Liunx之xl2TP的一键搭建

作者:邓聪聪

1

L2TP（Layer 2 Tunnel Protocol二层隧道协议l），上图说明了VPN的一些特点，出差员工或者外出员工通过拨特定号码的方式接入到企业内部网络;

-------------------------------------------------

 1、搭建环境

　　Centos6.8

　　所需软件：openswan、xl2tpd、rp-l2tp 链接：https://pan.baidu.com/s/1C9plODlCXlVO3x51_OFcNQ 密码：1ry8

　　yum安装所需的程序

yum install -y ppp iptables make gcc gmp-devel xmlto bison flex libpcap-devel lsof vim-enhanced man

2、安装openswan

cd openswan-2.6./
make programs install

3、安装xl2tpd和rp-l2tp

cd rp-l2tp-0.4
./configure
make
cp handlers/l2tp-control /usr/local/sbin/
mkdir /var/run/xl2tpd/
ln -s /usr/local/sbin/l2tp-control /var/run/xl2tpd/l2tp-control
------------------------------------------------------------------
cd xl2tpd-1.3.8
make && make install

4、配置

（1）编辑配置文件/etc/ipsec.conf

config setup
    nat_traversal=yes
    virtual_private=%v4:10.0.0.0/,%v4:192.168.0.0/,%v4:172.16.0.0/
    oe=off
    protostack=netkey

conn L2TP-PSK-NAT
    rightsubnet=vhost:%priv
    also=L2TP-PSK-noNAT

conn L2TP-PSK-noNAT
    authby=secret
    pfs=no
    auto=add
    keyingtries=
    rekey=no
    ikelifetime=8h
    keylife=1h
    type=transport
    left=接口上的公网IP地址
    leftid=接口上的公网地址
    leftprotoport=/
    right=%any
    rightid=%any
    rightprotoport=/%any

（2）设置共享密钥PSK 编辑配置文件/etc/ipsec.secrets

ServerIP %any: PSK "YourPSK"

（3）修改内核设置，使其支持转发，编辑/etc/sysctl.conf文件并生效

sed -i 's/net.ipv4.ip_forward = 0/net.ipv4.ip_forward = 1/g' /etc/sysctl.conf
sed -i 's/net.ipv4.conf.default.rp_filter = 1/net.ipv4.conf.default.rp_filter = 0/g' /etc/sysctl.conf

sysctl -p

　　编辑个一个脚本修改参数，防火墙配置nat转发

#!/bin/sh

for each in /proc/sys/net/ipv4/conf/*
do
echo 0 > $each/accept_redirects
echo 0 > $each/send_redirects
echo 0 > $each/rp_filter
echo 0 > $each/rp_filter
echo 0 > $each/rp_filter
done

iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -t nat -A POSTROUTING --jump MASQUERADE

（4）验证ipsec运行状态；查看系统IPSec安装和启动的正确性

ipsec setup start
ipsec verify

　　如果没有报错那么就没有问题，如果有报错逐一检查！！！

（5） 编辑配置文件/etc/xl2tpd/xl2tpd.conf

[global]
ipsec saref = yes
[lns default]
ip range = （vpn拨号所需的自定义内网地址）
local ip = （vpn本地的内网地址）
refuse chap = yes
refuse pap = yes
require authentication = yes
ppp debug = yes
pppoptfile = /etc/ppp/options.xl2tpd
length bit = yes

配置ppp 建立/etc/ppp/options.xl2tpd文件

require-mschap-v2
ms-dns 219.141.140.10
ms-dns 114.114.
asyncmap
auth
crtscts
lock
hide-password
modem
debug
name l2tpd
proxyarp
lcp-echo-interval
lcp-echo-failure 

（6）配置用户名,密码:编辑 /etc/ppp/chap-secrets

#default user & password set
#username    server    password    client-ipaddress
vpn    l2tpd    vpnpwd    *

（7）添加自启动

chkconfig ipsec on

chkconfig xl2tpd on

（8）检查ipsec配置的正确性，启动服务并验证服务是否正常启动

[root@heju ~]# ipsec verify
Checking if IPsec got installed and started correctly:

Version check and ipsec on-path                         [OK]
Openswan U2.6.50/K2.6.32-.el6.x86_64 (netkey)
See `ipsec --copyright' for copyright information.
Checking for IPsec support in kernel                    [OK]
 NETKEY: Testing XFRM related proc values
         ICMP default/send_redirects                    [OK]
         ICMP default/accept_redirects                  [OK]
         XFRM larval drop                               [OK]
Hardware random device check                            [N/A]
Two or more interfaces found, checking IP forwarding    [OK]
Checking rp_filter                                      [OK]
Checking that pluto is running                          [OK]
 Pluto listening for IKE on udp                      [OK]
 Pluto listening for IKE on tcp                      [NOT IMPLEMENTED]
 Pluto listening for IKE/NAT-T on udp               [OK]
 Pluto listening for IKE/NAT-T on tcp               [NOT IMPLEMENTED]
 Pluto listening for IKE on tcp  (cisco)           [NOT IMPLEMENTED]
Checking NAT and MASQUERADEing                          [TEST INCOMPLETE]
Checking 'ip' command                                   [OK]
Checking 'iptables' command                             [OK]
------表示无异常

[root@heju ~]# netstat -lntup
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address               Foreign Address             State       PID/Program name
tcp               0.0.0.0:                  0.0.0.0:*                   LISTEN      /sshd
tcp               127.0.0.1:                0.0.0.0:*                   LISTEN      /master
tcp               :::                       :::*                        LISTEN      /sshd
tcp               :::                      :::*                        LISTEN      /master
udp               127.0.0.1:               0.0.0.0:*                               /pluto
udp               192.168.168.250:         0.0.0.0:*                               /pluto
udp               X.X.X.X:                 0.0.0.0:*                               /pluto
udp               127.0.0.1:              0.0.0.0:*                               /pluto
udp               192.168.168.250:        0.0.0.0:*                               /pluto
udp               X.X.X.X:                0.0.0.0:*                               /pluto
udp               X.X.X.X:                0.0.0.0:*                               /xl2tpd
udp               :::                     :::*                                    /pluto
------端口检查中存在500、、，即表示服务已启动

记录用户名和登录时间：

在/etc/ppp/ip-up 脚本中加入

echo "****************************************************" >>  /var/log/xl2tpd-${}-up.log
echo "username: $PEERNAME" >> /var/log/xl2tpd-${}-up.log
echo "clientIP: $6" >> /var/log/xl2tpd-${}-up.log
echo "device: $1" >> /var/log/xl2tpd-${}-up.log
echo "vpnIP: $4" >> /var/log/xl2tpd-${}-up.log
echo "assignIP: $5" >> /var/log/xl2tpd-${}-up.log
echo "logintime: `date -d today +%F_%T`" >> /var/log/xl2tpd-${}-up.log
echo "****************************************************" >> /var/log/xl2tpd-${1}-up.log

在/etc/ppp/ip-down 脚本中加入

echo "****************************************************" >> /var/log/xl2tpd-${}-down.log
echo "downtime: `date -d today +%F_%T`" >> /var/log/xl2tpd-${}-down.log
echo "bytes sent: $BYTES_SENT" >> /var/log/xl2tpd-${}-down.log
echo "bytes received: $BYTES_RCVD" >> /var/log/xl2tpd-${}-down.log
echo "connect time: $CONNECT_TIME" >> /var/log/xl2tpd-${}-down.log
echo "****************************************************" >> /var/log/xl2tpd-${}-down.log

===================================================================