通过openswan基于Azure平台搭建VPN server

用过Azure的读者都知道，Vnet一直是Azure比较自豪的地方，尤其是VPN，Azure提供了两种VPN以及专线来保证客户数据的安全性，S2S vpn(站点到站点的，基于IPsec的)，P2S vpn(点到站点的，基于sstp的)，专线express route是和物理链路或者MPLS网络相连接，在这里笔者要提醒大家一句，Azure的vpn身后是两台机器做HA的vpn server，是提供LSA保证的，而无论是阿里还是AWS都没有这样的服务，而且Azure最高提供带宽200M的VPN链路，三线BGP相连（移动 联通 电信），一跳进入骨干网，所以说Azure的vpn并不是吹出来的，我们是有实力的！！！

笔者一直相信一句话，弱势与优势从来只是角度的问题，曾经碰到一个客户，这里不说名字，只谈场景，这个客户在全国有150多个分店，分店都有路由设备，并且要求数据不能走公网走，这样只能考虑vpn，本来Azure的vpn是Azure的优势，但是到这里就变成了劣势，为什么？你求我啊，我就告诉你，开个玩笑，是这样的，Azure的S2S vpn网关分个三个级别，分别对应的隧道数量只有，一个，十个，三十个，显而易见不符合需求，有人肯定会问一个vpn网关不够就用多个呗，但是Azure定义一个VNet只能有一个vpn网关，Vnet之间是隔离的，这是第一个原因，第二个原因是才最主要的，一个高级VPN网关一年的费用就达到三万左右，以这里为例，光五个vpn网关的价格就达到十五万以上，这是一般客户都难以承受的，反而这个时候用虚拟机搭vpn比较合适（这样阿里反而最占优势，因为虚拟机价格便宜），其实事实也并非如此，所以我一直觉得没有什么绝对的优势也没有觉得的劣势，关键在于客户愿意去听什么。

场景：本次poc中，我们选用开源软件openswan，然后在东部数据中心建立一台A1虚拟机，OS为Centos6.5，装上openswan，作为vpnserver，配置iptables，最后使用iphone拨该服务器，达到目的

架构图这里略去，虚拟机的建立过程略去，但是在装openswan之前，我们需要配置一下端口，分别是UDP500和UDP4500，在ASM中需要配置终结点，ARM需要配置NSG，这里的配置过程省去，结果如下

SSH登陆到vm，安装openswan

先确认OS版本，输入 sudo cat /etc/redhat-release

配置yum源

sudo vim /etc/yum.repos.d/epel.repo

[epel]
name=epel
baseurl=http://mirrors.sohu.com/fedora-epel/6/$basearch
enabled=
gpgcheck=

编辑保存，看到如下结果。

首先通过yum安装

sudo yum install -y ppp iptables make gcc gmp-devel xmlto bison flex xmlto libpcap-devel lsof

看到如下结果，说明安装成功

其次安装IPsec，下载，解压，安装

sudo wget https://download.openswan.org/openswan/openswan-2.6.49.tar.gz --no-check-certificate
sudo tar vxf openswan-.tar.gz
sudo cd openswan-2.6.49
sudo make programs install

通过yum安装epel里的xl2tpd

sudo yum install -y xl2tpd

看到如下结果说明安装成功

配置服务

配置IPsec

sudo vim /etc/ipsec.conf

# /etc/ipsec.conf - Openswan IPsec configuration file
# This file: /usr/local/share/doc/openswan/ipsec.conf-sample
#
# Manual: ipsec.conf.
version 2.0 # conforms to second version of ipsec.conf specification
# basic configuration
config setup
# Do not set debug options to debug configuration issues!
# plutodebug / klipsdebug = "all", "none" or a combation from below:
# "raw crypt parsing emitting control klips pfkey natt x509 dpd private"
# eg:
# plutodebug="control parsing"
# Again: only enable plutodebug or klipsdebug when asked by a developer
#
# enable to get logs per-peer
# plutoopts="--perpeerlog"
#
# Enable core dumps (might require system changes, like ulimit -C)
# This is required for abrtd to work properly
# Note: incorrect SElinux policies might prevent pluto writing the core
dumpdir=/var/run/pluto/
#
# NAT-TRAVERSAL support, see README.NAT-Traversal
nat_traversal=yes
# exclude networks used on server side by adding %v4:!a.b.c./
# It seems that T-Mobile in the US and Rogers/Fido in Canada are
# / as "private" address space on their 3G network.
# This range has not been announced via BGP (at least upto --)
virtual_private=%v4:,%v4:,%v4:,%v4:,%v6:fd00::/,%v6:fe80::/
# OE is now off by default. Uncomment and change to on, to enable.
oe=off
# which IPsec stack to use. auto will try netkey, then klips then mast
protostack=netkey
#protostack=auto
# Use this to log to a file, or disable logging on embedded systems (like openwrt)
#plutostderrlog=/dev/null
# Add connections here
# sample VPN connection
# for more examples, see /etc/ipsec.d/examples/
#conn sample
# # Left security gateway, subnet behind it, nexthop toward right.
# left=10.0.0.1
# leftsubnet=
# leftnexthop=10.22.33.44
# # Right security gateway, subnet behind it, nexthop toward left.
# right=10.12.12.1
# rightsubnet=
# rightnexthop=10.101.102.103
# # To authorize this connection, but not actually start it,
# # at startup, uncomment this.
# #auto=add
conn L2TP-PSK-NAT
  rightsubnet=vhost:%priv
  also=L2TP-PSK-noNAT
conn L2TP-PSK-noNAT
  authby=secret
  pfs=no
  auto=add
  keyingtries=
  rekey=no
  ikelifetime=8h
  keylife=1h
  type=transport
  left=10.215.92.31 #AWS EC2 Internal IP
  leftprotoport=/
  right=%any
  rightprotoport=/%any
  dpddelay=
  dpdtimeout=
  dpdaction=clear

在这里，笔者想提醒大家一句，在修改该文件时，尽量不要去动原有的内容格式，只修改要改的内容就好，否则会在后续的过程中出现不必要的错误，看到如下结果说明成功

配置安全规则ipsec.secrets

sudo vim /etc/ipsec.secrets

# This file holds shared secrets or RSA private keys for inter-Pluto
# authentication. See ipsec_pluto() manpage, and HTML documentation.
# RSA private key for this host, authenticating it to any other host
# which knows the public part. Suitable public keys, for ipsec.conf, DNS,
# or configuration of other implementations, can be extracted conveniently
# with "ipsec showhostkey".
# this file is managed with debconf and will contain the automatically created RSA keys
#include /var/lib/openswan/ipsec.secrets.inc
%any %any: PSK "azure"

看到如下结果说明成功

配置sysctl.conf文件

sudo vim /etc/sysctl.conf

net.ipv4.ip_forward =
net.ipv4.conf.
net.ipv4.conf.all.send_redirects =
net.ipv4.conf.
net.ipv4.conf.all.log_martians =
net.ipv4.conf.
net.ipv4.conf.
net.ipv4.conf.all.accept_redirects =
net.ipv4.conf.
net.ipv4.icmp_ignore_bogus_error_responses = 

看到如下结果则为成功

通过下面的命令，使配置生效

sudo sysctl -p
sudo service ipsec start
ipsec verify

看到如下结果

输入ipsec verify 会看到如下结果

在这里不需要关心errors，我们只关心我们创建的端口（udp4500和udp500正常工作就好了），其它问题引起的错误不要去纠结，这里不展开去说

配置xl2tpd

sudo vim /etc/xl2tpd/xl2tpd.conf

;
; This is a minimal sample xl2tpd configuration file for use
; with L2TP over IPsec.
;
; The idea is to provide an L2TP daemon to which remote Windows L2TP/IPsec
; clients connect. In this example, the internal (protected) network
; . A special IP range within this network is reserved
;
; (i.e. 192.168.1.128 ... 192.168.1.254)
;
; The listen-addr parameter can be used if you want to bind the L2TP daemon
; to a specific IP address instead of to all interfaces. For instance,
; you could bind it to the interface of the internal LAN (e.g. 192.168.1.98
; in the example below). Yet another IP address (local ip, e.g. 192.168.1.99)
; will be used by xl2tpd as its address on pppX interfaces.
[global]
; listen-addr = 192.168.1.98
;
; requires openswan- or higher - Also does not yet work in combination
; with kernel mode l2tp +
; ipsec saref = yes
; Use refinfo of   or
; when .
; saref refinfo =
;
; force userspace = yes
;
; debug tunnel = yes
ipsec saref = no
[lns default]
ip range = 192.168.1.128-192.168.1.254
local ip = 192.168.1.99
require chap = yes
refuse pap = yes
require authentication = yes
name = LinuxVPNserver
ppp debug = yes
pppoptfile = /etc/ppp/options.xl2tpd
length bit = yes

看到如下结果则成功

配置ppp的用户名和密码

sudo vim /etc/ppp/chap-secrets

# Secrets for authentication using CHAP
# client server secret IP addresses
user * azure *

配置iptables

sudo iptables -t nat -A POSTROUTING -s  -o eth0 -j MASQUERADE
sudo iptables -I FORWARD -s  -j ACCEPT
sudo iptables -I FORWARD -d  -j ACCEPT
sudo service iptables save

看到如下结果说明成功

设置服务

sudo service ipsec restart
sudo service xl2tpd restart
sudo service iptables restart
sudo chkconfig xl2tpd on
sudo chkconfig iptables on
sudo chkconfig ipsec on

看到如下结果

最后一步设置iphone，这一步这里就不再多说，但是在这里笔者想提醒大家一句，有人在测试的时候发现，iphone无论如何都不能连接vpn server，即使查看了/var/log/下的secure与message文件，也发现没有然后具体报错，如果遇到这种情况说明l2tp vpn server被封掉了，这时候无论你怎么连你都是连不上的，所以笔者的建议最好是以global账户来建立vm，这样就不会碰到这种情况。