不同机房vpc使用openswan打通内网

1、测试环境：

北京6云主机：120.92.51.75/10.0.3.13 VPC：10.0.0.0/16 Ren-test

上海2云主机：42.157.163.120/192.168.3.3 VPC：zxs_vpc

2、下载安装openwan：

1、安装依赖包：

# yum -y install gmp-devel  bison flex gcc

2、下载安装openswan

https://download.openswan.org/openswan/

# wget https://download.openswan.org/openswan/openswan-2.6.43.1.tar.gz

# tar zxf openswan-2.6.43.1.tar.gz

# cd openswan-2.6.43.1

# make programs

# sudo make install

3、启动openswan

# /etc/init.d/ipsec start     # 启动

# netstat -lnput |grep pluto  # 查看监听端口

4、基础环境，内核参数等配置修改

# ipsec verify     # 基础环境依赖、状态查看

① 解决，更新如下配置：

echo 0 > /proc/sys/net/ipv4/conf/all/rp_filter;

echo 0 > /proc/sys/net/ipv4/conf/default/rp_filter;

echo 0 > /proc/sys/net/ipv4/conf/eth0/rp_filter;

echo 0 > /proc/sys/net/ipv4/conf/eth1/rp_filter;

echo 0 > /proc/sys/net/ipv4/conf/lo/rp_filter;

② 配置服务器路由转发功能等操作

# vi /etc/sysctl.conf

net.ipv4.ip_forward = 1  # 开启转发

net.ipv4.conf.default.rp_filter = 0

# 关闭icmp重定向

# sysctl -a | egrep "ipv4.*(accept|send)_redirects" | awk -F "=" '{print$1"= 0"}' >> /etc/sysctl.conf

# sysctl -p

③ 检查最终效果

# ipsec verify

#北京6云主机配置：

[root@vm10-0-3-13 ]# cat /etc/issue

CentOS release 6.9 (Final)

[root@vm10-0-3-13 ~]# curl myip.ksyun.com

{"eip":"120.92.51.75"}

[root@vm10-0-3-13 ~]# cat /etc/sysctl.conf

net.ipv4.ip_forward = 1

net.ipv4.conf.default.rp_filter = 0

net.ipv4.conf.default.accept_source_route = 0

kernel.sysrq = 0

kernel.core_uses_pid = 1

net.ipv4.tcp_syncookies = 1

net.bridge.bridge-nf-call-ip6tables = 0

net.bridge.bridge-nf-call-iptables = 0

net.bridge.bridge-nf-call-arptables = 0

kernel.msgmnb = 65536

kernel.msgmax = 65536

kernel.shmmax = 68719476736

kernel.shmall = 4294967296

net.ipv4.tcp_keepalive_time = 1200

net.ipv4.ip_local_port_range = 1024 65535

net.ipv4.conf.all.rp_filter = 0

net.ipv4.conf.default.rp_filter = 0

net.ipv4.conf.eth0.rp_filter = 0

net.ipv4.conf.eth1.rp_filter = 0

net.ipv4.conf.all.arp_announce = 2

net.ipv4.conf.default.arp_announce = 2

net.ipv4.conf.eth0.arp_announce = 2

net.ipv4.conf.eth1.arp_announce = 2

net.ipv6.conf.all.disable_ipv6 = 0

net.ipv6.conf.default.disable_ipv6 = 0

net.ipv6.conf.lo.disable_ipv6 = 0

net.ipv4.conf.all.accept_redirects = 0

net.ipv4.conf.all.send_redirects = 0

net.ipv4.conf.default.accept_redirects = 0

net.ipv4.conf.default.send_redirects = 0

net.ipv4.conf.lo.accept_redirects = 0

net.ipv4.conf.lo.send_redirects = 0

net.ipv4.conf.eth0.accept_redirects = 0

net.ipv4.conf.eth0.send_redirects = 0

net.ipv4.conf.eth1.accept_redirects = 0

net.ipv4.conf.eth1.send_redirects = 0

[root@vm10-0-3-13 ~]# cat /etc/ipsec.d/ksyun.conf

conn BJ-to-SH

        ike=3des-sha1

        authby=secret

        phase2=esp

        phase2alg=3des-sha1

        compress=no

        type=tunnel

        pfs=yes

        leftid=42.157.163.120

        left=42.157.163.120

        leftsubnet=192.168.0.0/16

        leftnexthop=%defaultroute       

        rightid=120.92.51.75

        right=10.0.3.13

        rightsubnet=10.0.0.0/16

        rightnexthop=%defaultroute

        auto=start

[root@vm10-0-3-13 ~]# cat /etc/ipsec.secrets

#include /etc/ipsec.d/*.secrets

0.0.0.0 0.0.0.0 : PSK "kingsoft"

[root@vm10-0-3-13 ~]# ip addr show

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN

    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00

    inet 127.0.0.1/8 scope host lo

2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000

    link/ether fa:16:3e:0c:35:df brd ff:ff:ff:ff:ff:ff

    inet 10.0.3.13/24 brd 10.0.3.255 scope global eth0

3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000

    link/ether fa:16:3e:3e:72:2f brd ff:ff:ff:ff:ff:ff

    inet 10.0.2.208/24 brd 10.0.2.255 scope global eth1

[root@vm10-0-3-13 ~]# ip route show

10.0.2.0/24 dev eth1  proto kernel  scope link  src 10.0.2.208

10.0.3.0/24 dev eth0  proto kernel  scope link  src 10.0.3.13

169.254.0.0/16 dev eth0  scope link  metric 1002

169.254.0.0/16 dev eth1  scope link  metric 1003

default via 10.0.3.1 dev eth0

[root@vm10-0-3-13 log]# tail -20 /var/log/pluto.log

Jul 25 15:30:57: listening for IKE messages

Jul 25 15:30:57: adding interface eth1/eth1 10.0.2.208:500

Jul 25 15:30:57: adding interface eth1/eth1 10.0.2.208:4500

Jul 25 15:30:57: adding interface eth0/eth0 10.0.3.13:500

Jul 25 15:30:57: adding interface eth0/eth0 10.0.3.13:4500

Jul 25 15:30:57: adding interface lo/lo 127.0.0.1:500

Jul 25 15:30:57: adding interface lo/lo 127.0.0.1:4500

Jul 25 15:30:57: | setup callback for interface lo:4500 fd 23

Jul 25 15:30:57: | setup callback for interface lo:500 fd 22

Jul 25 15:30:57: | setup callback for interface eth0:4500 fd 21

Jul 25 15:30:57: | setup callback for interface eth0:500 fd 20

Jul 25 15:30:57: | setup callback for interface eth1:4500 fd 19

Jul 25 15:30:57: | setup callback for interface eth1:500 fd 18

Jul 25 15:30:57: loading secrets from "/etc/ipsec.secrets"

Jul 25 15:30:57: "BJ-to-SH" #1: initiating Main Mode

Jul 25 15:30:57: "BJ-to-SH" #1: ignoring Vendor ID payload [Openswan(xeleranized)]

Jul 25 15:30:57: "BJ-to-SH" #1: received Vendor ID payload [Dead Peer Detection]

Jul 25 15:30:57: "BJ-to-SH" #1: received Vendor ID payload [RFC 3947]

Jul 25 15:30:57: "BJ-to-SH" #1: enabling possible NAT-traversal with method RFC 3947 (NAT-Traversal)

Jul 25 15:30:57: "BJ-to-SH" #1: transition from state STATE_MAIN_I1 to state STATE_MAIN_I2

Jul 25 15:30:57: "BJ-to-SH" #1: STATE_MAIN_I2: sent MI2, expecting MR2

Jul 25 15:30:57: "BJ-to-SH" #1: NAT-Traversal: Result using RFC 3947 (NAT-Traversal) sender port 500: I am behind NAT+peer behind NAT

Jul 25 15:30:57: "BJ-to-SH" #1: transition from state STATE_MAIN_I2 to state STATE_MAIN_I3

Jul 25 15:30:57: "BJ-to-SH" #1: STATE_MAIN_I3: sent MI3, expecting MR3

Jul 25 15:30:57: "BJ-to-SH" #1: received Vendor ID payload [CAN-IKEv2]

Jul 25 15:30:57: "BJ-to-SH" #1: Main mode peer ID is ID_IPV4_ADDR: '42.157.163.120'

Jul 25 15:30:57: "BJ-to-SH" #1: transition from state STATE_MAIN_I3 to state STATE_MAIN_I4

Jul 25 15:30:57: "BJ-to-SH" #1: STATE_MAIN_I4: ISAKMP SA established {auth=PRESHARED_KEY cipher=oakley_3des_cbc_192 integ=sha group=MODP2048}

Jul 25 15:30:57: "BJ-to-SH" #2: initiating Quick Mode PSK+ENCRYPT+TUNNEL+PFS+UP+IKEV1_ALLOW+IKEV2_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW {using isakmp#1 msgid:8d92af45 proposal=3DES(3)_000-SHA1(2)_000 pfsgroup=OAKLEY_GROUP_MODP2048}

Jul 25 15:30:57: "BJ-to-SH" #2: transition from state STATE_QUICK_I1 to state STATE_QUICK_I2

Jul 25 15:30:57: "BJ-to-SH" #2: STATE_QUICK_I2: sent QI2, IPsec SA established tunnel mode {ESP/NAT=>0x32aaec51 <0x73d0c6c9 xfrm=3DES_0-HMAC_SHA1 NATOA=none NATD=42.157.163.120:4500 DPD=passive}

上海2云主机配置：

[root@vm192-168-3-9 ~]# cat /etc/issue

\S

Kernel \r on an \m

[root@vm192-168-3-9 ~]# curl myip.ksyun.com

{"eip":"42.157.163.120"}

[root@vm192-168-3-9 ~]# cat /etc/ipsec.d/ksyun.conf

conn SH-to-BJ

        ike=3des-sha1

        authby=secret

        phase2=esp

        phase2alg=3des-sha1

        compress=no

        type=tunnel

        pfs=yes

        leftid=42.157.163.120

        left=192.168.3.9

        leftsubnet=192.168.0.0/16

        leftnexthop=%defaultroute

        rightid=120.92.51.75

        right=120.92.51.75

        rightsubnet=10.0.0.0/16

        rightnexthop=%defaultroute

        auto=start

[root@vm192-168-3-9 ~]# cat /etc/ipsec.secrets

0.0.0.0 0.0.0.0 : PSK "kingsoft"

[root@vm192-168-3-9 ~]# ip addr show

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000

    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00

    inet 127.0.0.1/8 scope host lo

       valid_lft forever preferred_lft forever

2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000

    link/ether fa:16:3e:7d:86:8f brd ff:ff:ff:ff:ff:ff

    inet 192.168.3.9/24 brd 192.168.3.255 scope global eth0

       valid_lft forever preferred_lft forever

[root@vm192-168-3-9 ~]# ip route show

default via 192.168.3.1 dev eth0

169.254.0.0/16 dev eth0 scope link metric 1002

192.168.3.0/24 dev eth0 proto kernel scope link src 192.168.3.9

[root@vm192-168-3-9 ~]# tail -20 /var/log/messages

Jul 25 15:07:32 vm192-168-3-9 ipsec_setup: Starting Openswan IPsec U2.6.43/K3.10.0-862.14.4.el7.x86_64...

Jul 25 15:07:32 vm192-168-3-9 ipsec_setup: Using NETKEY(XFRM) stack

Jul 25 15:07:32 vm192-168-3-9 kernel: IPv6: esp6_init: can't add xfrm type

Jul 25 15:07:32 vm192-168-3-9 kernel: IPv6: ah6_init: can't add xfrm type

Jul 25 15:07:32 vm192-168-3-9 kernel: AVX2 instructions are not detected.

Jul 25 15:07:33 vm192-168-3-9 kernel: AVX2 or AES-NI instructions are not detected.

Jul 25 15:07:33 vm192-168-3-9 ipsec_setup: ...Openswan IPsec started

Jul 25 15:07:33 vm192-168-3-9 pluto: adjusting ipsec.d to /etc/ipsec.d

Jul 25 15:07:33 vm192-168-3-9 ipsec__plutorun: 002 added connection description "SH-to-BJ"

Jul 25 15:07:33 vm192-168-3-9 ipsec__plutorun: 002 listening for IKE messages

Jul 25 15:07:33 vm192-168-3-9 ipsec__plutorun: 002 adding interface eth0/eth0 192.168.3.9:500

Jul 25 15:07:33 vm192-168-3-9 ipsec__plutorun: 002 adding interface eth0/eth0 192.168.3.9:4500

Jul 25 15:07:33 vm192-168-3-9 ipsec__plutorun: 002 adding interface lo/lo 127.0.0.1:500

Jul 25 15:07:33 vm192-168-3-9 ipsec__plutorun: 002 adding interface lo/lo 127.0.0.1:4500

Jul 25 15:07:33 vm192-168-3-9 ipsec__plutorun: 002 loading secrets from "/etc/ipsec.secrets"

[root@vm192-168-3-9 ~]# 可以配置/etc/ipsec.conf中logfile=/var/log/pluto.log或plutostderrlog=/var/log/pluto.log开启openwan日志

added connection description "SH-to-BJ"

listening for IKE messages

adding interface eth0/eth0 192.168.3.9:500

adding interface eth0/eth0 192.168.3.9:4500

adding interface lo/lo 127.0.0.1:500

adding interface lo/lo 127.0.0.1:4500

loading secrets from "/etc/ipsec.secrets"

packet from 120.92.51.75:500: received Vendor ID payload [Dead Peer Detection]

packet from 120.92.51.75:500: ignoring Vendor ID payload [FRAGMENTATION]

packet from 120.92.51.75:500: received Vendor ID payload [RFC 3947] method set to=115

packet from 120.92.51.75:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03] meth=108, but already using method 115

packet from 120.92.51.75:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n] meth=106, but already using method 115

packet from 120.92.51.75:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02] meth=107, but already using method 115

"SH-to-BJ" #1: responding to Main Mode

"SH-to-BJ" #1: transition from state STATE_MAIN_R0 to state STATE_MAIN_R1

"SH-to-BJ" #1: STATE_MAIN_R1: sent MR1, expecting MI2

"SH-to-BJ" #1: NAT-Traversal: Result using draft-ietf-ipsec-nat-t-ike (MacOS X): both are NATed

"SH-to-BJ" #1: transition from state STATE_MAIN_R1 to state STATE_MAIN_R2

"SH-to-BJ" #1: STATE_MAIN_R2: sent MR2, expecting MI3

"SH-to-BJ" #1: Main mode peer ID is ID_IPV4_ADDR: '120.92.51.75'

"SH-to-BJ" #1: transition from state STATE_MAIN_R2 to state STATE_MAIN_R3

"SH-to-BJ" #1: new NAT mapping for #1, was 120.92.51.75:500, now 120.92.51.75:4500

"SH-to-BJ" #1: STATE_MAIN_R3: sent MR3, ISAKMP SA established {auth=OAKLEY_PRESHARED_KEY cipher=oakley_3des_cbc_192 prf=oakley_sha group=modp2048}

"SH-to-BJ" #1: the peer proposed: 192.168.0.0/16:0/0 -> 10.0.0.0/16:0/0

"SH-to-BJ" #2: responding to Quick Mode proposal {msgid:d6c02a77}

"SH-to-BJ" #2:     us: 192.168.0.0/16===192.168.3.9<192.168.3.9>[42.157.163.120]---192.168.3.1

"SH-to-BJ" #2:   them: 192.168.3.1---120.92.51.75<120.92.51.75>===10.0.0.0/16

"SH-to-BJ" #2: transition from state STATE_QUICK_R0 to state STATE_QUICK_R1

"SH-to-BJ" #2: STATE_QUICK_R1: sent QR1, inbound IPsec SA installed, expecting QI2

"SH-to-BJ" #2: transition from state STATE_QUICK_R1 to state STATE_QUICK_R2

"SH-to-BJ" #2: STATE_QUICK_R2: IPsec SA established tunnel mode {ESP=>0xd85f23ba <0x232e6a69 xfrm=3DES_0-HMAC_SHA1 NATOA=none NATD=120.92.51.75:45

00 DPD=none}

3、VPC控制台路由配置：

北京6 VPC：

上海2 VPC：

参考文档：https://www.172173.com/openswan.html#2-5-%E9%AA%8C%E8%AF%81%E7%8E%AF%E5%A2%83

zxs_vpc

不同机房vpc使用openswan打通内网的更多相关文章

阿里云vpc网络SNAT实现内网实例通外网
需求场景: 因费用和安全考虑,内网部分机器没有分配公网IP,没绑定弹性公网IP,没有购买NAT服务,但是内网机器需要访问外网部分资源,如发送邮件. 操作步骤如下: 1.查看外网上的转发功能的开启没开启 ...
典型案例收集-使用OpenVPN连通多个机房内网（转）（静态路由）
说明: 1.这篇文章主要是使用静态路由表实现的多个机房通过VPN连接后的子网机房互通. 2.OpenVPN使用的是桥接模式(server-bridge和dev tap),这个是关键点,只有这样设置才可 ...
ngrok反向隧道--获取内网IP
ngrok反向隧道前情提要:小明与小白各有一台主机,两台主机在同一内网,小明想直接通过内网ssh到小白的主机上.但是小白的ip地址会不断的变化,而小明不想每次都要麻烦小白查看ip.于是小明催生了一个 ...
内网gitlab访问外网
外网要访问内网,内网出口必须有公网ip,且外网访问内部网络可以用花生壳,可以用主机端口映射写ansible调api,打通内网到阿里云的master节点如何将公司内网与云服务器内网打通参照 ...
service几种访问类型（集群外负载均衡访问LoadBalancer ，集群内访问ClusterIP，VPC内网负载均衡LoadBalancer ，集群外访问NodePort）
一.集群外访问(负载均衡) kind: ServiceapiVersion: v1spec: ports: - protocol: TCP port: 4341 targetPort: 8080 no ...
IPsecVPN：阿里云VPN网关和深信服防火墙打通公有云和公司内网
简介目前许多公司网络环境为混合云(私有云,IDC,公司内网融合)的状态,通过内网ip的访问使得工作更加方便,需求也更为迫切,而本文介绍的即是实现私有云和公司内网互通的一种方法,希望对有此需求的小伙伴 ...
QQ通信原理及QQ是怎么穿透内网进行通信的？ (转)
原:http://f543711700.iteye.com/blog/978044#bc2344608 QQ是一个基于TCP/UDP协议的通讯软件发送消息的时候是UDP打洞,登陆的时候使用HTTP~ ...
烂泥：openvpn双网卡客户端与内网机器通信
本文由ilanniweb提供友情赞助,首发于烂泥行天下想要获得更多的文章,可以关注我的微信ilanniweb. 前段时间写了一篇有关openvpn搭建与内网机器通信的文章,那篇文章是基于服务器单网卡 ...
[转载]QQ通讯原理及QQ是怎么穿透内网的
QQ是一个基于TCP/UDP协议的通讯软件发送消息的时候是UDP打洞,登陆的时候使用HTTP~因为登陆服务器其实就是一个HTTP服务器,只不过不是常用的那些,那个服务器是腾讯自行开发的!!! 一.登 ...

随机推荐

jmeter ssh command方式执行hive指令
Hive命令执行打开任意一个安装了hive的服务器,进入hive bin 路径,可以看到存在以下文件(仅展示部分): -rwxr-xr-x 1 root root 1297 Jun 28 14:29 ...
Codeforces 1455G - Forbidden Value（map 启发式合并+DP）
Codeforces 题面传送门 & 洛谷题面传送门首先这个 if 与 end 配对的结构显然形成一个树形结构,考虑把这棵树建出来,于是这个程序的结构就变为,对树进行一遍 DFS,到达某个节 ...
洛谷 P5897 - [IOI2013]wombats（决策单调性优化 dp+线段树分块）
题面传送门首先注意到这次行数与列数不同阶,列数只有 \(200\),而行数高达 \(5000\),因此可以考虑以行为下标建线段树,线段树上每个区间 \([l,r]\) 开一个 \(200\times ...
洛谷 P5401 - [CTS2019]珍珠（NTT+二项式反演）
题面传送门一道多项式的 hot tea 首先考虑将题目的限制翻译成人话,我们记 \(c_i\) 为 \(i\) 的出现次数,那么题目的限制等价于 \(\sum\limits_{i=1}^D\lflo ...
EXCEL-批量下拉填充
3.批量下拉填充 => 全选->Ctrl+G定位空值->随意找一个空白单元格输入=还有此单元格想要填充的内容->按Ctrl+Enter,等待几秒,即可,批量下拉填充:
Oracle-distinct()用法、count(distinct( 字段A || 字段B))是什么意思？distinct多个字段
0.distinct用法在oracle中distinct的使用主要是在查询中去除重复出现的数据直接在字段前加distinct关键字即可,如:select distinct 名字 from tabl ...
ProxyApi-大数据采集用的IP代理池
用于大数据采集用的代理池在数据采集的过程中,最需要的就是一直变化的代理ip. 自建adsl为问题是只有一个区域的IP. 买的代理存在的问题是不稳定,影响采集效率. 云vps不允许安装花生壳等,即使有 ...
Hadoop入门完全分布式运行模式-准备
目录 Hadoop运行环境完全分布式运行模式(重点) scp secure copy 安全拷贝 1 hadoop102上的JDK文件推给103 2 hadoop103从102上拉取Hadoop文件 ...
Hive(六)【分区表、分桶表】
目录一.分区表 1.本质 2.创建分区表 3.加载数据到分区表 4.查看分区 5.增加分区 6.删除分区 7.二级分区 8.分区表和元数据对应得三种方式 9.动态分区二.分桶表 1.创建分桶表 2 ...
ssh : connect to host XXX.XXX.XXX.XXX port : 22 connect refused
初学者写博客如有不对之处请多多指教我是要在俩个主机的俩个虚拟机上用scp (security copy)进行文件远程复制. 但是终端提示 ssh : connect to host XXX ...

不同机房vpc使用openswan打通内网

不同机房vpc使用openswan打通内网的更多相关文章

随机推荐

热门专题