架设基于StrongSwan的L2tp/IPSec VPN服务器

参考： http://agit8.turbulent.ca/bwp/2011/01/setting-up-a-vpn-server-with-ubuntu-1004-and-strongswan/

以下操作基于Debian 6

安装StrongSwan

apt-get install libgmp3-dev libssl-dev make
cd /tmp
wget http://download.strongswan.org/strongswan-4.6.2.tar.gztar zxvf strongswan-4.6.2.tar.gz
cd /tmp/strongswan-4.6.2
./configure --prefix=/usr --sysconfdir=/etc --libexecdir=/usr/lib --with-ipsecdir=/usr/lib/strongswan --enable-cisco-quirks --enable-openssl --enable-nat-transport --disable-mysql --disable-ldap --disable-static --enable-shared --enable-eap-mschapv2 --enable-eap-radius --enable-eap-md5 --enable-dhcp
make
make install

编辑 IPSec 配置文件

cp /etc/ipsec.conf /etc/ipsec.conf.old
cat >/etc/ipsec.conf<<EOF
config setup
    nat_traversal=yes
    virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12
    plutostart=yes
    charonstart=yes
conn L2TP-PSK-NAT
    rightsubnet=vhost:%priv
    also=L2TP-PSK-noNAT
 
conn L2TP-PSK-noNAT
    type=transport
    authby=psk
    keyexchange=ikev1
    pfs=no
    keyingtries=3
    rekey=no
    left=%defaultroute
    leftnexthop=%defaultroute
    leftprotoport=17/1701
    right=%any
    rightprotoport=17/%any
    rightsubnetwithin=0.0.0.0/0
    auto=add
EOF

设置 PSK 预共享密钥，需要修改成你自己服务器的公网IP及”nsshell.com”部分

cat >/etc/ipsec.secrets<<EOF
216.187.89.188 %any: PSK "nsshell.com"
EOF

调整网络策略, for 循环语句，请一行一行地输入，输完后按回车。
[wp_ad_camp_1]

function updateipv4conf()
{
  for each in /proc/sys/net/ipv4/conf/*
  do
  echo 0 > $each/accept_redirects
  echo 0 > $each/send_redirects
  done
}

updateipv4conf

重启IPSec 服务，StrongSwan的ipsec命令应该会自动添加到$PATH中

ipsec restart

安装 L2TP

apt-get install xl2tpd

编辑 xl2tpd 配置文件，请修改下面对应的服务器IP

cat >/etc/xl2tpd/xl2tpd.conf<<EOF
[global]
port = 1701
listen-addr = < SERVER_PUBLIC_IP >
ipsec saref = yes
 
[lns default]
local ip = 10.31.2.1
ip range = 10.31.2.2-10.31.2.254
require chap = yes
refuse pap = yes
require authentication = yes
ppp debug = yes
pppoptfile = /etc/ppp/options.xl2tpd
length bit = yes
name = xl2tpd
EOF

PPP 的安装配置

cat >/etc/ppp/options.xl2tpd<<EOF
require-mschap-v2
ms-dns 8.8.8.8
ms-dns 8.8.4.4
asyncmap 0
auth
crtscts
lock
hide-password
modem
debug
name xl2tpd
proxyarp
lcp-echo-interval 30
lcp-echo-failure 4
mtu 1410
mru 1410
connect-delay 50
EOF

添加 VPN 用户

cat >>/etc/ppp/chap-secrets<<EOF
test * test *
EOF

[wp_ad_camp_3]

包转发及iptables设置在前面已经设置好(见OpenVPN配置页面中关于iptables的配置)

重启xl2tpd

/etc/init.d/xl2tpd restart

注意：Strongswan需要单独运行ipsec命令来启动服务，安装strongswan后，以root用户执行

ipsec

命令，即可启动strongswan. 试用

ipsec statusall