CentOS安装L2TP VPN笔记

1. 1. 安装ipsec
2. 2. 安装必须的模块
3. 3. 配置ipsec
4. 4. 配置密钥
5. 5. 配置转发
6. 6. 验证ipsec配置
7. 7. 安装x2ltpd
8. 8. 配置xl2tpd
9. 9. 配置转发规则
10. 10. 启动xl2tp
11. 11. 自启动配置

换了个新vps，之前一直用pptp和openvpn，这次准备尝试下l2tp，记录下安装过程

ip里也就能通过NCSetting快速启动vpn了，openvpn没有在NCSetting里的设置

首先需要卸载已安装的openswan，我因为yum install安装的openswan版本有bug，导致我折腾一天也没连接成功，所以建议直接下载指定版本的源码编译安装

安装ipsec

yum remove -y openswan
wget http://www.openswan.org/download/openswan-2.6.24.tar.gz
tar zxvf openswan-2.6.24.tar.gz
cd openswan-2.6.24
make programs install

安装必须的模块

yum install ppp iptables libpcap-devel

配置ipsec

rm -rf /etc/ipsec.conf
touch /etc/ipsec.conf
cat >>/etc/ipsec.conf< <EOF
config setup
    nat_traversal=yes
    virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12
    oe=off
    protostack=netkey

conn L2TP-PSK-NAT
    rightsubnet=vhost:%priv
    also=L2TP-PSK-noNAT

conn L2TP-PSK-noNAT
    authby=secret
    pfs=no
    auto=add
    keyingtries=3
    rekey=no
    ikelifetime=8h
    keylife=1h
    type=transport
    left=$ip  #替换成vps的ip
    leftprotoport=17/1701
    right=%any
    rightprotoport=17/%any
EOF

配置密钥

替换vipip和key

echo "$your_vps_ip %any: PSK \"$your_key\"" >/etc/ipsec.d/l2tp.secrets

配置转发

sed -i 's/net.ipv4.ip_forward = 0/net.ipv4.ip_forward = 1/g' /etc/sysctl.conf
sysctl -p
for each in /proc/sys/net/ipv4/conf/*                                                                                                      
do                                                                                                                                         
echo 0 > $each/accept_redirects                                                                                                            
echo 0 > $each/send_redirects                                                                                                              
done 
iptables -t nat -A POSTROUTING -j MASQUERADE

验证ipsec配置

/etc/init.d/ipsec restart                                                                                                                  
ipsec verify 
Checking your system to see if IPsec got installed and started correctly:
Version check and ipsec on-path                                 [OK]
Linux Openswan U2.6.24/K2.6.32-71.29.1.el6.i686 (netkey)
Checking for IPsec support in kernel                            [OK]
NETKEY detected, testing for disabled ICMP send_redirects       [OK]
NETKEY detected, testing for disabled ICMP accept_redirects     [OK]
Checking for RSA private key (/etc/ipsec.secrets)               [OK]
Checking that pluto is running                                  [OK]
Pluto listening for IKE on udp 500                              [OK]
Pluto listening for NAT-T on udp 4500                           [OK]
Two or more interfaces found, checking IP forwarding            [OK]
Checking NAT and MASQUERADEing                                  [N/A]
Checking for 'ip' command                                       [OK]
Checking for 'iptables' command                                 [OK]
Opportunistic Encryption Support                                [DISABLED]

安装x2ltpd

wget http://www.xelerance.com/wp-content/uploads/software/xl2tpd/xl2tpd-1.3.0.tar.gz
tar xvf xl2tpd-1.3.0.tar.gz
make install
mkdir /var/run/xl2tpd
ln -s /usr/local/sbin/l2tp-control /var/run/xl2tpd/l2tp-control
mkdir /etc/xl2tpd

配置xl2tpd

修改/etc/xl2tpd/xl2tpd.conf

[global]
listen-addr = $your_vps_ip #替换成你的vpsip
ipsec saref = yes
[lns default]
ip range = 192.168.30.10-192.168.30.20
local ip = 192.168.30.1
require chap = yes
refuse pap = yes
require authentication = yes
ppp debug = yes
pppoptfile = /etc/ppp/options.xl2tpd
length bit = yes

编辑 /etc/ppp/options.xl2tpd

require-mschap-v2
ipcp-accept-local
ipcp-accept-remote
ms-dns  8.8.8.8
ms-dns  8.8.4.4
asyncmap 0
noccp
auth
crtscts
hide-password
debug
modem
lock
proxyarp
name l2tpd
lcp-echo-interval 30
lcp-echo-failure 4

配置用户和密码 /etc/ppp/chap-secrets

# Secrets for authentication using CHAP
# client        server  secret                  IP addresses
name         l2tpd   password                *

配置转发规则

iptables -t nat -A POSTROUTING -s 192.168.30.0/24 -o eth0 -j MASQUERADE 
iptables -t nat -A POSTROUTING -s 192.168.30.0/24 -j SNAT --to-source $your_vps_ip

启动xl2tp

xl2tpd -D &

现在应该已经正常运行了，可以在你的手机或者电脑上新建一个l2tp连接测试

自启动配置

为了保证每次vps重启后都正常启动l2tp服务，我们还需做下面操作

iptables-save > /etc/iptables
echo "iptables-restore /etc/iptables" >> /etc/rc.local
echo "/usr/local/sbin/xl2tpd -D &" >> /etc/rc.local
chkconfig --add ipsec
chkconfig --level 2345 ipsec on

参考文章：
CentOS上L2TP安装与配置