CentOS6.5 利用openswan xl2tpd配置***服務
OpenSWan是Linux下IPsec的最佳實現方式，其功能強大，最大程度地保證了數據傳輸中的安全性、完整性問題
OpenSWan支持2.0、2.2、2.4以及2.6內核，可以運行在不同的系統平臺下，包括X86、X86_64、IA64、MIPS以及ARM
OpenSWan是開源項目FreeS/WAN停止開發後的後繼分支項目，由三個主要組件構成：
配置工具（ipsec命令腳本）
Key管理工具（pluto）
內核組件（KLIPS/26sec）
26sec使用2.6內核內建模塊Netkey，用來替代OpenSWan開發的KLIPS模塊，2.4及以下版本內核無Netkey模塊支持，只能使用KLIPS。如果你用的是2.6.9以上的內核，推薦使用26sec，可以不用給內核打Nat-T補丁就可以使用NAT，2.6.9以下版本內核的NETKEY存在Bug，推薦使用KLIPS
OpenSWan有兩種連接方式：
1) Network-To-Network方式
Network-To-Network方式是把兩個網絡連接成一個虛擬專用網絡。當連接建立後，每個子網的主機都可透明地訪問遠程子網的主機。要實現此種連接方式，要滿足以下兩個條件：
I. 每個子網各自擁有一臺安裝有OpenSWan的主機作爲其子網的出口網關;
II.每個子網的IP段不能有疊加
2) Road Warrior方式
當使用Network-To-Network方式時，作爲每個子網網關的主機不能像子網內部主機那樣透明訪問遠程子網的主機，也就是說：
如果你是一個使用LClient的移動用戶，經常出差或是在不同的地點辦公，你的LClient將不能用Network-To-Network方式與公司網絡進行連接。
Road Warrior方式正是爲這種情況而設計的，連接建立後，你的LClient就可以連接到遠程的網絡了
#openswan配置
client1 192.168.10.2(網關192.168.10.1)
server1 192.168.22.210(內網192.168.10.1)
server2 192.168.22.199(內網192.168.20.1)
client2 192.168.20.2(網關192.168.20.2)
client1 ←—→ server1←———→ server2 ←—→ client2
10.2 22.210(10.1) 22.199(20.1) 20.2
安裝openswan ipsec
在server：
vim /etc/sysctl.conf #開啓轉發
net.ipv4.ip_forward = 1
net.ipv4.conf.default.rp_filter = 0
sysctl -a | egrep "ipv4.*(accept|send)_redirects" | awk -F "=" '{print$1"= 0"}' >> /etc/sysctl.conf #禁用ICMP重定向
/sbin/sysctl -p
setenforce 0
yum install openswan lsof
# ipsec --version
Linux Openswan U2.6.32/K(no kernel code presently loaded)
See `ipsec --copyright' for copyright information.
# service ipsec start
ipsec_setup: Starting Openswan IPsec U2.6.32/K2.6.32-431.el6.x86_64...
# ipsec verify
Checking your system to see if IPsec got installed and started correctly:
Version check and ipsec on-path [OK]
Linux Openswan U2.6.32/K2.6.32-431.el6.x86_64 (netkey)
Checking for IPsec support in kernel [OK]
SAref kernel support [N/A]
NETKEY: Testing for disabled ICMP send_redirects [OK]
NETKEY detected, testing for disabled ICMP accept_redirects [OK]
Checking that pluto is running [OK]
Pluto listening for IKE on udp 500 [OK]
Pluto listening for NAT-T on udp 4500 [OK]
Two or more interfaces found, checking IP forwarding [OK]
Checking NAT and MASQUERADEing [OK]
Checking for 'ip' command [OK]
Checking /bin/sh is not /bin/dash [OK]
Checking for 'iptables' command [OK]
Opportunistic Encryption Support [DISABLED]配置ipsec
# vim /etc/ipsec.conf version 2.0 config setup protostack=netkey nat_traversal=yes virtual_private= oe=off nhelpers=0 conn net-to-net authby=secret type=tunnel ike=aes256-sha2_256;modp2048 phase2alg=aes256-sha2_256;modp2048 left=192.168.22.210 leftsubnet=192.168.10.1/24 right=192.168.22.199 rightsubnet=192.168.20.1/24 forceencaps=yes dpddelay=1 dpdtimeout=3 dpdaction=restart auto=start #sha2_truncbug=yes
# vim /etc/ipsec.d/ipsec.secrets
192.168.22.210 %any 0.0.0.0: PSK "test" #right的ip改一下
# service ipsec restart
# service ipsec status
# ipsec auto --up net-to-net #測試上面定義的net-to-net
117 "net-to-net" #8: STATE_QUICK_I1: initiate
004 "net-to-net" #8: STATE_QUICK_I2: sent QI2, IPsec SA established tunnel mode \
{ESP/NAT=>0xb7ba4252 <0x98e5c578 xfrm=AES_256-HMAC_SHA2_256 NATOA=none NATD=192.168.22.199:4500 DPD=enabled}#在client上面ping gateway的內網和另一個client的ip，是可以ping通的
#xl2tpd配置
Road Warrior模式
# yum install xl2tpd
會安裝 libpcap-1.4.0，ppp-2.4.5，xl2tpd-1.3.6 三個包
http://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm #yum安裝不上，先安裝這玩意
設置ipsec：
# grep -v ^\# /etc/ipsec.conf|sed '/^$/d' version 2.0 # conforms to second version of ipsec.conf specification config setup # Debug-logging controls: "none" for (almost) none, "all" for lots. # klipsdebug=none # plutodebug="control parsing" # For Red Hat Enterprise Linux and Fedora, leave protostack=netkey protostack=netkey nat_traversal=yes virtual_private=%v4:192.168.0.0/16,%v4:10.0.0.0/8,%v4:172.16.0.0/12,%v4:25.0.0.0/8,%v4:!10.254.253.0/24 protostack=netkey oe=off # Enable this if you see "failed to find any available worker" # nhelpers=0 nhelpers=0 conn net-to-net authby=secret type=tunnel ike=aes256-sha2_256;modp2048 phase2alg=aes256-sha2_256;modp2048 left=192.168.22.210 leftsubnet=192.168.10.1/24 right=192.168.22.199 rightsubnet=192.168.20.1/24 forceencaps=yes dpddelay=1 dpdtimeout=3 dpdaction=restart auto=start conn l2tp-psk authby=secret pfs=no auto=add rekey=no type=transport left=192.168.22.210 leftprotoport=17/1701 right=%any rightprotoport=17/%any rightsubnet=vhost:%priv,%no
配置xl2tpd
# grep -v ^\; /etc/xl2tpd/xl2tpd.conf|sed '/^$/d' [global] listen-addr = 192.168.22.210 auth file = /etc/ppp/chap-secrets [lns default] ip range = 192.168.10.128-192.168.10.254 local ip = 192.168.10.1 require chap = yes refuse pap = yes require authentication = yes name = Linux***server ppp debug = yes pppoptfile = /etc/ppp/options.xl2tpd length bit = yes
# grep -v ^\# /etc/ppp/options.xl2tpd|sed '/^$/d' ipcp-accept-local ipcp-accept-remote ms-dns 114.114.114.114 noccp auth crtscts idle 1800 mtu 1410 mru 1410 nodefaultroute debug lock proxyarp connect-delay 5000 logfile /var/log/xl2tpd.log
# cat /etc/ppp/chap-secrets # Secrets for authentication using CHAP # client server secret IP addresses *** * *** 192.168.10.22 #用戶名爲***，密碼爲***，分配的ip地址爲192.168.10.22
#在xp系統驗證
網上鄰居--創建一個新的連接--***--輸入gateway的ip--創建完畢後，右鍵--屬性--安全，把"要求數據加密(沒有就斷開)"去掉，要不會出現錯誤 741
點擊“IPSec設置”--“使用與共享的密鑰作身份驗證”輸入上面的密鑰“test”，就可以連接
# tail /var/log/xl2tpd.log #查看日誌 rcvd [IPCP ConfReq id=0x6 <addr 0.0.0.0> <ms-dns1 0.0.0.0> <ms-dns2 0.0.0.0>] sent [IPCP ConfNak id=0x6 <addr 192.168.10.22> <ms-dns1 114.114.114.114> <ms-dns2 114.114.114.114>] rcvd [IPCP ConfAck id=0x2 <addr 192.168.10.1>] rcvd [IPCP ConfReq id=0x7 <addr 192.168.10.22> <ms-dns1 114.114.114.114> <ms-dns2 114.114.114.114>] sent [IPCP ConfAck id=0x7 <addr 192.168.10.22> <ms-dns1 114.114.114.114> <ms-dns2 114.114.114.114>] found interface eth0 for proxy arp local IP address 192.168.10.1 remote IP address 192.168.10.22 Script /etc/ppp/ip-up started (pid 7472) Script /etc/ppp/ip-up finished (pid 7472), status = 0x0
防火牆：
iptables -A INPUT -p udp --dport 500 -j ACCEPT
iptables -A INPUT -p tcp --dport 4500 -j ACCEPT
iptables -A INPUT -p udp --dport 4500 -j ACCEPT
iptables -t nat -A POSTROUTING -s site-A-private-subnet -d site-B-private-subnet -j SNAT --to site-A-Public-IP
參考網站：
http://www.freeswan.org/
https://github.com/xelerance/Openswan/wiki/L2tp-ipsec-configuration-using-openswan-and-xl2tpd
http://segmentfault.com/blog/tyheist/1190000000646294
http://www.360doc.com/content/09/1105/16/25127_8448328.shtml