all files completed!...================================="
#make & install openswan-2.6.38
cd $cur_dir/l2tp/untar/openswan-2.6.38
make programs install

#configuation ipsec
rm -rf /etc/ipsec.conf
touch /etc/ipsec.conf
cat >>/etc/ipsec.conf<<EOF
config setup
    nat_traversal=yes
    virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12
    oe=off
    protostack=netkey

conn L2TP-PSK-NAT
    rightsubnet=vhost:%priv
    also=L2TP-PSK-noNAT

conn L2TP-PSK-noNAT
    authby=secret
    pfs=no
    auto=add
    keyingtries=3
    rekey=no
    ikelifetime=8h
    keylife=1h
    type=transport
    left=$tmpip
	leftid=$tmpip
    leftprotoport=17/1701
    right=%any
	rightid=%any
    rightprotoport=17/%any
EOF
cat >>/etc/ipsec.secrets<<EOF
$tmpip %any: PSK "$mypsk"
EOF
sed -i 's/net.ipv4.ip_forward = 0/net.ipv4.ip_forward = 1/g' /etc/sysctl.conf
sed -i 's/net.ipv4.conf.default.rp_filter = 1/net.ipv4.conf.default.rp_filter = 0/g' /etc/sysctl.conf
sysctl -p
iptables --table nat --append POSTROUTING --jump MASQUERADE
for each in /proc/sys/net/ipv4/conf/*
do
echo 0 > $each/accept_redirects
echo 0 > $each/send_redirects
done

#make & install rp-l2tp-0.4
cd $cur_dir/l2tp/untar/rp-l2tp-0.4
./configure
make
cp handlers/l2tp-control /usr/local/sbin/
mkdir -p /var/run/xl2tpd/
ln -s /usr/local/sbin/l2tp-control /var/run/xl2tpd/l2tp-control
#make & install xl2tpd-1.2.4.tar.gz
cd $cur_dir/l2tp/untar/xl2tpd-1.2.4
make install
mkdir -p /etc/xl2tpd
rm -rf /etc/xl2tpd/xl2tpd.conf
touch /etc/xl2tpd/xl2tpd.conf
cat >>/etc/xl2tpd/xl2tpd.conf<<EOF
[global]
ipsec saref = yes
[lns default]
ip range = $iprange.2-$iprange.254
local ip = $iprange.1
refuse chap = yes
refuse pap = yes
require authentication = yes
ppp debug = yes
pppoptfile = /etc/ppp/options.xl2tpd
length bit = yes
EOF
rm -rf /etc/ppp/options.xl2tpd
touch /etc/ppp/options.xl2tpd
cat >>/etc/ppp/options.xl2tpd<<EOF
require-mschap-v2
ms-dns 8.8.8.8
ms-dns 8.8.4.4
asyncmap 0
auth
crtscts
lock
hide-password
modem
debug
name l2tpd
proxyarp
lcp-echo-interval 30
lcp-echo-failure 4
EOF

#default user & password set
pass=`openssl rand 6 -base64`
if [ "$1" != "" ]
then pass=$1
fi
echo "vpn l2tpd ${pass} *" >> /etc/ppp/chap-secrets

touch /usr/bin/l2tpset
echo "#/bin/bash" >>/usr/bin/l2tpset
echo "for each in /proc/sys/net/ipv4/conf/*" >>/usr/bin/l2tpset
echo "do" >>/usr/bin/l2tpset
echo "echo 0 > \$each/accept_redirects" >>/usr/bin/l2tpset
echo "echo 0 > \$each/send_redirects" >>/usr/bin/l2tpset
echo "done" >>/usr/bin/l2tpset
chmod +x /usr/bin/l2tpset
iptables --table nat --append POSTROUTING --jump MASQUERADE
l2tpset
xl2tpd
cat >>/etc/rc.local<<EOF
iptables --table nat --append POSTROUTING --jump MASQUERADE
/etc/init.d/ipsec restart
/usr/bin/l2tpset
/usr/local/sbin/xl2tpd
EOF
clear
ipsec verify
printf "
####################################################
#                                                  #
# Install L2TP bash script                         #
# Version: 1.0                                     #
# Author: teddysun <http://teddysun.com>           #
# enjoy it!!                                       #
####################################################
if there are no [FAILED] above, then you can
connect to your L2TP VPN Server with the default
user/password below:

ServerIP:$tmpip
username:vpn
password:${pass}
PSK:$mypsk

运行脚本：./l2tp.sh

如果提示无法下载上面几个文件，说明下载链接失效了，可以网上搜素有效的下载链接，在脚本里面替换

配置映射。

相关阅读

最新海康摄像机、NVR、流媒体服务器、回放取流RTSP地

本文档主要介绍海康威视设备预览、回放、流媒体取流的RTSP URL和IE直接预览、回放的HTTP URL。RTSP为取流协议，取到码流后需要解码

Linux下nfs+rpcbind实现服务器之间的文件共享（mount 挂

1、安装nfs和rpcbind 检查自己的电脑是否已经默认安装了nfs和rpcbind： rpm -aq | grep nfs nfs-utils-1.2.3-54.el6.x86_64 nfs4-

服务器遇到Broken Pipe崩溃之异常分析报告

问题描述：Linux+JDK1.7+Tomcat7+mysql部署的WEB项目，线上时常抛出该异常（文章底部有解决方案）。org.apache.catalina.connector.Clien

新版SoftEther VPN客户端管理器

最新版SoftEther VPN客户端管理器安装操作步骤 安装SoftEther VPN服务器之后，接下来安装SoftEther VPN客户端管理进行VPN连接。

Axure+SVN（服务器搭建+运用），产品经理的硬实力

文章主要给大家介绍一下Axure+SVN，按照代码管理的方式来管理我们的产品原型文档。技术伙伴在访问https://xxxx.axshare.com的原型

赞()
分享到:

猜你喜欢

栏目导航

推荐阅读

热门阅读

seo实验室提供seo优化服务，有网站优化、网站建设、运营推广等需求请联系我们!
Copyright © 2001-2017 .seo实验室 版权所有 网站地图