linode centos7 xl2tp ipsec
程序员文章站
2022-07-14 15:24:08
...
xl2tp客户端:https://blog.csdn.net/loomz/article/details/52955267
https://www.jianshu.com/p/e772ffc22e77
配置完客户端要加路由....???
最新的为https://www.iteye.com/blog/haoningabc-2480610
2018年2月14日更新:
aws的ip为172.31.26.41
iptables -t nat -A POSTROUTING -s 172.31.26.0/24 -o eth0 -j MASQUERADE
然后按照
http://blog.csdn.net/kitvv/article/details/50696585
操作
psk的那个secure文件改成
13.115.181.153 %any: PSK "haha"
################
在aws上建立rhel7.1的虚拟机
PermitRootLogin yes
PasswordAuthentication yes
参考
http://www.esojourn.org/blog/post/setup-l2tp-vpn-server-with-ipsec-in-centos6.php?page=2&part=1
使用xl2tp和ipsec,ppp让iphone和mac上网
注意的地方
1.尽量用新版本
2.配置的vpn用户名密码要是系统能登录的
3.http://pkgs.org/centos-7/nux-dextop-x86_64/xl2tpd-1.3.6-2.el7.nux.x86_64.rpm.html
下载对应的系统对应的rpm包 xl2tpd
rpm -ivh xl2tpd-1.3.6-8.el7.x86_64.rpm
4.yum install ppp openswan
openswan就是ipsec
5.我linode的ip是106.187.44.20,要替换下面的ip到你的ip
17/%any 和ifconfig得到的内网ip,这里注意一下
验证
sysctl -p
service ipsec start
ipsec verify
可用的时候是这样的
yum install iptables-services
systemctl enable iptables
COMMIT 注意要有换行
xl2tpd -D &
service iptables restart
ipsec restart
----------------ubuntu14.04 aws
设置root的ssh
------------------------------------------------------------
------------------------------------------------------------
ubuntu14.04参考
https://raymii.org/s/tutorials/IPSEC_L2TP_vpn_with_Ubuntu_14.04.html
apt-get install iptables-persistent
apt-get install ppp openswan xl2tpd
也没好使
http://crazyof.me/blog/archives/610.html
http://www.enjoydiy.com/213.html
http://ubuntuforums.org/showthread.php?t=2211939
vim /etc/ipsec.conf
注意,left为内网ifconfig的ip,leftprotoport=17/%any 一定要这么写,写成1701会报错
cat /etc/rc.local
cat /etc/iptables/rules.v4
cat /etc/xl2tpd/xl2tpd.conf
网段和iptables配置的网段要一样,不能是已经存在的网段
cat /etc/ppp/chap-secrets
useradd hey
passwd hey
heyman
cat /etc/ipsec.secrets
ip为ifconfig的内网ip
设置
/etc/sysctl.conf 上面
sysctl -p
/etc/init.d/iptables-persistent restart
service ipsec restart
servcie xl2tpd restart
tailf /var/log/secure 看访问的log
r如果有尝试密码的使用
/etc/hosts.deny
all:218.87.111.110
禁止
iphone访问的话
https://www.jianshu.com/p/e772ffc22e77
配置完客户端要加路由....???
最新的为https://www.iteye.com/blog/haoningabc-2480610
2018年2月14日更新:
aws的ip为172.31.26.41
iptables -t nat -A POSTROUTING -s 172.31.26.0/24 -o eth0 -j MASQUERADE
然后按照
http://blog.csdn.net/kitvv/article/details/50696585
操作
psk的那个secure文件改成
13.115.181.153 %any: PSK "haha"
################
在aws上建立rhel7.1的虚拟机
PermitRootLogin yes
PasswordAuthentication yes
[ec2-user@ip-172-31-17-111 ~]$ cat /etc/ssh/sshd_config # $OpenBSD: sshd_config,v 1.93 2014/01/10 05:59:19 djm Exp $ # This is the sshd server system-wide configuration file. See # sshd_config(5) for more information. # This sshd was compiled with PATH=/usr/local/bin:/usr/bin # The strategy used for options in the default sshd_config shipped with # OpenSSH is to specify options with their default value where # possible, but leave them commented. Uncommented options override the # default value. # If you want to change the port on a SELinux system, you have to tell # SELinux about this change. # semanage port -a -t ssh_port_t -p tcp #PORTNUMBER # #Port 22 #AddressFamily any #ListenAddress 0.0.0.0 #ListenAddress :: # The default requires explicit activation of protocol 1 #Protocol 2 # HostKey for protocol version 1 #HostKey /etc/ssh/ssh_host_key # HostKeys for protocol version 2 HostKey /etc/ssh/ssh_host_rsa_key #HostKey /etc/ssh/ssh_host_dsa_key HostKey /etc/ssh/ssh_host_ecdsa_key HostKey /etc/ssh/ssh_host_ed25519_key # Lifetime and size of ephemeral version 1 server key #KeyRegenerationInterval 1h #ServerKeyBits 1024 # Ciphers and keying #RekeyLimit default none # Logging # obsoletes QuietMode and FascistLogging #SyslogFacility AUTH SyslogFacility AUTHPRIV #LogLevel INFO # Authentication: #LoginGraceTime 2m PermitRootLogin yes #StrictModes yes #MaxAuthTries 6 #MaxSessions 10 #RSAAuthentication yes #PubkeyAuthentication yes # The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2 # but this is overridden so installations will only check .ssh/authorized_keys AuthorizedKeysFile .ssh/authorized_keys #AuthorizedPrincipalsFile none #AuthorizedKeysCommand none #AuthorizedKeysCommandUser nobody # For this to work you will also need host keys in /etc/ssh/ssh_known_hosts #RhostsRSAAuthentication no # similar for protocol version 2 #HostbasedAuthentication no # Change to yes if you don't trust ~/.ssh/known_hosts for # RhostsRSAAuthentication and HostbasedAuthentication #IgnoreUserKnownHosts no # Don't read the user's ~/.rhosts and ~/.shosts files #IgnoreRhosts yes # To disable tunneled clear text passwords, change to no here! PasswordAuthentication yes #PermitEmptyPasswords no #PasswordAuthentication no # Change to no to disable s/key passwords #ChallengeResponseAuthentication yes ChallengeResponseAuthentication no # Kerberos options #KerberosAuthentication no #KerberosOrLocalPasswd yes #KerberosTicketCleanup yes #KerberosGetAFSToken no #KerberosUseKuserok yes # GSSAPI options GSSAPIAuthentication yes GSSAPICleanupCredentials no #GSSAPIStrictAcceptorCheck yes #GSSAPIKeyExchange no #GSSAPIEnablek5users no # Set this to 'yes' to enable PAM authentication, account processing, # and session processing. If this is enabled, PAM authentication will # be allowed through the ChallengeResponseAuthentication and # PasswordAuthentication. Depending on your PAM configuration, # PAM authentication via ChallengeResponseAuthentication may bypass # the setting of "PermitRootLogin without-password". # If you just want the PAM account and session checks to run without # PAM authentication, then enable this but set PasswordAuthentication # and ChallengeResponseAuthentication to 'no'. # WARNING: 'UsePAM no' is not supported in Red Hat Enterprise Linux and may cause several # problems. UsePAM yes #AllowAgentForwarding yes #AllowTcpForwarding yes #GatewayPorts no X11Forwarding yes #X11DisplayOffset 10 #X11UseLocalhost yes #PermitTTY yes #PrintMotd yes #PrintLastLog yes #TCPKeepAlive yes #UseLogin no UsePrivilegeSeparation sandbox # Default for new installations. #PermitUserEnvironment no #Compression delayed ClientAliveInterval 0 #ClientAliveCountMax 3 #ShowPatchLevel no #UseDNS yes #PidFile /var/run/sshd.pid #MaxStartups 10:30:100 #PermitTunnel no #ChrootDirectory none #VersionAddendum none # no default banner path #Banner none # Accept locale-related environment variables AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE AcceptEnv XMODIFIERS # override default of no subsystems Subsystem sftp /usr/libexec/openssh/sftp-server # Example of overriding settings on a per-user basis #Match User anoncvs # X11Forwarding no # AllowTcpForwarding no # PermitTTY no # ForceCommand cvs server [ec2-user@ip-172-31-17-111 ~]$
参考
http://www.esojourn.org/blog/post/setup-l2tp-vpn-server-with-ipsec-in-centos6.php?page=2&part=1
使用xl2tp和ipsec,ppp让iphone和mac上网
注意的地方
1.尽量用新版本
2.配置的vpn用户名密码要是系统能登录的
3.http://pkgs.org/centos-7/nux-dextop-x86_64/xl2tpd-1.3.6-2.el7.nux.x86_64.rpm.html
下载对应的系统对应的rpm包 xl2tpd
rpm -ivh xl2tpd-1.3.6-8.el7.x86_64.rpm
4.yum install ppp openswan
openswan就是ipsec
5.我linode的ip是106.187.44.20,要替换下面的ip到你的ip
#!/bin/sh for each in /proc/sys/net/ipv4/conf/* do echo 0 > $each/accept_redirects echo 0 > $each/send_redirects done
[root@localhost ~]# cat /etc/ipsec.conf # /etc/ipsec.conf - Libreswan IPsec configuration file # This file: /etc/ipsec.conf # # Enable when using this configuration file with openswan instead of libreswan #version 2 # # Manual: ipsec.conf.5 # basic configuration config setup # which IPsec stack to use, "netkey" (the default), "klips" or "mast". # For MacOSX use "bsd" oe=off protostack=netkey # # The interfaces= line is only required for the klips/mast stack #interfaces="%defaultroute" #interfaces="ipsec0=eth0 ipsec1=ppp0" # # If you want to limit listening on a single IP - not required for # normal operation #listen=127.0.0.1 # # Do not set debug options to debug configuration issues! # # plutodebug / klipsdebug = "all", "none" or a combation from below: # "raw crypt parsing emitting control kernel pfkey natt x509 dpd # private". # Note: "crypt" is not included with "all", as it can show confidential # information. It must be specifically specified # examples: # plutodebug="control parsing" # plutodebug="all crypt" # Again: only enable plutodebug or klipsdebug when asked by a developer #plutodebug=none #klipsdebug=none # # Normally, pluto logs via syslog. If you want to log to a file, # specify below or to disable logging, eg for embedded systems, use # the file name /dev/null # Note: SElinux policies might prevent pluto writing to a log file at # an unusual location. #plutostderrlog=/var/log/pluto.log # # Enable core dumps (might require system changes, like ulimit -C) # This is required for abrtd to work properly # Note: SElinux policies might prevent pluto writing the core at # unusual locations dumpdir=/var/run/pluto/ # # NAT-TRAVERSAL support # exclude networks used on server side by adding %v4:!a.b.c.0/24 # It seems that T-Mobile in the US and Rogers/Fido in Canada are # using 25/8 as "private" address space on their wireless networks. # This range has not been announced via BGP (at least upto 2010-12-21) nat_traversal=yes virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:25.0.0.0/8,%v4:100.64.0.0/10,%v6:fd00::/8,%v6:fe80::/10 # Add connections here # For example connections, see your distribution's documentation directory, # or the documentation which could be located at # /usr/share/docs/libreswan-3.*/ or look at https://www.libreswan.org/ # # There is also a lot of information in the manual page, "man ipsec.conf" # You may put your configuration (.conf) file in the "/etc/ipsec.d/" directory # by uncommenting this line #include /etc/ipsec.d/*.conf conn L2TP-PSK-NAT rightsubnet=vhost:%priv also=L2TP-PSK-noNAT conn L2TP-PSK-noNAT authby=secret pfs=no auto=add keyingtries=3 rekey=no ikelifetime=8h keylife=1h type=transport left=172.31.17.111 # leftid=52.74.143.66 # leftprotoport=17/1701 leftprotoport=17/%any right=%any right=%any
17/%any 和ifconfig得到的内网ip,这里注意一下
[root@localhost ~]# cat /etc/ipsec.secrets include /etc/ipsec.d/*.secrets 106.187.44.20 %any: PSK "haha"
[root@localhost ~]# cat /etc/sysctl.conf # System default settings live in /usr/lib/sysctl.d/00-system.conf. # To override those settings, enter new settings here, or in an /etc/sysctl.d/<name>.conf file # # For more information, see sysctl.conf(5) and sysctl.d(5). net.ipv4.ip_forward = 1 net.ipv4.conf.default.rp_filter = 0 net.ipv4.conf.eth0.rp_filter = 0 net.ipv4.conf.all.send_redirects = 0 net.ipv4.conf.default.send_redirects = 0 net.ipv4.conf.all.log_martians = 0 net.ipv4.conf.default.log_martians = 0 net.ipv4.conf.default.accept_source_route = 0 net.ipv4.conf.all.accept_redirects = 0 net.ipv4.conf.default.accept_redirects = 0 net.ipv4.icmp_ignore_bogus_error_responses = 1
验证
sysctl -p
service ipsec start
ipsec verify
可用的时候是这样的
[root@localhost ~]# ipsec verify Verifying installed system and configuration files Version check and ipsec on-path [OK] Libreswan 3.8 (netkey) on 3.15.4-x86_64-linode45 Checking for IPsec support in kernel [OK] NETKEY: Testing XFRM related proc values ICMP default/send_redirects [OK] ICMP default/accept_redirects [OK] XFRM larval drop [OK] Pluto ipsec.conf syntax [OK] Hardware random device [N/A] Two or more interfaces found, checking IP forwarding [OK] Checking rp_filter [OK] Checking that pluto is running [OK] Pluto listening for IKE on udp 500 [OK] Pluto listening for IKE/NAT-T on udp 4500 [OK] Pluto ipsec.secret syntax [OK] Checking NAT and MASQUERADEing [TEST INCOMPLETE] Checking 'ip' command [OK] Checking 'iptables' command [OK] Checking 'prelink' command does not interfere with FIPSChecking for obsolete ipsec.conf options [OK] Opportunistic Encryption [DISABLED] [root@localhost ~]#
[color=red]listen-addr 注意这里的ip如果外网不通就用内网的[/color] [root@localhost ~]# cat /etc/xl2tpd/xl2tpd.conf ; ; This is a minimal sample xl2tpd configuration file for use ; with L2TP over IPsec. ; ; The idea is to provide an L2TP daemon to which remote Windows L2TP/IPsec ; clients connect. In this example, the internal (protected) network ; is 192.168.1.0/24. A special IP range within this network is reserved ; for the remote clients: 192.168.1.128/25 ; (i.e. 192.168.1.128 ... 192.168.1.254) ; ; The listen-addr parameter can be used if you want to bind the L2TP daemon ; to a specific IP address instead of to all interfaces. For instance, ; you could bind it to the interface of the internal LAN (e.g. 192.168.1.98 ; in the example below). Yet another IP address (local ip, e.g. 192.168.1.99) ; will be used by xl2tpd as its address on pppX interfaces. [global] ;listen-addr = 106.187.44.20 ;ipsec saref = no ; ; requires openswan-2.5.18 or higher - Also does not yet work in combination ; with kernel mode l2tp as present in linux 2.6.23+ ; ipsec saref = yes ; Use refinfo of 22 if using an SAref kernel patch based on openswan 2.6.35 or ; when using any of the SAref kernel patches for kernels up to 2.6.35. ; saref refinfo = 30 ; ; force userspace = yes ; ; debug tunnel = yes [lns default] ip range = 192.168.1.128-192.168.1.254 local ip = 192.168.1.99 require chap = yes refuse pap = yes require authentication = yes name = LinuxVPNserver ppp debug = yes pppoptfile = /etc/ppp/options.xl2tpd length bit = yes
[root@localhost ~]# cat /etc/ppp/options.xl2tpd require-mschap-v2 ipcp-accept-local ipcp-accept-remote #ms-dns 106.187.36.20 ms-dns 8.8.4.4 ms-dns 8.8.8.8 # ms-dns 192.168.1.1 # ms-dns 192.168.1.3 # ms-wins 192.168.1.2 # ms-wins 192.168.1.4 noccp auth crtscts idle 1800 mtu 1410 mru 1410 nodefaultroute debug lock proxyarp connect-delay 5000 # To allow authentication against a Windows domain EXAMPLE, and require the # user to be in a group "VPN Users". Requires the samba-winbind package # require-mschap-v2 # plugin winbind.so # ntlm_auth-helper '/usr/bin/ntlm_auth --helper-protocol=ntlm-server-1 --require-membership-of="EXAMPLE\\VPN Users"' # You need to join the domain on the server, for example using samba: # http://rootmanager.com/ubuntu-ipsec-l2tp-windows-domain-auth/setting-up-openswan-xl2tpd-with-native-windows-clients-lucid.html
[root@localhost ~]# cat /etc/ppp/chap-secrets # Secrets for authentication using CHAP # client server secret IP addresses root * 我的密码 *
yum install iptables-services
systemctl enable iptables
[root@localhost ~]# cat /etc/sysconfig/iptables *nat :PREROUTING ACCEPT [39:3503] :POSTROUTING ACCEPT [0:0] :OUTPUT ACCEPT [0:0] -A POSTROUTING -s 192.168.1.0/24 -o eth0 -j MASQUERADE COMMIT *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [121:13264] -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT -A INPUT -p icmp -j ACCEPT -A INPUT -i lo -j ACCEPT -A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT -A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT -A INPUT -p tcp -m state --state NEW -m tcp --dport 53 -j ACCEPT -A INPUT -p udp -m state --state NEW -m udp --dport 53 -j ACCEPT -A INPUT -p tcp -m state --state NEW -m tcp --dport 1194 -j ACCEPT -A INPUT -p udp -m state --state NEW -m udp --dport 1701 -j ACCEPT -A INPUT -p udp -m state --state NEW -m udp --dport 500 -j ACCEPT -A INPUT -p udp -m state --state NEW -m udp --dport 4500 -j ACCEPT -A INPUT -j REJECT --reject-with icmp-host-prohibited -A FORWARD -d 192.168.1.0/24 -j ACCEPT -A FORWARD -s 192.168.1.0/24 -j ACCEPT -A FORWARD -j REJECT --reject-with icmp-host-prohibited COMMIT
COMMIT 注意要有换行
xl2tpd -D &
service iptables restart
ipsec restart
----------------ubuntu14.04 aws
设置root的ssh
ssh出现permission denied (publickey)问题: 修改/etc/ssh/sshd-config文件. 将其中的PermitRootLogin no修改为yes PubkeyAuthentication yes修改为no AuthorizedKeysFile .ssh/authorized_keys前面加上#屏蔽掉, PasswordAuthentication no修改为yes就可以了。 重启sshd即可:service sshd restart
------------------------------------------------------------
------------------------------------------------------------
ubuntu14.04参考
https://raymii.org/s/tutorials/IPSEC_L2TP_vpn_with_Ubuntu_14.04.html
apt-get install iptables-persistent
apt-get install ppp openswan xl2tpd
也没好使
http://crazyof.me/blog/archives/610.html
http://www.enjoydiy.com/213.html
http://ubuntuforums.org/showthread.php?t=2211939
"I also make it my habit to make leftprotoport 17/%any instead of 17/1701"
vim /etc/ipsec.conf
config setup nat_traversal=yes virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12 oe=off protostack=netkey conn L2TP-PSK-NAT rightsubnet=vhost:%priv also=L2TP-PSK-noNAT conn L2TP-PSK-noNAT authby=secret pfs=no auto=add keyingtries=3 rekey=no ikelifetime=8h keylife=1h type=transport left=172.31.30.234 leftprotoport=17/%any right=%any rightprotoport=17/%any
注意,left为内网ifconfig的ip,leftprotoport=17/%any 一定要这么写,写成1701会报错
cat /etc/rc.local
iptables --table nat --append POSTROUTING --jump MASQUERADE echo 1 > /proc/sys/net/ipv4/ip_forward for each in /proc/sys/net/ipv4/conf/* do echo 0 > $each/accept_redirects echo 0 > $each/send_redirects done exit 0
cat /etc/iptables/rules.v4
# Generated by iptables-save v1.4.21 on Mon Nov 24 04:44:08 2014 #*filter #:INPUT ACCEPT [0:0] #:FORWARD ACCEPT [0:0] #:OUTPUT ACCEPT [0:0] #COMMIT # Completed on Mon Nov 24 04:44:08 2014 # sample configuration for iptables service # you can edit this manually or use system-config-firewall # please do not ask us to add additional ports/services to this default configuration *nat :PREROUTING ACCEPT [39:3503] :POSTROUTING ACCEPT [0:0] :OUTPUT ACCEPT [0:0] -A POSTROUTING -s 192.168.3.0/24 -o eth0 -j MASQUERADE COMMIT *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] #:OUTPUT ACCEPT [0:0] :OUTPUT ACCEPT [121:13264] -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT -A INPUT -p icmp -j ACCEPT -A INPUT -i lo -j ACCEPT -A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT -A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT -A INPUT -p tcp -m state --state NEW -m tcp --dport 53 -j ACCEPT -A INPUT -p udp -m state --state NEW -m udp --dport 53 -j ACCEPT -A INPUT -p tcp -m state --state NEW -m tcp --dport 1194 -j ACCEPT -A INPUT -p udp -m state --state NEW -m udp --dport 1701 -j ACCEPT -A INPUT -p udp -m state --state NEW -m udp --dport 500 -j ACCEPT -A INPUT -p tcp -m state --state NEW -m tcp --dport 500 -j ACCEPT -A INPUT -p udp -m state --state NEW -m udp --dport 4500 -j ACCEPT -A INPUT -j REJECT --reject-with icmp-host-prohibited -A FORWARD -d 192.168.3.0/24 -j ACCEPT -A FORWARD -s 192.168.3.0/24 -j ACCEPT -A FORWARD -j REJECT --reject-with icmp-host-prohibited COMMIT
cat /etc/xl2tpd/xl2tpd.conf
[global] ipsec saref = no [lns default] ip range = 192.168.3.128-192.168.3.254 local ip = 192.168.3.1 require chap = yes refuse pap = yes require authentication = yes ppp debug = yes pppoptfile = /etc/ppp/options.xl2tpd length bit = yes
网段和iptables配置的网段要一样,不能是已经存在的网段
cat /etc/ppp/chap-secrets
# Secrets for authentication using CHAP # client server secret IP addresses hey * heyman *
useradd hey
passwd hey
heyman
cat /etc/ipsec.secrets
root@ip-172-31-30-234:/home/ubuntu# cat /etc/ipsec.secrets # This file holds shared secrets or RSA private keys for inter-Pluto # authentication. See ipsec_pluto(8) manpage, and HTML documentation. # RSA private key for this host, authenticating it to any other host # which knows the public part. Suitable public keys, for ipsec.conf, DNS, # or configuration of other implementations, can be extracted conveniently # with "ipsec showhostkey". # this file is managed with debconf and will contain the automatically created RSA keys #include /var/lib/openswan/ipsec.secrets.inc 172.31.30.234 %any: PSK "haha"
root@ip-172-31-30-234:/data/meatspace-chat# cat /etc/ppp/options.xl2tpd require-mschap-v2 ms-dns 8.8.8.8 asyncmap 0 auth crtscts lock hide-password modem debug name l2tpd proxyarp lcp-echo-interval 30 lcp-echo-failure 4
ip为ifconfig的内网ip
设置
/etc/sysctl.conf 上面
sysctl -p
/etc/init.d/iptables-persistent restart
service ipsec restart
servcie xl2tpd restart
tailf /var/log/secure 看访问的log
r如果有尝试密码的使用
/etc/hosts.deny
all:218.87.111.110
禁止
iphone访问的话
上一篇: HIVE json格式数据的处理
下一篇: 串的模式匹配算法