[TOC] https://segmentfault.com/a/1190000006125737 # 搭建VPN ## 安装gcc openswan xltpd 配置ipsec ~~~ sudo yum install gcc epel-release openswan -y ~~~ xl2tpd必须放在下面单独安装，因为CentOS原本的yum源里面是没有xl2tpd的，要安装epel后才有。 ~~~ sudo yum install xl2tpd -y ~~~ 安装完上面的东西后修改ipsec.conf配置文件 ~~~ sudo vim /etc/ipsec.conf ~~~ 配置文件的内容可以直接用下面的替换， 并用VPS实例的公网IP地址替换left=your.vps.ip.addr中的your.vps.ip.addr ~~~ # /etc/ipsec.conf - Libreswan IPsec configuration file #This file: /etc/ipsec.conf # # Enable when using this configuration file with openswan instead of libreswan version 2 # # Manual: ipsec.conf.5 # basic configuration config setup protostack=netkey virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12 nat_traversal=yes conn L2TP-PSK-NAT rightsubnet=vhost:%priv also=L2TP-PSK-noNAT conn L2TP-PSK-noNAT authby=secret pfs=no auto=add keyingtries=3 rekey=no ikelifetime=8h keylife=1h type=transport left=your.vps.ip.addr leftprotoport=17/1701 right=%any rightprotoport=17/%any ~~~ 接着修改ipsec.secrets配置文件，设置预共享密钥 ~~~ sudo vim /etc/ipsec.secrets ~~~ 配置文件的内容如下，用VPS实例的公网IP地址替换left=your.vps.ip.addr中的your.vps.ip.addr 用你自己设定的密码替换your.pre_shared_key ~~~ include /etc/ipsec.d/*.secrets your.vps.ip.addr %any: PSK "your.pre_shared_key" ~~~ 修改/etc/sysctl.conf配置文件,添加内容如下 ~~~ net.ipv4.ip_forward = 1 net.ipv4.conf.all.rp_filter = 0 net.ipv4.conf.default.rp_filter = 0 net.ipv4.conf.eth0.rp_filter = 0 net.ipv4.conf.eth1.rp_filter = 0 net.ipv4.conf.all.send_redirects = 0 net.ipv4.conf.default.send_redirects = 0 net.ipv4.conf.all.accept_redirects = 0 net.ipv4.conf.default.accept_redirects = 0 ~~~ 创建脚本并以管理员权限运行 ~~~ vim modify.sh ~~~ modify.sh中的内容如下 ~~~ for each in /proc/sys/net/ipv4/conf/* do echo 0 > $each/accept_redirects echo 0 > $each/send_redirects done ~~~ 保存并退出modify.sh, 执行modify.sh ~~~ sudo sh modify.sh ~~~ 此时再执行如下命令应该会看到输出一系列的0 ~~~ for each in /proc/sys/net/ipv4/conf/*; do cat $each/accept_redirects; cat $each/send_redirects; done ~~~ 重启ipsec ~~~ systemctl restart ipsec ==== AUTHENTICATING FOR org.freedesktop.systemd1.manage-units === Authentication is required to manage system services or units. Authenticating as: root Password: 输入root用户的密码 ==== AUTHENTICATION COMPLETE === ~~~ 检验ipsec的配置 ~~~ sudo ipsec verify ~~~ 此时系统的输出如果是这样就说明到此为止都是正确的 ~~~ Verifying installed system and configuration files Version check and ipsec on-path [OK] Libreswan 3.15 (netkey) on 3.10.0-327.28.3.el7.x86_64 Checking for IPsec support in kernel [OK] 　NETKEY: Testing XFRM related proc values 　　　　ICMP default/send_redirects [OK] 　　　　ICMP default/accept_redirects [OK] 　　　　XFRM larval drop [OK] Pluto ipsec.conf syntax [OK] Hardware random device [N/A] Two or more interfaces found, checking IP forwarding [OK] Checking rp_filter [OK] Checking that pluto is running [OK] Pluto listening for IKE on udp 500 [OK] Pluto listening for IKE/NAT-T on udp 4500 [OK] Pluto ipsec.secret syntax [OK] Checking 'ip' command [OK] Checking 'iptables' command [OK] Checking 'prelink' command does not interfere with FIPSChecking for obsolete > ipsec.conf options [OK] Opportunistic Encryption [DISABLED] ~~~ 如果看到下面这样的输出 ~~~ Checking rp_filter [ENABLED] /proc/sys/net/ipv4/conf/eth0/rp_filter [ENABLED] /proc/sys/net/ipv4/conf/eth1/rp_filter [ENABLED] ~~~ 那么就根据提供的路径，修改文件的内容为0 ~~~ sudo sh -c "echo 0 > /proc/sys/net/ipv4/conf/eth0/rp_filter" sudo sh -c "echo 0 > /proc/sys/net/ipv4/conf/eth1/rp_filter" ~~~ 重新检验ipsec的配置， 即可得到正确的输出 ~~~ sudo ipsec verify ~~~ 接着配置VPN登陆的账号和密码 ~~~ sudo vim /etc/ppp/chap-secrets ~~~ 内容如下, 替换your.account为你要设置的账号， 替换your.password为你要设置的密码 ~~~ # Secrets for authentication using CHAP # client server secret IP addresses your.account l2tpd your.password * ~~~ 到这里我们已经完成一部分了，可以测试一下到此为止是否一切顺利，我们通过客户端VPN连接测试是否正常，这里我使用windows系统的VPN功能进行测试。  保存配置并连接，此时还是连不上的，但是服务器端我们可以查看连接日志 ~~~ sudo vim /var/log/secure ~~~ 在打开的日志文件中搜索 ~~~ IPsec SA established ~~~ 或者 ~~~ IPSec connection established ~~~ 如果能搜索到这样的字样，则说明到此为止一切顺利 # 安装和配置xl2tpd 安装xl2tp ~~~ cd /use/src sudo wget http://downloads.sourceforge.net/project/rp-l2tp/rp-l2tp/0.4/rp-l2tp-0.4.tar.gz sudo tar zxf rp-l2tp-0.4.tar.gz cd rp-l2tp-0.4 sudo ./configure sudo make sudo make install sudo cp handlers/l2tp-control /usr/local/sbin/ sudo mkdir /var/run/xl2tpd/ sudo ln -s /usr/local/sbin/l2tp-control /var/run/xl2tpd/l2tp-control sudo yum install xl2tpd sudo vim /etc/xl2tpd/xl2tpd.conf ~~~ xl2tpd.conf中的内容如下, 其中x和y代表客户端的ip地址范围,不要将local ip的值包含在内 ~~~ [global] ipsec saref = yes [lns default] ip range = 10.0.10.x-10.0.10.y local ip = 10.0.10.1 refuse chap = yes refuse pap = yes require authentication = yes ppp debug = yes pppoptfile = /etc/ppp/options.xl2tpd length bit = yes ~~~ 编辑options.xl2tps ~~~ sudo vim /etc/ppp/options.xl2tpd ~~~ options.xl2tpd文件的内容如下, 其中ms-dns推荐使用Google的DNS ~~~ require-mschap-v2 ms-dns 8.8.8.8 ms-dns 8.8.4.4 asyncmap 0 auth crtscts lock hide-password debug name l2tpd proxyarp lcp-echo-interval 30 lcp-echo-failure 4 noccp connect-delay 5000 ~~~ 防火墙开启端口 ~~~ sudo vim /usr/lib/firewalld/services/l2tpd.xml ~~~ 文件内容如下 ~~~ <?xml version="1.0" encoding="utf-8"?> <service> <short>l2tpd</short> <description>L2TP IPSec</description> <port protocol="udp" port="500"/> <port protocol="udp" port="4500"/> <port protocol="udp" port="1701"/> </service> ~~~ 设置并重启防火墙 ~~~ sudo firewall-cmd --reload sudo firewall-cmd --permanent --add-service=l2tpd sudo firewall-cmd --permanent --add-service=ipsec sudo firewall-cmd --permanent --add-masquerade sudo firewall-cmd --permanent --direct --add-rule ipv4 filter FORWARD 0 -p tcp -i ppp+ -j TCPMSS --syn --set-mss 1356 sudo firewall-cmd --reload ~~~ 现在以debug模式启动xl2tpd ~~~ sudo xl2tpd -D ~~~ 此时可以在控制台看到输出，客户端再次连接VPN，就可以连接上并访问网络了, 百度搜索ip会显示你的IP地址为你VPS实例的IP地址。 如果一切都正常，就设置开机自启 ~~~ systemctl enable ipsec xl2tpd systemctl restart ipsec xl2tpd ~~~ # 流量监控 如果想要统计CentOS的流量适用情况， 推荐使用vnstat ~~~ sudo yum install vnstat 然后创建要统计的网卡的数据库 sudo vnstat --create -i eth0 Creating database for interface "eth0"... Info: -> A new database has been created. Restart the vnStat daemon if it is currently running in order to start monitoring "eth0". 可以看到eth0网卡的数据库已经建立， 可以通过一下命令获取统计结果 vnstat // 输出本月和本日的统计信息 vnstat -l //显示实时网络状态 vnstat --help //查看vnstat所有支持参数 可以通过修改配置文件来修改写入数据库的频率和显示时的流量单位 sudo vim /etc/ ~~~ 修改UnitMode 0为UnitMode 1， 就会以KB/MB/GB/TB为单位。 # 一键安装 https://teddysun.com/448.html/comment-page-21 root 用户登录后，运行以下命令： ~~~ wget --no-check-certificate https://raw.githubusercontent.com/teddysun/across/master/l2tp.sh chmod +x l2tp.sh ./l2tp.sh ~~~