【vpn异地组网专题】linux安装L2TP服务器

小灰灰 2022-09-10 08:10 450阅读 0赞

**1.先看看你的主机是否支持pptp，返回结果为yes就表示通过**

modprobe ppp-compress-18 && echo yes

**2.是否开启了TUN**

cat /dev/net/tun

有的虚拟机主机需要开启，返回结果为cat: /dev/net/tun: File descriptor in bad state。就表示通过。

**3.更新一下再安装**

yum install update 
    yum update -y

**4.安装EPEL源**

yum install -y epel-release

**5.安装xl2tpd和libreswan**

yum install -y xl2tpd libreswan lsof

**6.编辑xl2tpd配置文件**

vim /etc/xl2tpd/xl2tpd.conf

修改内容如下：

> ;
> 
> ; This is a minimal sample xl2tpd configuration file for use
> 
> ; with L2TP over IPsec.
> 
> ;
> 
> ; The idea is to provide an L2TP daemon to which remote Windows L2TP/IPsec
> 
> ; clients connect. In this example, the internal (protected) network
> 
> ; is 192.168.1.0/24.  A special IP range within this network is reserved
> 
> ; for the remote clients: 192.168.1.128/25
> 
> ; (i.e. 192.168.1.128 ... 192.168.1.254)
> 
> ;
> 
> ; The listen-addr parameter can be used if you want to bind the L2TP daemon
> 
> ; to a specific IP address instead of to all interfaces. For instance,
> 
> ; you could bind it to the interface of the internal LAN (e.g. 192.168.1.98
> 
> ; in the example below). Yet another IP address (local ip, e.g. 192.168.1.99)
> 
> ; will be used by xl2tpd as its address on pppX interfaces.
> 
> \[global\]
> 
> listen-addr = 0.0.0.0
> 
> ;
> 
> ; requires openswan-2.5.18 or higher - Also does not yet work in combination
> 
> ; with kernel mode l2tp as present in linux 2.6.23+
> 
> ipsec saref = yes
> 
> ; Use refinfo of 22 if using an SAref kernel patch based on openswan 2.6.35 or
> 
> ;  when using any of the SAref kernel patches for kernels up to 2.6.35.
> 
> ; saref refinfo = 30
> 
> ;
> 
> ; force userspace = yes
> 
> ;
> 
> ; debug tunnel = yes
> 
> \[lns default\]
> 
> ip range = 172.20.0.20-172.20.0.254
> 
> local ip = 172.20.0.1
> 
> require chap = yes
> 
> refuse pap = yes
> 
> require authentication = yes
> 
> name = LinuxVPNserver
> 
> ppp debug = yes
> 
> pppoptfile = /etc/ppp/options.xl2tpd
> 
> length bit = yes

**7.编辑pppoptfile文件**

vim /etc/ppp/options.xl2tpd

修改内容如下：

> ipcp-accept-local
> 
> ipcp-accept-remote
> 
> ms-dns  223.5.5.5
> 
> ms-dns  223.6.6.6
> 
> \# ms-dns  192.168.1.1
> 
> \# ms-dns  192.168.1.3
> 
> \# ms-wins 192.168.1.2
> 
> \# ms-wins 192.168.1.4
> 
> noccp
> 
> auth
> 
> crtscts
> 
> idle 1800
> 
> mtu 1410
> 
> mru 1410
> 
> nodefaultroute
> 
> debug
> 
> lock
> 
> proxyarp
> 
> connect-delay 5000
> 
> \# To allow authentication against a Windows domain EXAMPLE, and require the
> 
> \# user to be in a group "VPN Users". Requires the samba-winbind package
> 
> \# require-mschap-v2
> 
> \# plugin winbind.so
> 
> \# ntlm\_auth-helper '/usr/bin/ntlm\_auth --helper-protocol=ntlm-server-1 --require-membership-of="EXAMPLE\\\\VPN Users"'
> 
> \# You need to join the domain on the server, for example using samba:
> 
> \# http://rootmanager.com/ubuntu-ipsec-l2tp-windows-domain-auth/setting-up-openswan-xl2tpd-with-native-windows-clients-lucid.html

**8.编辑ipsec配置文件**

vim /etc/ipsec.conf

> \# /etc/ipsec.conf - Libreswan IPsec configuration file
> 
> \#
> 
> \# see 'man ipsec.conf' and 'man pluto' for more information
> 
> \#
> 
> \# For example configurations and documentation, see https://libreswan.org/wiki/
> 
> config setup
> 
>         \# Normally, pluto logs via syslog.
> 
>         \#logfile=/var/log/pluto.log
> 
>         \#
> 
>         \# Do not enable debug options to debug configuration issues!
> 
>         \#
> 
>         \# plutodebug="control parsing"
> 
>         \# plutodebug="all crypt"
> 
>         plutodebug=none
> 
>         \#
> 
>         \# NAT-TRAVERSAL support
> 
>         \# exclude networks used on server side by adding %v4:!a.b.c.0/24
> 
>         \# It seems that T-Mobile in the US and Rogers/Fido in Canada are
> 
>         \# using 25/8 as "private" address space on their wireless networks.
> 
>         \# This range has never been announced via BGP (at least up to 2015)
> 
>         nat\_traversal=yes
> 
>         virtual\_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:25.0.0.0/8,%v4:100.64.0.0/10,%v6:fd00::/8,%v6:fe80::/10
> 
> \# if it exists, include system wide crypto-policy defaults
> 
> \# include /etc/crypto-policies/back-ends/libreswan.config
> 
> \# It is best to add your IPsec connections as separate files in /etc/ipsec.d/
> 
> include /etc/ipsec.d/\*.conf

**9.编辑include的conn文件**

vim /etc/ipsec.d/l2tp_psk.conf

修改内容如下：

> conn L2TP-PSK-NAT
> 
>     rightsubnet=vhost:%priv
> 
>     also=L2TP-PSK-noNAT
> 
> conn L2TP-PSK-noNAT
> 
>     authby=secret
> 
>     pfs=no
> 
>     auto=add
> 
>     keyingtries=3
> 
>     dpddelay=30
> 
>     dpdtimeout=120
> 
>     dpdaction=clear
> 
>     rekey=no
> 
>     ikelifetime=8h
> 
>     keylife=1h
> 
>     type=transport
> 
>     left=172.31.160.144
> 
>     leftprotoport=17/1701
> 
>     right=%any
> 
>     rightprotoport=17/%any

注意：上面内容中的172.31.160.144改为服务器的公网ip

**10.设置用户名密码**

vim /etc/ppp/chap-secrets

修改内容：

>     vpnuser * pass * 
>     说明：用户名[空格]service[空格]密码[空格]指定IP

**11.设置PSK，即为客户端链接时需填入的预共享密钥**

vim /etc/ipsec.d/ipsec.secrets

>     : PSK "qbly.top"

**12.CentOS7防火墙设置**

firewall-cmd --permanent --add-service=ipsec
    firewall-cmd --permanent --add-port=1701/udp
    firewall-cmd --permanent --add-port=4500/udp
    firewall-cmd --permanent --add-masquerade
    firewall-cmd --reload

**13.IP\_FORWARD 设置**

vim /etc/sysctl.conf

> vm.swappiness = 0
> 
> net.ipv4.ip\_forward = 1
> 
> net.ipv4.neigh.default.gc\_stale\_time=120
> 
> net.ipv4.conf.all.rp\_filter=0
> 
> net.ipv4.conf.default.rp\_filter=0
> 
> net.ipv4.conf.default.arp\_announce = 2
> 
> net.ipv4.conf.all.arp\_announce=2
> 
> net.ipv4.tcp\_max\_tw\_buckets = 5000
> 
> net.ipv4.tcp\_syncookies = 1
> 
> net.ipv4.tcp\_max\_syn\_backlog = 1024
> 
> net.ipv4.tcp\_synack\_retries = 2
> 
> net.ipv4.conf.lo.arp\_announce=2
> 
> net.ipv4.conf.default.accept\_redirects = 0
> 
> net.ipv4.conf.default.send\_redirects = 0
> 
> net.ipv4.conf.default.accept\_source\_route = 0

重启生效

**14.ipsec启动&检查**

systemctl enable ipsec
    systemctl restart ipsec

检查：ipsec verify

正常输出：

Verifying installed system and configuration files
    
    Version check and ipsec on-path                         [OK]
    Libreswan 3.15 (netkey) on 3.10.0-123.13.2.el7.x86_64
    Checking for IPsec support in kernel                    [OK]
     NETKEY: Testing XFRM related proc values
             ICMP default/send_redirects                    [OK]
             ICMP default/accept_redirects                  [OK]
             XFRM larval drop                               [OK]
    Pluto ipsec.conf syntax                                 [OK]
    Hardware random device                                  [N/A]
    Two or more interfaces found, checking IP forwarding    [OK]
    Checking rp_filter                                      [OK]
    Checking that pluto is running                          [OK]
     Pluto listening for IKE on udp 500                     [OK]
     Pluto listening for IKE/NAT-T on udp 4500              [OK]
     Pluto ipsec.secret syntax                              [OK]
    Checking 'ip' command                                   [OK]
    Checking 'iptables' command                             [OK]
    Checking 'prelink' command does not interfere with FIPSChecking for obsolete ipsec.conf options             [OK]
    Opportunistic Encryption                                [DISABLED]

**15.xl2tpd启动**

systemctl enable xl2tpd
    systemctl restart xl2tpd