vpnaas配置的资料很少，官网目前参考的https://wiki.openstack.org/wiki/Neutron/VPNaaS/HowToInstall比较旧，方面配置基本没有讲
经历漫长时间的查找资料、学习，现终于配置成功了，记录下来给大家参考一下，有什么不正确的地方及时留言
1. 配置
1.1 准备
yum install openstack-neutron-vpn-agent libreswan -y vi /etc/sysctl net.ipv4.ip_forward=1 net.ipv4.conf.default.send_redirects = 0 net.ipv4.conf.default.accept_redirects = 0 net.ipv4.conf.default.rp_filter = 0
1.2添加vpn服务
vim /etc/neutron/neutron.conf [DEFAULT] service_plugins = router,vpnaas [service_providers] service_provider = VPN:Vpn:neutron.services.vpn.service_drivers.ipsec.IPsecVPNDriver:default
1.3 配置vpnaas
vim /etc/neutron/vpn_agent.ini
[DEFAULT] # VPN-Agent configuration file # Note vpn-agent inherits l3-agent, so you can use configs on l3-agent also interface_driver = neutron.agent.linux.interface.OVSInterfaceDriver [vpnagent] vpn_device_driver=neutron.services.vpn.device_drivers.ipsec.OpenSwanDriver [ipsec] ipsec_status_check_interval=30
vi /usr/share/neutron/rootwrap/vpnaas.filters
[Filters] ip: IpFilter, ip, root ip_exec: IpNetnsExecFilter, ip, root openswan: CommandFilter, ipsec, root libreswan: CommandFilter, certutil, root
1.4 dashboard启用vpn
vim /etc/openstack-dashboard/local_settings
OPENSTACK_NEUTRON_NETWORK = {
‘enable_vpn‘: True,
}
1.5 确认ipsec
#cat test.sh
for FILE in /proc/sys/net/ipv4/conf/*
do
echo 0 > $FILE/accept_redirects
echo 0 > $FILE/rp_filter
done
sh test.shservice ipsec start ipsec verify
2 修改代码
2.1
vi /usr/lib/python2.7/site-packages/neutron/services/vpn/device_drivers/ipsec.py
97行添加
bcertutil = "certutil"
114行添加
NSS_FILES = [
‘cert8.db‘,
‘key3.db‘,
‘secmod.db‘
]
189行添加
def _ensure_nss(self, nss_files):
if not os.path.isfile(nss_files):
#start nss database
self._execute([self.bcertutil,
‘-N‘,
‘--empty-password‘,
‘-d‘, self.ipsecd_dir,
])
204行添加
for nss_file in self.NSS_FILES:
nss_path = os.path.join(self.ipsecd_dir, nss_file)
self._ensure_nss(nss_path)
327行添加
self.ipsecd_dir = os.path.join(
self.etc_dir, ‘ipsec.d‘)
409、410行修改和删除
修改 ‘--ipsecdir‘, self.etc_dir 成： ‘--ipsecdir‘, self.ipsecd_dir
删除 ‘--use-netkey‘,
422行删除
‘--defaultroutenexthop‘, nexthop,
470行添加
pid_file = self.pid_path + ‘.pid‘
if os.path.exists(pid_file):
os.remove(pid_file)
2.2
vi /usr/lib/python2.7/site-packages/neutron/services/vpn/device_drivers/template/openswan/ipsec.conf.template
3行删除：nat_traversal=yes
7行删除：keylife=60m 添加：salifetime=60m
20行删除：leftnexthop=%defaultroute
31行删除：rightnexthop=%defaultroute
63行删除：lifetime={{ipsec_site_connection.ipsecpolicy.lifetime_value}}s 添加：salifetime={{ipsec_site_connection.ipsecpolicy.lifetime_value}}s
3. 重启服务
systemctl enable neutron-vpn-agent service neutron-vpn-agent start 重启neutron所有服务
4. 测试
(10.1.0.0/24 - DevStack East)
|
| 10.1.0.1
[Quantum Router]
| 172.24.4.226
|
| 172.24.4.225
[Internet GW]
|
|
[Internet GW]
| 172.24.4.232
|
| 172.24.4.233
[Quantum Router]
| 10.2.0.1
|
(10.2.0.0/24 DevStack West)
openstack集群A（East）
外网：flat
网关:172.24.4.225
路由(routerA)外网ip:172.24.4.226
路由(routerA)内网ip:10.1.0.1
子网(netA)：10.1.0.0/24
openstack集群B(West)
外网：flat
网关:172.24.4.232
路由(routerB)外网ip:172.24.4.233
路由(routerB)内网ip:10.2.0.1
子网(netB)：10.2.0.0/24
在集群A分别执行下列命令，创建ike策略 ipsec策略 vpn服务 以及连接
neutron vpn-ikepolicy-create ikepolicy1 neutron vpn-ipsecpolicy-create ipsecpolicy1 neutron vpn-service-create --name myvpnA routerA netA neutron ipsec-site-connection-create --name vpnconnectionA --vpnservice-id myvpnA --ikepolicy-id ikepolicy1 --ipsecpolicy-id ipsecpolicy1 --peer-address 172.24.4.233 --peer-id 172.24.4.233 --peer-cidr 10.2.0.0/24 --psk secret
在集群B分别执行下列命令，创建ike策略 ipsec策略 vpn服务 以及连接
neutron vpn-ikepolicy-create ikepolicy1 neutron vpn-ipsecpolicy-create ipsecpolicy1 neutron vpn-service-create --name myvpnB routerB netB neutron ipsec-site-connection-create --name vpnconnectionB --vpnservice-id myvpn --ikepolicy-id ikepolicy1 --ipsecpolicy-id ipsecpolicy --peer-address 172.24.4.233 --peer-id 172.24.4.233 --peer-cidr 10.2.0.0/24 --psk secret
> peer-address 和peer-id 对写成对方router的外网ip地址即可
> peer-cidr写成对方路由保护的内网
> psk可以自定义，只要双方一致即可
接下来就是稍等片刻，connection的状态会由pending create 变成active
PS
在同一个集群中，创建两个用户网络和两个路由也可以进行测试
在测试vpn之前先确认两个子网上的vm可以ping通对方路由的外网ip，确认下vm是否可以访问外网
有问题及时留言