{"id":541,"date":"2016-09-30T00:03:12","date_gmt":"2016-09-30T00:03:12","guid":{"rendered":"http:\/\/16c222aa19898e5058938167c8ab6c57"},"modified":"2017-10-24T13:06:04","modified_gmt":"2017-10-24T05:06:04","slug":"linux-l2tp","status":"publish","type":"post","link":"https:\/\/www.xiaobo.li\/notes\/archives\/541","title":{"rendered":"linux l2tp"},"content":{"rendered":"

yum install openswan xl2tpd ppp<\/p>\n

\/etc\/ipsec.conf<\/b><\/p>\n

config setup\r\n\tprotostack=netkey\r\n\tdumpdir=\/var\/run\/pluto\/\r\n\tvirtual_private=%v4:10.0.0.0\/8,%v4:192.168.0.0\/16,%v4:172.16.0.0\/12,%v4:25.0.0.0\/8,%v4:100.64.0.0\/10,%v6:fd00::\/8,%v6:fe80::\/10\r\n\tnat_traversal=yes\r\n\toe=off\r\n<\/pre>\n
 <\/p>\n
\/etc\/ipsec.d\/l2tp-psk.conf<\/b><\/p>\n
conn L2TP-PSK-NAT\r\n\trightsubnet=vhost:%priv\r\n\talso=L2TP-PSK-noNAT\r\n\r\nconn L2TP-PSK-noNAT\r\n\tauthby=secret\r\n\tpfs=no\r\n\tauto=add\r\n\tkeyingtries=3\r\n\trekey=no\r\n\tikelifetime=8h\r\n\tkeylife=1h\r\n\ttype=transport\r\n\tleft=HOST_IP<\/span>\r\n\tleftprotoport=17\/1701\r\n\tright=%any\r\n\trightprotoport=17\/%any\r\n\tdpddelay=40\r\n\tdpdtimeout=130\r\n\tdpdaction=clear\r\n\tleftnexthop=%defaultroute\r\n\trightnexthop=%defaultroute\r\n\r\n<\/span><\/pre>\n
\/etc\/ipsec.secrets
\n<\/b>HOST_IP %any<\/span><\/span>: PSK \"\u5bc6\u94a5\"<\/code><\/p>\n
\/etc\/xl2tpd\/xl2tpd.conf<\/code><\/b><\/p>\n
[global]
\nipsec saref = yes
\n[lns default]
\nip range = 192.168.0.200-192.168.0.254
\nlocal ip = 192.168.0.196
\nrefuse chap = yes
\nrefuse pap = yes
\nrequire authentication = yes
\nppp debug = yes
\npppoptfile = \/etc\/ppp\/options
\nlength bit = yes<\/code><\/p>\n
\/etc\/sysctl.conf<\/b>
\n<\/code>net.ipv4.conf.all.send_redirects = 0
\nnet.ipv4.conf.default.send_redirects = 0
\nnet.ipv4.conf.all.accept_redirects = 0
\nnet.ipv4.conf.default.accept_redirects = 0
\nnet.ipv4.conf.default.rp_filter = 0
\n<\/code><\/p>\n
test<\/code><\/b><\/p>\n
\n
sysctl<\/span> -<\/span>p<\/span><\/div>\n
service <\/span>ipsec <\/span>start<\/span><\/div>\n
\n
ipsec <\/span>verify<\/span><\/p>\n
rp_filter<\/b>
\necho 0 > \/proc\/sys\/net\/ipv4\/conf\/lo\/rp_filter
\necho 0 > \/proc\/sys\/net\/ipv4\/conf\/eth0\/rp_filter<\/p>\n<\/div>\n<\/div>\n
 <\/p>\n
#network \u53c2\u8003(\u65b0\u624b\u522b\u5b8c\u5168\u7167\u6284)\u3002
\n*nat
\n:PREROUTING ACCEPT [39:3503]
\n:POSTROUTING ACCEPT [0:0]
\n:OUTPUT ACCEPT [0:0]
\n-A POSTROUTING -s 192.168.7.0\/24 -o eth0 -j MASQUERADE
\nCOMMIT
\n# Completed on Thu Jun 28 15:50:40 2012
\n# Generated by iptables-save v1.4.7 on Thu Jun 28 15:50:40 2012
\n*filter
\n:INPUT ACCEPT [0:0]
\n:FORWARD ACCEPT [0:0]
\n:OUTPUT ACCEPT [121:13264]
\n-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
\n-A INPUT -p icmp -j ACCEPT
\n-A INPUT -i lo -j ACCEPT
\n-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
\n-A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
\n-A INPUT -p tcp -m state --state NEW -m tcp --dport 53 -j ACCEPT
\n-A INPUT -p udp -m state --state NEW -m udp --dport 53 -j ACCEPT
\n-A INPUT -p tcp -m state --state NEW -m tcp --dport 1194 -j ACCEPT
\n-A INPUT -p udp -m state --state NEW -m udp --dport 1701 -j ACCEPT
\n-A INPUT -p udp -m state --state NEW -m udp --dport 500 -j ACCEPT
\n-A INPUT -p udp -m state --state NEW -m udp --dport 4500 -j ACCEPT-A INPUT -j REJECT --reject-with icmp-host-prohibited
\n-A FORWARD -d 192.168.7.0\/24 -j ACCEPT
\n-A FORWARD -s 192.168.7.0\/24 -j ACCEPT
\n-A FORWARD -j REJECT --reject-with icmp-host-prohibited
\nCOMMIT
\n# Completed on Thu Jun 28 15:50:40 2012<\/p>\n
Command:<\/b>
\niptables -t nat -A POSTROUTING -s 192.168.195.0\/24 -o eth0 -j MASQUERADE
\niptables -t nat -A POSTROUTING -s 192.168.196.0\/24 -o eth0 -j MASQUERADE<\/p>\n
 <\/p>\n
\u4f7f\u7528ipsec whack --status\u67e5\u770bvpn\u7684\u72b6\u6001\uff1b<\/span><\/p>\n
-----------------------------------------------------<\/span><\/p>\n
windows \u7cfb\u7edf\u4f7f\u7528l2tp\u51fa\u73b0 809\u9519\u8bef\u65f6\u5904\u7406\u65b9\u5f0f\uff1a<\/span><\/p>\n
\u5fae\u8f6f\u5b98\u7f51\u63a8\u8350\u65b9\u6cd5\uff0c\u65b0\u5efa\u6ce8\u518c\u8868\u503c
\n\u6ce8\uff1a \u4fee\u6539\u540e\u5fc5\u9700\u8981\u91cd\u542f\u7535\u8111\u624d\u80fd\u751f\u6548<\/span><\/b>
\n<\/span><\/p>\n
Windows Registry Editor Version 5.00<\/span><\/p>\n

\n[HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\PolicyAgent]
\n\"AssumeUDPEncapsulationContextOnSendRule\"=dword:00000002
\n<\/span><\/p>\n
\u00a0<\/span><\/p>\n
--------------------------------------------------------------------------------------------------<\/p>\n
\u53c2\u80032\uff1a<\/span><\/b><\/p>\n
\u4e00\u3001\/etc\/ipsec.conf<\/span><\/p>\n
version 2.0\r\nconfig setup\r\n    nat_traversal=yes\r\n    virtual_private=%v4:10.0.0.0\/8,%v4:192.168.0.0\/16,%v4:172.16.0.0\/12\r\n    oe=off\r\n    protostack=netkey\r\n\r\nconn L2TP-PSK-NAT\r\n    rightsubnet=vhost:%priv\r\n    also=L2TP-PSK-noNAT\r\n\r\nconn L2TP-PSK-noNAT\r\n    authby=secret\r\n    pfs=no\r\n    auto=add\r\n    keyingtries=3\r\n    rekey=no\r\n    ikelifetime=8h\r\n    keylife=1h\r\n    type=transport\r\n    left=YOUR.SERVER.IP.ADDRESS\r\n    leftprotoport=17\/1701\r\n    right=%any\r\n    rightprotoport=17\/%any<\/span><\/pre>\n
 <\/p>\n
\u4e8c\u3001\/etc\/ipsec.secrets\uff1a<\/span><\/p>\n
YOUR.SERVER.IP.ADDRESS   %any:  PSK \"YourSharedSecret\"<\/span><\/pre>\n
\uff08\u300cYOUR.SERVER.IP.ADDRESS\u300d\u8fd9\u90e8\u5206\u6362\u6210\u4f60\u7684\u670d\u52a1\u5668\u7684 IP \u5730\u5740\uff0c\u628a\u300cYourSharedSecret\u300d\u90e8\u5206\u6362\u6210\u968f\u4fbf\u4e00\u4e2a\u5b57\u4e32\uff0c\u4f8b\u5982\u4f60\u559c\u6b22\u7684\u4e00\u53e5\u8bdd\uff0c\u7b49\u7b49\u3002\uff09<\/span><\/p>\n
\u4e09\u3001\u8fd0\u884c\u4ee5\u4e0b\u547d\u4ee4\uff1a<\/span><\/p>\n
for each in \/proc\/sys\/net\/ipv4\/conf\/*\r\ndo\r\n    echo 0 > $each\/accept_redirects\r\n    echo 0 > $each\/send_redirects\r\ndone<\/span><\/pre>\n
\u56db\u3001\u68c0\u67e5\u4e00\u4e0b IPSec \u80fd\u5426\u6b63\u5e38\u5de5\u4f5c\uff1a<\/span><\/p>\n
sudo ipsec verify<\/span><\/pre>\n
\u5982\u679c\u5728\u7ed3\u679c\u4e2d\u770b\u5230\u300cOpportunistic Encryption Support\u300d\u88ab\u7981\u7528\u4e86\uff0c\u6ca1\u5173\u7cfb\uff0c\u5176\u4ed6\u9879 OK \u5373\u53ef\u3002<\/span><\/p>\n
\u4e94\u3001\u91cd\u542f openswan:<\/span><\/p>\n
sudo \/etc\/init.d\/ipsec restart<\/span><\/pre>\n
\u516d\u3001\u5b89\u88c5 L2TP<\/span><\/p>\n
\u8fd0\u884c\u4ee5\u4e0b\u547d\u4ee4\uff1a<\/span><\/p>\n
sudo aptitude install xl2tpd<\/span><\/pre>\n
\u516b\u3001\u7528\u6587\u5b57\u7f16\u8f91\u5668\u6253\u5f00 \/etc\/xl2tpd\/xl2tpd.conf\uff0c\u6539\u6210\u8fd9\u6837\uff1a<\/span><\/p>\n
[global]\r\nipsec saref = yes\r\n\r\n[lns default]\r\nip range = 10.1.2.2-10.1.2.255\r\nlocal ip = 10.1.2.1\r\n;require chap = yes\r\nrefuse chap = yes\r\nrefuse pap = yes\r\nrequire authentication = yes\r\nppp debug = yes\r\npppoptfile = \/etc\/ppp\/options.xl2tpd\r\nlength bit = yes<\/span><\/pre>\n
\u8fd9\u91cc\u8981\u6ce8\u610f\u7684\u662f ip range \u4e00\u9879\u91cc\u7684 IP \u5730\u5740\u4e0d\u80fd\u548c\u4f60\u6b63\u5728\u7528\u7684 IP \u5730\u5740\u91cd\u5408\uff0c\u4e5f\u4e0d\u53ef\u4e0e\u7f51\u7edc\u4e0a\u7684\u5176\u4ed6 IP \u5730\u5740\u51b2\u7a81\u3002<\/span><\/p>\n
\u4e5d\u3001\u5b89\u88c5 ppp\u3002\u8fd9\u662f\u7528\u6765\u7ba1\u7406 VPN \u7528\u6237\u7684\u3002<\/span><\/p>\n
sudo aptitude install ppp<\/span><\/pre>\n
\u5341\u3001\u68c0\u67e5\u4e00\u4e0b \/etc\/ppp \u76ee\u5f55\u91cc\u6709\u6ca1\u6709 options.xl2tpd \u8fd9\u4e2a\u6587\u4ef6\uff0c\u6ca1\u6709\u7684\u8bdd\u5c31\u5efa\u4e00\u4e2a\uff0c\u6587\u4ef6\u5185\u5bb9\u5982\u4e0b\uff1a<\/span><\/p>\n
require-mschap-v2\r\nms-dns 208.67.222.222\r\nms-dns 208.67.220.220<\/span>\r\nasyncmap 0\r\nauth\r\ncrtscts\r\nlock\r\nhide-password\r\nmodem\r\ndebug\r\nname l2tpd\r\nproxyarp\r\nlcp-echo-interval 30\r\nlcp-echo-failure 4<\/span><\/pre>\n
\u6ce8\u610f ms-dns \u53ef\u66f4\u6362\u4e3a\u4f60\u6700\u8fd1\u670d\u52a1\u5730\u5740\u3002<\/span><\/p>\n
\u5341\u4e00\u3001\u6dfb\u52a0 VPN \u7528\u6237\u3002
\n\u7528\u6587\u5b57\u7f16\u8f91\u5668\u6253\u5f00 \/etc\/ppp\/chap-secrets:<\/span><\/p>\n
# user      server      password            ip\r\ntest        l2tpd       testpassword        *<\/span><\/pre>\n
\u5982\u679c\u4f60\u4e4b\u524d\u8bbe\u7f6e\u8fc7 PPTP VPN\uff0cchap-secrets \u6587\u4ef6\u91cc\u53ef\u80fd\u5df2\u7ecf\u6709\u4e86\u5176\u4ed6\u7528\u6237\u7684\u5217\u8868\u3002
\n\u4f60\u53ea\u8981\u628a test l2tpd testpassword * \u8fd9\u6837\u52a0\u5230\u540e\u9762\u5373\u53ef\u3002<\/span><\/p>\n
\u5341\u4e8c\u3001\u91cd\u542f xl2tpd:<\/span><\/p>\n
sudo \/etc\/init.d\/xl2tpd restart<\/span><\/pre>\n
 <\/p>\n
\u53c2\u8003\uff1a
\nhttps:\/\/segmentfault.com\/a\/1190000000646294<\/a>\u00a0 \uff08\u914d\u7f6e\uff09<\/p>\n","protected":false},"excerpt":{"rendered":"
 <\/p>\n
yum install openswan xl2tpd ppp<\/p>\n
 <\/p>\n
\/etc\/ipsec.conf<\/b><\/p>\n
 <\/p>\n
config setup
\n        protostack=netkey
\n        dumpdir=\/var\/run\/pluto\/
\n        virtual_private=%v4:10.0.0.0\/8,%v4:192.168.0.0\/16,%v4:172.16.0.0\/12,%v4:25.0.0.0\/8,%v4:100.64.0.0\/10,%v6:fd00::\/8,%v6:fe80::\/10
\n        nat_traversal=yes
\n        oe=off<\/p>\n
 <\/p>\n
\/etc\/ipsec.d\/l2tp-psk.conf<\/b><\/p>\n
conn L2TP-PSK-NAT
\n    rightsubnet=vhost:%priv
\n  &n...<\/p>\n
 \u7ee7\u7eed\u9605\u8bfb →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[291],"tags":[],"class_list":["post-541","post","type-post","status-publish","format-standard","hentry","category-network"],"_links":{"self":[{"href":"https:\/\/www.xiaobo.li\/notes\/wp-json\/wp\/v2\/posts\/541","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.xiaobo.li\/notes\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.xiaobo.li\/notes\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.xiaobo.li\/notes\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.xiaobo.li\/notes\/wp-json\/wp\/v2\/comments?post=541"}],"version-history":[{"count":0,"href":"https:\/\/www.xiaobo.li\/notes\/wp-json\/wp\/v2\/posts\/541\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.xiaobo.li\/notes\/wp-json\/wp\/v2\/media?parent=541"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.xiaobo.li\/notes\/wp-json\/wp\/v2\/categories?post=541"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.xiaobo.li\/notes\/wp-json\/wp\/v2\/tags?post=541"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}