【详细贴】Ubuntu Linode搭建海外策略路由VPN IPSec+L2TP（一）

对于码农来说，Google上搜索，stackoverflow上提问，twitter上交流，这样的国际化开放平台才是码农成长的空间。但是，目前遇到的一些现实的困难，无可避免的带来一些麻烦，不过这难不倒我们。

让我们来梳理一下需求，

• 移动设备有随时随地访问海外的需求，特别是Twitter，必须iPhone/Android都支持
• 电脑有访问海外的需求，例如Google IO 2013的直播，WWDC录像，都在Youtube
• 电脑想访问都要先拨号后使用，且拨号以后访问国内网站速度慢，需实现策略路由
• 访问速度要快，不能打开个网页像蜗牛

这样，

• 我们需要一个VPN
• 速度要快
• 实现策略路由

VPN选型

• OpenVPN iOS设备上需要安装专门的软件，证书导入复杂–放弃
• PPTP VPN 安全性和NAT穿透性差，我的工作和生活环境有两个路由，还有自建NAT的情况，使用体验慢，效果差-放弃
• L2TP IPSec VPN IPSec属于高强度加密，L2TP走UDP，NAT穿透好，只要不封闭目的端的指定端口，一般不会出现墙的情况

所以我选择了 L2TP IPSec VPN来解决我的问题

Linode在东京，国内访问速度在 250毫秒左右，速度属于比较快的国外VPS服务器了，我选择的主机操作系统是Ubuntu 12.04 LTS，属于比较常用的操作系统。

Ubuntu上的安装过程就比较简单了：

sudo apt-get install openswan xl2tpd

抱歉，为了基本的安全原因，我的Ubuntu 运行在非root用户下，linode的ubuntu运行在root下，需要进行一下改造，如何改造另文描述

Linode Ubuntu IPSec 提示是否是有X.509证书

Linode Ubuntu IPSec X.509证书 导入还是创建，选择创建

Linode Ubuntu IPSec X.509是否使用自签名，选择使用自签名

Linode Ubuntu IPSec 安装完成

seaman@li600-18:~$ sudo apt-get install openswan xl2tpd
[sudo] password for seaman:
Reading package lists... Done
Building dependency tree
Reading state information... Done
Suggested packages:
openswan-modules-source openswan-modules-dkms openswan-doc
The following NEW packages will be installed:
openswan xl2tpd
0 upgraded, 2 newly installed, 0 to remove and 31 not upgraded.
Need to get 1,177 kB of archives.
After this operation, 2,940 kB of additional disk space will be used.
Get:1 http://us.archive.ubuntu.com/ubuntu/ precise/universe openswan amd64 1:2.6.37-1 [1,103 kB]
Get:2 http://us.archive.ubuntu.com/ubuntu/ precise/universe xl2tpd amd64 1.3.1+dfsg-1 [74.1 kB]
Fetched 1,177 kB in 3s (387 kB/s)
Preconfiguring packages ...
Selecting previously unselected package openswan.
(Reading database ... 21184 files and directories currently installed.)
Unpacking openswan (from .../openswan_1%3a2.6.37-1_amd64.deb) ...
Selecting previously unselected package xl2tpd.
Unpacking xl2tpd (from .../xl2tpd_1.3.1+dfsg-1_amd64.deb) ...
Processing triggers for ureadahead ...
Processing triggers for man-db ...
Setting up openswan (1:2.6.37-1) ...
Generating a 2048 bit RSA private key
....................+++
.............+++
writing new private key to '/etc/ipsec.d/private/li600-18Key.pem'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:State or Province Name (full name) [Some-State]:Locality Name (eg, city) []:Organization Name (eg, company) [Internet Widgits Pty Ltd]:Organizational Unit Name (eg, section) []:Common Name (e.g. server FQDN or YOUR name) []:Email Address []:Successfully created x509 certificate.
ipsec_setup: Starting Openswan IPsec U2.6.37/K3.9.3-x86_64-linode33...
Setting up xl2tpd (1.3.1+dfsg-1) ...
Starting xl2tpd: xl2tpd.

编辑/etc/ipsec.conf，拷贝粘贴即可，注意left服务器IP地址，需要改成您的：

seaman@li600-18:~$ sudo vi /etc/ipsec.conf
[sudo] password for seaman:
version 2.0
config setup
nat_traversal=yes
virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12
oe=off
protostack=netkey
conn L2TP-PSK-NAT
dpddelay=40
dpdtimeout=130
dpdaction=clear
rightsubnet=vhost:%priv
also=L2TP-PSK-noNAT
conn L2TP-PSK-noNAT
authby=secret
pfs=no
auto=add
keyingtries=3
rekey=no
ikelifetime=8h
keylife=1h
type=transport
left=106.186.178.35
leftprotoport=17/1701
right=%any
rightprotoport=17/%any

修改/etc/ipsec.secrets 设置IPSec握手时的Machine Authentication – Shared Secret

seaman@li600-18:~$ sudo vi /etc/ipsec.secrets
[sudo] password for seaman:
# This file holds shared secrets or RSA private keys for inter-Pluto
# authentication. See ipsec_pluto(8) manpage, and HTML documentation.
# RSA private key for this host, authenticating it to any other host
# which knows the public part. Suitable public keys, for ipsec.conf, DNS,
# or configuration of other implementations, can be extracted conveniently
# with "ipsec showhostkey".
# this file is managed with debconf and will contain the automatically created RSA keys
# include /var/lib/openswan/ipsec.secrets.inc
106.186.178.35 %any: PSK "password"

编辑/etc/xl2tpd/xl2tpd.conf ，配置监听端口和监听服务

seaman@li600-18:~$ sudo vi /etc/xl2tpd/xl2tpd.conf
[global]
ipsec saref = yes
[lns default]
ip range = 10.1.2.2-10.1.2.255
local ip = 10.1.2.1
;require chap = yes
refuse chap = yes
refuse pap = yes
require authentication = yes
ppp debug = yes
pppoptfile = /etc/ppp/options.xl2tpd
length bit = yes

新建xl2tpd的配置文件，用户拨叫后，服务器的处理流程，这里debug开启后可以在日志中看到详细记录

seaman@li600-18:~$ sudo vi /etc/ppp/options.xl2tpd
require-mschap-v2
ms-dns 8.8.8.8
asyncmap 0
auth
crtscts
lock
hide-password
modem
debug
name l2tpd
proxyarp
lcp-echo-interval 30
lcp-echo-failure 4

编辑一个密码文件，配置用户名和密码 /etc/ppp.chap-secrets 记得红色字部分换成自己的。这里的l2tpd必须和options文件中的name字段一致。

seaman@li600-18:~$ sudo vi /etc/ppp/chap-secrets
# Secrets for authentication using CHAP
# client server secret IP addresses
seaman l2tpd password *

最后，配置一下端口转发，防火墙的规则

seaman@li600-18:~$ sudo vi /etc/rc.local
#!/bin/sh -e
#
# rc.local
#
# This script is executed at the end of each multiuser runlevel.
# Make sure that the script will "exit 0" on success or any other
# value on error.
#
# In order to enable or disable this script just change the execution
# bits.
#
# By default this script does nothing.
iptables --table nat --append POSTROUTING --jump MASQUERADE
echo 1 > /proc/sys/net/ipv4/ip_forward
for each in /proc/sys/net/ipv4/conf/*
do
echo 0 > $each/accept_redirects
echo 0 > $each/send_redirects
done
/etc/init.d/ipsec restart
exit 0

重启相关服务

seaman@li600-18:~$ sudo service ipsec restart
seaman@li600-18:~$ sudo service xl2tpd restart

重启相关服务的日志，如果是这样的日志，那就是正确的：

Jul 15 00:13:19 li600-18 ipsec_setup: Stopping Openswan IPsec...
Jul 15 00:13:20 li600-18 ipsec_setup: ...Openswan IPsec stopped
Jul 15 00:13:20 li600-18 ipsec_setup: Starting Openswan IPsec U2.6.37/K3.9.3-x86_64-linode33...
Jul 15 00:13:20 li600-18 ipsec_setup: Using NETKEY(XFRM) stack
Jul 15 00:13:20 li600-18 ipsec_setup: ...Openswan IPsec started
Jul 15 00:13:20 li600-18 pluto: adjusting ipsec.d to /etc/ipsec.d
Jul 15 00:13:20 li600-18 ipsec__plutorun: adjusting ipsec.d to /etc/ipsec.d
Jul 15 00:13:21 li600-18 ipsec__plutorun: 002 added connection description "L2TP-PSK-NAT"
Jul 15 00:13:21 li600-18 ipsec__plutorun: 002 added connection description "L2TP-PSK-noNAT"
Jul 15 00:13:52 li600-18 xl2tpd[4400]: death_handler: Fatal signal 15 received
Jul 15 00:13:53 li600-18 xl2tpd[5291]: Enabling IPsec SAref processing for L2TP transport mode SAs
Jul 15 00:13:53 li600-18 xl2tpd[5291]: IPsec SAref does not work with L2TP kernel mode yet, enabling forceuserspace=yes
Jul 15 00:13:53 li600-18 xl2tpd[5291]: setsockopt recvref[30]: Protocol not available
Jul 15 00:13:53 li600-18 xl2tpd[5291]: This binary does not support kernel L2TP.
Jul 15 00:13:53 li600-18 xl2tpd[5292]: xl2tpd version xl2tpd-1.3.1 started on li600-18 PID:5292
Jul 15 00:13:53 li600-18 xl2tpd[5292]: Written by Mark Spencer, Copyright (C) 1998, Adtran, Inc.
Jul 15 00:13:53 li600-18 xl2tpd[5292]: Forked by Scott Balmos and David Stipp, (C) 2001
Jul 15 00:13:53 li600-18 xl2tpd[5292]: Inherited by Jeff McAdams, (C) 2002
Jul 15 00:13:53 li600-18 xl2tpd[5292]: Forked again by Xelerance (www.xelerance.com) (C) 2006
Jul 15 00:13:53 li600-18 xl2tpd[5292]: Listening on IP address 0.0.0.0, port 1701

最后我会重启服务器，测试一遍是否开机自启，是否iptables配置正确，是否无需人工干预，养成这个好习惯，收益一辈子。

seaman@li600-18:~$ sudo reboot

正确完整的连接服务器日志如下：

Jul 15 00:22:04 li600-18 xl2tpd[5788]: control_finish: Peer requested tunnel 20 twice, ignoring second one.
Jul 15 00:22:05 li600-18 xl2tpd[5788]: Connection established to 124.126.164.85, 65314. Local: 54863, Remote: 20 (ref=0/0). LNS session is 'default'
Jul 15 00:22:05 li600-18 xl2tpd[5788]: start_pppd: I'm running:
Jul 15 00:22:05 li600-18 xl2tpd[5788]: "/usr/sbin/pppd"
Jul 15 00:22:05 li600-18 xl2tpd[5788]: "passive"
Jul 15 00:22:05 li600-18 xl2tpd[5788]: "nodetach"
Jul 15 00:22:05 li600-18 xl2tpd[5788]: "10.1.2.1:10.1.2.2"
Jul 15 00:22:05 li600-18 xl2tpd[5788]: "refuse-pap"
Jul 15 00:22:05 li600-18 xl2tpd[5788]: "refuse-chap"
Jul 15 00:22:05 li600-18 xl2tpd[5788]: "auth"
Jul 15 00:22:05 li600-18 xl2tpd[5788]: "debug"
Jul 15 00:22:05 li600-18 xl2tpd[5788]: "file"
Jul 15 00:22:05 li600-18 xl2tpd[5788]: "/etc/ppp/options.xl2tpd"
Jul 15 00:22:05 li600-18 xl2tpd[5788]: "ipparam"
Jul 15 00:22:05 li600-18 xl2tpd[5788]: "124.126.164.85"
Jul 15 00:22:05 li600-18 xl2tpd[5788]: "/dev/pts/1"
Jul 15 00:22:05 li600-18 xl2tpd[5788]: Call established with 124.126.*.*, Local: 33517, Remote: 8892, Serial: 1
Jul 15 00:22:05 li600-18 pppd[5836]: pppd 2.4.5 started by root, uid 0
Jul 15 00:22:05 li600-18 pppd[5836]: using channel 1
Jul 15 00:22:05 li600-18 pppd[5836]: Using interface ppp0
Jul 15 00:22:05 li600-18 pppd[5836]: Connect: ppp0 /dev/pts/1
Jul 15 00:22:05 li600-18 pppd[5836]: sent [LCP ConfReq id=0x1 ]
Jul 15 00:22:05 li600-18 pppd[5836]: rcvd [LCP ConfAck id=0x1 ]
Jul 15 00:22:08 li600-18 pppd[5836]: sent [LCP ConfReq id=0x1 ]
Jul 15 00:22:08 li600-18 pppd[5836]: rcvd [LCP ConfReq id=0x1 ]
Jul 15 00:22:08 li600-18 pppd[5836]: sent [LCP ConfAck id=0x1 ]
Jul 15 00:22:08 li600-18 pppd[5836]: rcvd [LCP ConfAck id=0x1 ]
Jul 15 00:22:08 li600-18 pppd[5836]: sent [LCP EchoReq id=0x0 magic=0x6008c32e]
Jul 15 00:22:08 li600-18 pppd[5836]: sent [CHAP Challenge id=0xde , name = "l2tpd"]
Jul 15 00:22:08 li600-18 pppd[5836]: rcvd [LCP EchoReq id=0x0 magic=0x750875db]
Jul 15 00:22:08 li600-18 pppd[5836]: sent [LCP EchoRep id=0x0 magic=0x6008c32e]
Jul 15 00:22:08 li600-18 pppd[5836]: rcvd [LCP EchoRep id=0x0 magic=0x750875db]
Jul 15 00:22:08 li600-18 pppd[5836]: rcvd [CHAP Response id=0xde , name = "seaman"]
Jul 15 00:22:08 li600-18 pppd[5836]: sent [CHAP Success id=0xde "S=9FDDBC3C524C2C4A504DD75725A4BE1AFCDC033B M=Access granted"]
Jul 15 00:22:08 li600-18 pppd[5836]: sent [CCP ConfReq id=0x1 <deflate(old#) 15> ]
Jul 15 00:22:08 li600-18 pppd[5836]: sent [IPCP ConfReq id=0x1 ]
Jul 15 00:22:08 li600-18 pppd[5836]: rcvd [IPCP ConfReq id=0x1 ]
Jul 15 00:22:08 li600-18 pppd[5836]: sent [IPCP ConfNak id=0x1 ]
Jul 15 00:22:08 li600-18 pppd[5836]: rcvd [IPV6CP ConfReq id=0x1 ]
Jul 15 00:22:08 li600-18 pppd[5836]: Unsupported protocol 'IPv6 Control Protocol' (0x8057) received
Jul 15 00:22:08 li600-18 pppd[5836]: sent [LCP ProtRej id=0x2 80 57 01 01 00 0e 01 0a 16 10 9f ff fe d1 fa 47]
Jul 15 00:22:08 li600-18 pppd[5836]: rcvd [LCP ProtRej id=0x2 80 fd 01 01 00 0f 1a 04 78 00 18 04 78 00 15 03 2f]
Jul 15 00:22:08 li600-18 pppd[5836]: Protocol-Reject for 'Compression Control Protocol' (0x80fd) received
Jul 15 00:22:08 li600-18 pppd[5836]: rcvd [IPCP ConfRej id=0x1 ]
Jul 15 00:22:08 li600-18 pppd[5836]: sent [IPCP ConfReq id=0x2 ]
Jul 15 00:22:09 li600-18 pppd[5836]: rcvd [IPCP ConfReq id=0x2 ]
Jul 15 00:22:09 li600-18 pppd[5836]: sent [IPCP ConfAck id=0x2 ]
Jul 15 00:22:09 li600-18 pppd[5836]: rcvd [IPCP ConfAck id=0x2 ]
Jul 15 00:22:09 li600-18 pppd[5836]: Cannot determine ethernet address for proxy ARP
Jul 15 00:22:09 li600-18 pppd[5836]: local IP address 10.1.2.1
Jul 15 00:22:09 li600-18 pppd[5836]: remote IP address 10.1.2.2
Jul 15 00:22:09 li600-18 pppd[5836]: Script /etc/ppp/ip-up started (pid 5843)
Jul 15 00:22:09 li600-18 pppd[5836]: Script /etc/ppp/ip-up finished (pid 5843), status = 0x0
Jul 15 00:22:09 li600-18 kernel: nf_conntrack: automatic helper assignment is deprecated and it will be removed soon. Use the iptables CT target to attach helpers instead.
Jul 15 00:22:10 li600-18 ntpd[2533]: Listen normally on 9 ppp0 10.1.2.1 UDP 123
Jul 15 00:22:10 li600-18 ntpd[2533]: peers refreshed
Jul 15 00:22:10 li600-18 ntpd[2533]: new interface(s) found: waking up resolver

服务器的配置到此结束，这样一个完整的IPSec+L2TP VPN就建立起来了，客户端部分怎么配置呢？请看（二）

FAQ:如下的错误如何处理
Jul 15 00:18:58 li600-18 pppd[5800]: The remote system is required to authenticate itself
Jul 15 00:18:58 li600-18 pppd[5800]: but I couldn’t find any suitable secret (password) for it to use to do so.

基本的原因是 /etc/ppp/chap-secrets 不正确，常见的错误有：
1.ipaddress那个*号没填
2.server应该是option.xl2tpd里面制定的那个name字段，是否少些一个d，例如写成xl2tp而不是xl2tpd

更好排版的版本：http://www.seaman.be/view/【详细贴】ubuntu-linode搭建海外策略路由vpn-ipsecl2tp（一）.html