第二层隧道协议L2TP(Layer 2 Tunneling Protocol)是一种工业标准的Internet隧道协议，它使用UDP的1701端口进行通信。L2TP本身并没有任何加密，但是我们可以使用IPSec对L2TP包进行加密。
l2tp就用xl2tpd，官网：http://www.xelerance.com/services/software/xl2tpd/
IPSec就是openswan，提供IPSec加密，官网是：http://www.openswan.org/code/ ，在centos7 版本后， 提供ipsec 服务包由libreswan替代了openswan。
1、环境准备
服务器外网地址eth1：10.15.44.132/24
服务器内网地址eth2：192.168.184.128/24
VPN:10.0.0.0/16
[[email protected] ~]# yum install -y make gcc gmp-devel xmlto bison flex xmlto libpcap-devel lsof vim-enhanced man
一、安装lsof：用于数据访问，没有安装下面配置完openswan验证时会报错
[[email protected] ~]# yum install lsof –y
二、安装 配置openswan
1、安装
[[email protected] ~]# yum -y install openswan
2、配置
修改ipsec 主配置文件：
[[email protected] ~]# cp /etc/ipsec.conf{,.20161207bak}
[[email protected] ~]# vim /etc/ipsec.conf #注意格式对齐
config setup
nat_traversal=yes
virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12
oe=off
protostack=netkey
conn %default
Forceencaps=yes
conn L2TP-PSK-NAT
rightsubnet=vhost:%priv
also=L2TP-PSK-noNAT
conn L2TP-PSK-noNAT #定义一个VPN的连接，L2TP-PSK-noNAT是这个连接的名字
authby=secret
pfs=no
auto=add #ipsec启动后，VPN1连接处于等待状态
keyingtries=3
rekey=no
ikelifetime=8h
keylife=1h
type=transport
left=10.15.44.132 #vpn服务器外网ip
leftprotoport=17/1701 #vpn服务器端口，17指协议号 UDP协议 1701指端口号
right=%any #我们目前这种方式vpn比较简单，所以只配置了一方
rightprotoport=17/%any
#enable DPD
dpddelay=40
dpdtimeout=130
dpdaction=clear
# leftnexthop=%defaultroute
# rightnexthop=%defaultroute
[[email protected] ~]# cp /etc/ipsec.secrets{,.20161207bak}
[[email protected] ~]# vim /etc/ipsec.secrets #设置IPSec预共享密钥
include /etc/ipsec.d/*.secrets
10.15.44.132 %any: PSK "PASSWORD"
#外网IP地址 %any: PSK “预共享密钥”
[[email protected] ~]# for each in /proc/sys/net/ipv4/conf/*
>do
>echo 0 > $each/accept_redirects
>echo 0 > $each/send_redirects
>done
[[email protected] ~]# service ipsec restart #重启IPSec ，此步同ipsec restart，验证
Missing control file /var/run/pluto/pluto.ctl - is pluto running?
Starting pluto IKE daemon for IPsec: . [ OK ]
[[email protected] ~]# ipsec restart
Redirecting to: service ipsec stop
Shutting down pluto IKE daemon
002 shutting down
Redirecting to: service ipsec start
Starting pluto IKE daemon for IPsec: . [ OK ]
[[email protected] ~]# ipsec verify #如果正常运行，将会得到类似下面的输出：
Verifying installed system and configuration files
Version check and ipsec on-path [OK]
Libreswan 3.15 (netkey) on 2.6.32-642.el6.x86_64
Checking for IPsec support in kernel [OK]
NETKEY: Testing XFRM related proc values
ICMP default/send_redirects [OK]
ICMP default/accept_redirects [OK]
XFRM larval drop [OK]
Pluto ipsec.conf syntax [OK]
Hardware random device [N/A]
Checking rp_filter [ENABLED]
/proc/sys/net/ipv4/conf/default/rp_filter [ENABLED]
/proc/sys/net/ipv4/conf/lo/rp_filter [ENABLED]
/proc/sys/net/ipv4/conf/eth1/rp_filter [ENABLED]
rp_filter is not fully aware of IPsec and should be disabled
Checking that pluto is running [OK]
Pluto listening for IKE on udp 500 [OK]
Pluto listening for IKE/NAT-T on udp 4500 [OK]
Pluto ipsec.secret syntax [OK]
Checking ‘ip‘ command [OK]
Checking ‘iptables‘ command [OK]
Checking ‘prelink‘ command does not interfere with FIPS [PRESENT]
Checking for obsolete ipsec.conf options [OK]
Opportunistic Encryption [DISABLED]
ipsec verify: encountered 7 errors - see ‘man ipsec_verify‘ for help
[[email protected] ~]# chkconfig ipsec on
遇到的问题：
1、Two or more interfacesfound, checking IP forwarding [Failed]
[[email protected] ~]# vim /etc/sysctl.conf net.ipv4.ip_forward = 1 [[email protected] ~]# sysctl -p
2、Checking that pluto isrunning [Failed]
[[email protected] ~]# cd /var/run/pluto/ [[email protected] pluto]# ipsec pluto [[email protected] pluto]# ls pluto.ctl pluto.pid [[email protected] pluto]# ipsec verify
三、安装 配置ppp：提供用户名、密码 认证
[[email protected] ~]# yum -y install ppp [[email protected] ~]# rpm -qa|grep -i ppp rp-pppoe-3.10-16.el6.x86_64 ppp-2.4.5-10.el6.x86_64 [[email protected] ~]# vim /etc/ppp/options.xl2tpd #如果文件不存在直接新建就好了 require-mschap-v2 ms-dns 192.168.100.189 #分配给客户机的DNS地址 ms-dns 202.96.209.133 #ms-wins 192.168.1.2 #ms-wins 192.168.1.4 noccp #asyncmap 0 auth crtscts #lock #hide-password #modem idle 1800 mtu 1410 mru 1410 nodefaultroute debug #name xl2tpd lock proxyarp connect-delay 5000 #lcp-echo-interval 30 #lcp-echo-failure 4 [[email protected] ~]# vim /etc/ppp/chap-secrets #添加用户名/密码（客户端登陆时的用户名密码） # Secrets for authentication using CHAP # client server secret IP addresses # user server password ip justin * 51cto * #justin xl2tpd 51cto * #上面的xl2tpd对应上面etc/ppp/options.xl2tpd文件中的name xl2tpd
/etc/ppp/options.xl2tpd 如果文件不存在直接新建或者cp xl2tpd-1.3.6/examples/ppp-options.xl2tpd
四、安装 配置L2TP：提供L2TP VPN服务
1、安装
[[email protected] ~]# yum -y install xl2tpd Loaded plugins: fastestmirror, refresh-packagekit, security Setting up Install Process Loading mirror speeds from cached hostfile * base: mirrors.aliyun.com * extras: mirrors.aliyun.com * updates: mirrors.tuna.tsinghua.edu.cn base | 3.7 kB 00:00 extras | 3.4 kB 00:00 updates | 3.4 kB 00:00 No package xl2tpd available. Error: Nothing to do [[email protected] ~]# wget [[email protected] ~]# yum install -y libpcap-devel^C #xl2tpd的一个依赖，不然编译会报错 [[email protected] ~]# tar zxvf xl2tpd-1.3.6.tar.gz [[email protected] ~]# cd xl2tpd-1.3.6 [[email protected] xl2tpd-1.3.6]# make [[email protected] xl2tpd-1.3.6]# make install [[email protected] xl2tpd-1.3.6]# mkdir /etc/xl2tpd [[email protected] xl2tpd-1.3.6]# cp doc/l2tpd.conf.sample /etc/xl2tpd/xl2tpd.conf [[email protected] xl2tpd-1.3.6]# cp doc/l2tp-secrets.sample /etc/xl2tpd/xl2tp-secrets [[email protected] xl2tpd-1.3.6]# vim /etc/xl2tpd/xl2tpd.conf [global] ;port=1701 #这个在文件是被注释掉的意思，如果要改端口号，改成1723是不行的，l2tp客户端好像不能改端口 [lns default] ip range = 10.0.0.2-10.0.255.254 #vpn连接成功之后，服务器给客户端分配的ip地址，这个不要与局域网ip段重合 local ip = 10.0.0.1 #不是外网地址，也不是内网地址，而是虚拟网关的IP地址，这个没有开启客户端连接时候会提示localhost pppd[3929]: Could not determine local IP address length bit = yes require chap = yes refuse pap = yes refuse authentication = yes ppp debug = yes name = LinuxVPNserver pppoptfile = /etc/ppp/options.xl2tpd [[email protected] xl2tpd-1.3.6]#
xl2tpd.conf也可以使用默认示例配置文件examples/xl2tpd.conf，这个文件更加简洁
启用包转发
[[email protected] ~]# vim /etc/sysctl.conf net.ipv4.ip_forward = 1 net.ipv4.conf.default.rp_filter = 0 net.ipv4.conf.default.accept_source_route =0 kernel.sysrq = 0 kernel.core_uses_pid = 1 net.ipv4.tcp_syncookies = 1 kernel.msgmnb = 65536 kernel.msgmax = 65536 kernel.shmmax = 68719476736 kernel.shmall = 4294967296 net.core.xfrm_larval_drop = 1 [[email protected] ~]# sysctl -p
防火墙配置
[[email protected] ~]# iptables -A INPUT -p udp --destination-port 1701 -j ACCEPT [[email protected] ~]# iptables -A POSTROUTING -t nat -s 10.0.0.0/24 -j MASQUERADE [[email protected] ~]# /etc/init.d/iptables save [[email protected] ~]# /etc/init.d/iptables restart
启动
参数D表示让l2tpd在前台运行，显示整个l2tpd的运行信息，如果不加D，l2tpd在后台运行；其它参数查看目录下的README*/
[[email protected] xl2tpd-1.3.6]# ./xl2tpd -D
xl2tpd[2144]: setsockopt recvref[30]: Protocol not available
xl2tpd[2144]: L2TP kernel support not detected (try modprobing l2tp_ppp and pppol2tp)
xl2tpd[2144]: open_controlfd: Unable to open /var/run/xl2tpd/l2tp-control for reading.
[[email protected] xl2tpd-1.3.6]# mkdir /var/run/xl2tpd/
[[email protected] xl2tpd-1.3.6]# touch /var/run/xl2tpd/l2tp-control
[[email protected] xl2tpd-1.3.6]# ./xl2tpd -D
xl2tpd[2275]: setsockopt recvref[30]: Protocol not available
xl2tpd[2275]: L2TP kernel support not detected (try modprobing l2tp_ppp and pppol2tp)
xl2tpd[2275]: xl2tpd version xl2tpd-1.3.6 started on localhost.localdomain PID:2275
xl2tpd[2275]: Written by Mark Spencer, Copyright (C) 1998, Adtran, Inc.
xl2tpd[2275]: Forked by Scott Balmos and David Stipp, (C) 2001
xl2tpd[2275]: Inherited by Jeff McAdams, (C) 2002
xl2tpd[2275]: Forked again by Xelerance (www.xelerance.com) (C) 2006
xl2tpd[2275]: Listening on IP address 0.0.0.0, port 1701
[[email protected] xl2tpd-1.3.6]# netstat -naptlu | grep xl2tpd
udp 0 0 0.0.0.0:1701 0.0.0.0:* 3695/./xl2tpd
[[email protected] xl2tpd-1.3.6]# vim /etc/init.d/xl2tpd
#!/bin/sh
#
# xl2tpd This shell ｓｃｒｉｐｔ takes care of starting and stopping l2tpd.
#
# chkconfig: - 80 30
# de ｓｃｒｉｐｔ ion: Layer 2 Tunnelling Protocol Daemon (RFC 2661)
#
# processname: xl2tpd
# config: /etc/xl2tpd/xl2tpd.conf
# pidfile: /var/run/xl2tpd.pid
#Servicename
SERVICE=xl2tpd
# Source function library.
. /etc/rc.d/init.d/functions
# Source networking configuration.
. /etc/sysconfig/network
if [ ${NETWORKING} = "no" ]
then
exit 0
fi
[ -x /usr/local/sbin/$SERVICE ] || exit 0
RETVAL=0
start() {
echo -n "Starting $SERVICE: "
if [ ! -d /var/run/xl2tpd ]
then
mkdir /var/run/xl2tpd
fi
daemon /usr/local/sbin/$SERVICE
RETVAL=$?
[ $RETVAL -eq 0 ] && touch /var/lock/subsys/$SERVICE
echo ""
return $RETVAL
}
stop() {
echo -n "Stopping $SERVICE: "
killproc $SERVICE
RETVAL=$?
echo
[ $RETVAL -eq 0 ] && rm -f /var/lock/subsys/$SERVICE
return $RETVAL
}
restart() {
stop
start
}
# See how we were called.
case "$1" in
start)
start
;;
stop)
stop
;;
status)
status $SERVICE
RETVAL=$?
;;
restart|reload)
restart
;;
condrestart)
[ -f /var/lock/subsys/$SERVICE ] && restart || :
;;
*)
echo "Usage: $SERVICE {start|stop|status|restart|reload|condrestart}"
exit 1
esac
[[email protected] xl2tpd-1.3.6]# chmod +x /etc/init.d/xl2tpd
[[email protected] xl2tpd-1.3.6]# chkconfig --add xl2tpd
[[email protected] xl2tpd-1.3.6]# chkconfig --add pppoe-server
[[email protected] xl2tpd-1.3.6]# chkconfig --add ipsec
[[email protected] xl2tpd-1.3.6]# chkconfig xl2tpd on
[[email protected] xl2tpd-1.3.6]# chkconfig pppoe-server on
[[email protected] xl2tpd-1.3.6]# chkconfig ipsec on
[[email protected] xl2tpd-1.3.6]# /etc/init.d/pppoe-server restart
[[email protected] xl2tpd-1.3.6]# /etc/init.d/ipsec restart
[[email protected] xl2tpd-1.3.6]# /etc/init.d/xl2tpd restart
[[email protected] xl2tpd-1.3.6]# /etc/rc.d/rc.local
/etc/init.d/xl2tpd start
[[email protected] xl2tpd-1.3.6]#
日志信息：
[[email protected] xl2tpd]# tail -f /var/log/messages Dec 9 12:13:02 localhost xl2tpd[2457]: Written by Mark Spencer, Copyright (C) 1998, Adtran, Inc. Dec 9 12:13:02 localhost xl2tpd[2457]: Forked by Scott Balmos and David Stipp, (C) 2001 Dec 9 12:13:02 localhost xl2tpd[2457]: Inherited by Jeff McAdams, (C) 2002 Dec 9 12:13:02 localhost xl2tpd[2457]: Forked again by Xelerance (www.xelerance.com) (C) 2006 Dec 9 12:13:02 localhost xl2tpd[2457]: Listening on IP address 0.0.0.0, port 1701
五、测试拨号是否成功
端口测试：
一般我们用telnet测试端口连通性，但是telnet使用的是tcp协议，也就是说telnet只能检测tcp的这个端口打开了没。除了telnet以外，还有一个命令nc也可查看端口是否打开，它可以检测tcp和udp端口连通性。
[[email protected] ppp]# nc -vuz 192.168.100.243 1707 Connection to 192.168.100.243 1707 port [udp/vdmplay] succeeded! [[email protected] ppp]# nc -vuz 10.10.2.80 80 Connection to 10.10.2.80 80 port [udp/http] succeeded! [[email protected] ppp]#
-i<延迟秒数> 设置时间间隔，以便传送信息及扫描通信端口。
-l 使用监听模式，管控传入的资料。
-n 直接使用IP地址，而不通过域名服务器。
-o<输出文件> 指定文件名称，把往来传输的数据以16进制字码倾倒成该文件保存。
-p<通信端口> 设置本地主机使用的通信端口。
-r 乱数指定本地与远端主机的通信端口。
-s<来源地址> 设置本地主机送出数据包的IP地址。
-u 使用UDP传输协议。
-v 显示指令执行过程。
-w<超时秒数> 设置等待连线的时间。
-z 使用0输入/输出模式，只在扫描通信端口时使用。
客户端连接测试：
windows server 2008下：L2TP客户端设置
1、右键选择创建好的VPN连接属性，点击“安全”
VPN类型：使用IPsec 的第2层隧道协议（L2TP/IPsec）
数据加密：需要加密（如果服务器拒绝将断开连接）
高级设置：使用预共享密钥作为身份验证，密钥对应/etc/ipsec.secrets中设置的密钥
2、修改注册表：运行：regedit.exe
开始>>运行>>regedit.exe找到下面这个路径:
HEKY_LOCAL_MACHINE/SYTEM/CUrrentCOntrolSet/Services/RasMan/Parameters,新增或修改ProhibitIpSec的值（类型DWORD）为1
完成后测试连接是否正常，若仍提示连接不上，重启电脑再次尝试。
如果还是无法连接查看服务端日志/var/log/messages
时间： 2024-08-01 10:45:17