建站
咨詢
售后
建站咨詢
新聞中心
這里有您想知道的互聯(lián)網(wǎng)營(yíng)銷解決方案
CentOS7部署L2TP
l2tp是一種工業(yè)標(biāo)準(zhǔn)的Internet隧道協(xié)議，功能大致和PPTP協(xié)議類似，比如同樣可以對(duì)網(wǎng)絡(luò)數(shù)據(jù)流進(jìn)行加密。為眾多公司所接受，已經(jīng)成為IETF有關(guān)2層通道協(xié)議的工業(yè)標(biāo)準(zhǔn)，此協(xié)議基于微軟的點(diǎn)對(duì)點(diǎn)隧道協(xié)議(PPTP)和思科2層轉(zhuǎn)發(fā)協(xié)議(L2F)之上，這種虛擬私有網(wǎng)絡(luò)可以被因特網(wǎng)服務(wù)提供商和公司通過(guò)因特網(wǎng)使用。
目前創(chuàng)新互聯(lián)已為1000+的企業(yè)提供了網(wǎng)站建設(shè)、域名、雅安服務(wù)器托管、網(wǎng)站托管、服務(wù)器租用、企業(yè)網(wǎng)站設(shè)計(jì)、中衛(wèi)網(wǎng)站維護(hù)等服務(wù)，公司將堅(jiān)持客戶導(dǎo)向、應(yīng)用為本的策略，正道將秉承"和諧、參與、激情"的文化，與客戶和合作伙伴齊心協(xié)力一起成長(zhǎng)，共同發(fā)展。
1.先看看你的主機(jī)是否支持pptp，返回結(jié)果為yes就表示通過(guò)
modprobe ppp-compress-18 && echo yes
2.是否開(kāi)啟了TUN
有的虛擬機(jī)主機(jī)需要開(kāi)啟，返回結(jié)果為cat: /dev/net/tun: File descriptor in bad state。就表示通過(guò)。
cat /dev/net/tun
3.更新一下再安裝
yum install update
yum update -y
4.安裝EPEL源
yum install -y epel-release
5.安裝xl2tpd和libreswan
yum install -y xl2tpd libreswan lsof
6.編輯xl2tpd配置文件
vim /etc/xl2tpd/xl2tpd.conf
修改內(nèi)容如下：
[global]
[lns default]
ip range = 172.100.1.100-172.100.1.150 #分配給客戶端的地址池
local ip = 172.100.1.1
require chap = yes
refuse pap = yes
require authentication = yes
name = LinuxVPNserver
ppp debug = yes
pppoptfile = /etc/ppp/options.xl2tpd
length bit = yes
7.編輯pppoptfile文件
vim /etc/ppp/options.xl2tpd
修改內(nèi)容如下：
ipcp-accept-local
ipcp-accept-remote
ms-dns 8.8.8.8
ms-dns 209.244.0.3
ms-dns 208.67.222.222
name xl2tpd
#noccp
auth
crtscts
idle 1800
mtu 1410 #第一次配置不建議設(shè)置mtu，mru，否則可能789錯(cuò)誤
mru 1410
nodefaultroute
debug
lock
proxyarp
connect-delay 5000
refuse-pap
refuse-chap
refuse-mschap
require-mschap-v2
persist
logfile /var/log/xl2tpd.log
8.編輯ipsec配置文件
vim /etc/ipsec.conf
config setup
protostack=netkey
dumpdir=/var/run/pluto/
virtual_private=%v4:10.0.0.0/8,%v4:172.100.0.0/12,%v4:25.0.0.0/8,%v4:100.64.0.0/10,%v6:fd00::/8,%v6:fe80::/10
include /etc/ipsec.d/*.conf
9.編輯include的conn文件
vim /etc/ipsec.d/l2tp-ipsec.conf
修改內(nèi)容如下：
conn L2TP-PSK-NAT
rightsubnet=0.0.0.0/0
dpddelay=10
dpdtimeout=20
dpdaction=clear
forceencaps=yes
also=L2TP-PSK-noNAT
conn L2TP-PSK-noNAT
authby=secret
pfs=no
auto=add
keyingtries=3
rekey=no
ikelifetime=8h
keylife=1h
type=transport
left=192.168.0.17 #service/VPS的外網(wǎng)地址，某些vps只有eth0一塊網(wǎng)卡的，
#就填內(nèi)網(wǎng)地址，內(nèi)核開(kāi)啟nat轉(zhuǎn)發(fā)就可以了，
#CentOS7以下的用iptables定義轉(zhuǎn)發(fā)規(guī)則
leftprotoport=17/1701
right=%any
rightprotoport=17/%any
10.設(shè)置用戶名密碼
vim /etc/ppp/chap-secrets
修改內(nèi)容：
vpnuser * pass *
說(shuō)明：用戶名[空格]service[空格]密碼[空格]指定IP
11.設(shè)置PSK
vim /etc/ipsec.d/default.secrets
: PSK "testvpn"
12.CentOS7防火墻設(shè)置
firewall-cmd --permanent --add-service=ipsec
firewall-cmd --permanent --add-port=1701/udp
firewall-cmd --permanent --add-port=4500/udp
firewall-cmd --permanent --add-masquerade
firewall-cmd --reload
13.IP_FORWARD 設(shè)置
vim /etc/sysctl.d/60-sysctl_ipsec.conf
net.ipv4.ip_forward = 1
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.rp_filter = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv4.conf.default.rp_filter = 0
net.ipv4.conf.default.send_redirects = 0
net.ipv4.conf.eth0.accept_redirects = 0
net.ipv4.conf.eth0.rp_filter = 0
net.ipv4.conf.eth0.send_redirects = 0
net.ipv4.conf.eth1.accept_redirects = 0
net.ipv4.conf.eth1.rp_filter = 0
net.ipv4.conf.eth1.send_redirects = 0
net.ipv4.conf.eth2.accept_redirects = 0
net.ipv4.conf.eth2.rp_filter = 0
net.ipv4.conf.eth2.send_redirects = 0
net.ipv4.conf.ip_vti0.accept_redirects = 0
net.ipv4.conf.ip_vti0.rp_filter = 0
net.ipv4.conf.ip_vti0.send_redirects = 0
net.ipv4.conf.lo.accept_redirects = 0
net.ipv4.conf.lo.rp_filter = 0
net.ipv4.conf.lo.send_redirects = 0
net.ipv4.conf.ppp0.accept_redirects = 0
net.ipv4.conf.ppp0.rp_filter = 0
net.ipv4.conf.ppp0.send_redirects = 0
重啟生效
systemctl restart network
13.ipsec啟動(dòng)&檢查
systemctl enable ipsec
systemctl restart ipsec
檢查：ipsec verify
正常輸出：
Verifying installed system and configuration files
Version check and ipsec on-path [OK]
Libreswan 3.15 (netkey) on 3.10.0-123.13.2.el7.x86_64
Checking for IPsec support in kernel [OK]
NETKEY: Testing XFRM related proc values
ICMP default/send_redirects [OK]
ICMP default/accept_redirects [OK]
XFRM larval drop [OK]
Pluto ipsec.conf syntax [OK]
Hardware random device [N/A]
Two or more interfaces found, checking IP forwarding [OK]
Checking rp_filter [OK]
Checking that pluto is running [OK]
Pluto listening for IKE on udp 500 [OK]
Pluto listening for IKE/NAT-T on udp 4500 [OK]
Pluto ipsec.secret syntax [OK]
Checking 'ip' command [OK]
Checking 'iptables' command [OK]
Checking 'prelink' command does not interfere with FIPSChecking for obsolete ipsec.conf options [OK]
Opportunistic Encryption [DISABLED]
14.xl2tpd啟動(dòng)
systemctl enable xl2tpd
systemctl restart xl2tpd
15.Windows連接
Windows連接，需要修改注冊(cè)表鍵值（據(jù)說(shuō)可以不用修改，但是我的不修改的話，一直789，log無(wú)顯示）
當(dāng)前題目：CentOS7部署L2TP
文章轉(zhuǎn)載：http://fisionsoft.com.cn/article/cdhcseo.html
