linux下搭建Ipsec+L2TP VPN服务（线上）

Posted 2022-05-12 chenzm0592

安装软件及依赖包

yum -y install epel-release
yum -y install ipsec-tools
yum -y install gmp gmp-devel gawk flex bison
yum -y install openswan ppp xl2tpd

内核调优：cat /etc/sysctl.conf

net.ipv4.ip_forward = 1
net.ipv4.conf.default.rp_filter = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0
net.ipv4.conf.all.log_martians = 0
net.ipv4.conf.default.log_martians = 0
net.ipv4.conf.default.accept_source_route = 0
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv4.icmp_ignore_bogus_error_responses = 1
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0

net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_fin_timeout = 30
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_tw_recycle = 1
net.ipv4.ip_local_port_range = 1000 65000
net.ipv4.tcp_max_syn_backlog = 8192
net.ipv4.tcp_max_tw_buckets = 5000

kernel.shmmax = 67108864
fs.file-max = 65535

修改ipsec的配置文件：

cd /etc/ipsec.d/
ls ./*.conf|xargs -I  mv  .bak
vim L2TP.conf
cat /etc/ipsec.d/L2TP.conf 
conn L2TP-PSK-NAT
    rightsubnet=vhost:%priv
    also=L2TP-PSK-noNAT
  
conn L2TP-PSK-noNAT
    authby=secret
    pfs=no
    auto=add
    keyingtries=3
    rekey=no
    ikelifetime=8h
    keylife=1h
    type=transport
    left=165.227.2.134
    leftprotoport=17/1701
    right=%any
rightprotoport=17/%any

4.配置IPSEC的密钥：

165.227.2.134 %any: PSK "123456"

验证IPSEC的运行状态：只要没有faild即可

6. 编辑/etc/xl2tpd/xl2tpd.conf

7.编辑/etc/ppp/options.xl2tpd

设置VPN账户密码：

启动服务：

防火墙测量设置：

主要是以下几条要添加即可.

iptables -A FORWARD -s 10.0.0.0/8 -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j TCPMSS --set-mss 1356
iptables -t nat -A POSTROUTING -s 10.0.0.0/8 -j SNAT --to-source 165.227.2.134
iptables -I INPUT -p udp -m udp -m state --state NEW --dport 1701 -j ACCEPT
iptables -I INPUT -p udp -m udp -m state --state NEW --dport 500 -j ACCEPT
iptables -I INPUT -p esp -j ACCEPT
/etc/init.d/iptables save

苹果手机测试：

电脑端测试：VPN.pbk