CentOS 6.5安装L2TP VPN配置实例

1.
yum install -y ppp iptables make gcc gmp-devel xmlto bison flex xmlto libpcap-devel lsof vim-enhanced
2.
yum -y install nss-devel nspr-devel pkgconfig pam-devel libcap-ng-devel libselinux-devel curl-devel flex bison gcc make fipscheck-devel unbound-devel xmlto
3.
yum install openswan ppp xl2tpd

4.

vi /etc/ipsec.conf
version 2.0
config setup
    nat_traversal=yes
    virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12
    oe=off
    protostack=netkey
conn L2TP-PSK-NAT
    rightsubnet=vhost:%priv
    also=L2TP-PSK-noNAT
conn L2TP-PSK-noNAT
    authby=secret
    pfs=no
    auto=add
    keyingtries=3
    rekey=no
    ikelifetime=8h
    keylife=1h
    type=transport
    left=210.73.211.233
    leftprotoport=17/1701
    right=%any
    rightprotoport=17/%any

5.vi /etc/ipsec.secrets

  xxx.xxx.xxx.xxx(公网IP地址) %any: PSK "33e9.com"

6. vim /etc/sysctl.conf
   net.ipv4.ip_forward = 1
   net.ipv4.conf.default.rp_filter = 0
   net.ipv4.conf.all.send_redirects = 0
   net.ipv4.conf.default.send_redirects = 0
   net.ipv4.conf.all.log_martians = 0
   net.ipv4.conf.default.log_martians = 0
   net.ipv4.conf.default.accept_source_route = 0
   net.ipv4.conf.all.accept_redirects = 0
   net.ipv4.conf.default.accept_redirects = 0
   net.ipv4.icmp_ignore_bogus_error_responses = 1

   sysctl -p

7. ipsec initnss
   //必须初始化，否则会验证nss数据库失败，诸如这样的错误：checking that pluto is running failed  或者 no "/var/run/pluto/pluto.ctl" 或者 Failed to initialize nss database sql:/etc/ipsec.d
   ipsec setup start
   ipsec verify 

8. vim /etc/xl2tpd/xl2tpd.conf
  [global]

  listen-addr = xxx.xxx.xxx.xxx //公网IP地址
  port = 1701
  auth file = /etc/ppp/chap-secrets

   [lns default]
  ip range = 192.168.39.39-192.168.39.89
  local ip = 192.168.39.99
  require chap = yes
  refuse pap = yes
  require authentication = yes
  name = LinuxVPNserver
  ppp debug = yes
  pppoptfile = /etc/ppp/options.xl2tpd
  length bit = yes

9. /etc/ppp/options.xl2tpd

   ipcp-accept-local
   ipcp-accept-remote
   ms-dns  8.8.8.8
   ms-dns  8.8.4.4
   noccp
   auth
   crtscts
   idle 1800
   mtu 1356
   mru 1356
   nodefaultroute
   debug
   lock
   proxyarp
   connect-delay 5000

10. vim /etc/ppp/chap-secrets
    apple   l2tpd  2wsxzaq1   *

11. iptables -A INPUT -p udp -m multiport --dports 500,4500,1701 -j ACCEPT

    iptables -t nat -A POSTROUTING -s 192.168.39.0/24 -o eth1 -j MASQUERADE