strongswan、xl2tp基礎配置檔

利用IPSEC保持總部靜態IP+分支動態IP的連線。

環境：總部：Centos6.5

      分支：vigor or Dlink 路由器

      移動辦公室：win7

wget https://download.strongswan.org/strongswan-5.3.5.tar.gz

tar -xzvf strongswan-5.3.5.tar.gz

cd strongswan-5.3.5.tar.gz

yum update

yum install pam-devel openssl-devel make gcc -y

 ./configure  --enable-eap-identity --enable-eap-md5 --enable-eap-mschapv2 --enable-eap-tls --enable-eap-ttls --enable-eap-peap  --enable-eap-tnc --enable-eap-dynamic --enable-eap-radius --enable-xauth-eap --enable-xauth-pam  --enable-dhcp  --enable-openssl  --enable-addrblock --enable-unity  --enable-certexpire --enable-radattr --enable-tools --enable-openssl --disable-gmp

make && make install

#for *** in /proc/sys/net/ipv4/conf/*; do echo 0 > $***/accept_redirects; echo 0 > $***/send_redirects; done

vim /etc/sysctl.conf

sysctl -p

vim /usr/local/etc/ipsec.conf

conn %default

    ikelifetime=60m

    rekeymargin=3m

    keyingtries=1

    keyexchange=ikev1

    authby=secret

        ike=3des-sha1-modp1024

        esp=3des-md5

conn ×××

        left=0.0.0.0

        leftsubnet=192.168.0.0/16

        leftfirewall=yes

        right=%any

        rightsubnet=192.168.3.0/24

        auto=add

conn ***2

        left=0.0.0.0

        leftsubnet=192.168.0.0/16

        leftfirewall=yes

        right=%any

        rightsubnet=172.20.15.2/24

        auto=add

vim /usr/local/etc/ipsec.secrets

 : PSK XXXXXX

/usr/local/sbin/ipsec start

cat /var/log/messages  

vim /etc/rc.local

#!/bin/sh

#

# This script will be executed *after* all the other init scripts.

# You can put your own initialization stuff in here if you don't

# want to do the full Sys V style init stuff.

touch /var/lock/subsys/local

ifconfig eth0:0 192.168.16.1  netmask 255.255.0.0  up

wget http://www.atomicorp.com/installers/atomic

sh ./atomic

yum check-update

yum install xl2tpd -y

vim /etc/xl2tpd/xl2tpd.conf

[lns default]

ip range = 192.168.16.128-192.168.16.254

local ip = 192.168.16.1

require chap = yes

refuse pap = yes

require authentication = yes

name = Linux×××server

ppp debug = yes

pppoptfile = /etc/ppp/options.xl2tpd

length bit = yes

vim /etc/ppp/options.xl2tpd

ipcp-accept-local

ipcp-accept-remote

ms-dns  192.168.1.1

ms-dns  192.168.1.1

ms-wins 192.168.1.2

ms-wins 192.168.1.4

noccp

auth

crtscts

idle 1800

mtu 1410

mru 1410

nodefaultroute

debug

lock

proxyarp

connect-delay 5000

vim  /etc/ppp/chap-secrets

# Secrets for authentication using CHAP

# client        server  secret                  IP addresses

user1   *       test1   192.168.16.2

service xl2tpd start

vim /etc/sysconfig/iptables

# Firewall configuration written by system-config-firewall

# Manual customization of this file is not recommended.

*filter

:INPUT ACCEPT [0:0]

:FORWARD ACCEPT [0:0]

:OUTPUT ACCEPT [0:0]

-A INPUT -p 50 -j ACCEPT

-A INPUT -p 51 -j ACCEPT

-A INPUT -p udp --dport 500 -j ACCEPT

-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

-A INPUT -p icmp -j ACCEPT

-A INPUT -i lo -j ACCEPT

-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT

-A INPUT -j REJECT --reject-with icmp-host-prohibited

-A FORWARD -j REJECT --reject-with icmp-host-prohibited

COMMIT

service iptables restart

service xl2tpd restart

/usr/local/sbin/ipsec restart

done