CentOS安装L2TP VPN笔记

发表于 更新于 分类于

换了个新vps,之前一直用pptp和openvpn,这次准备尝试下l2tp,记录下安装过程.

安装ipsec:

1
2
3
4
5
yum remove -y openswan
wget https://download.openswan.org/openswan//old/openswan-2.6/openswan-2.6.24.tar.gz
tar zxvf openswan-2.6.24.tar.gz
cd openswan-2.6.24
make programs install

安装必须的模块:

1
yum install ppp iptables libpcap-devel

配置ipsec:

1
2
3
4
5
6
rm -rf /etc/ipsec.conf
touch /etc/ipsec.conf
cat >>/etc/ipsec.conf $each/accept_redirects
echo 0 > $each/send_redirects
done
iptables -t nat -A POSTROUTING -j MASQUERADE

验证ipsec配置:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
/etc/init.d/ipsec restart
ipsec verify
Checking your system to see if IPsec got installed and started correctly:
Version check and ipsec on-path [OK]
Linux Openswan U2.6.24/K2.6.32-71.29.1.el6.i686 (netkey)
Checking for IPsec support in kernel [OK]
NETKEY detected, testing for disabled ICMP send_redirects [OK]
NETKEY detected, testing for disabled ICMP accept_redirects [OK]
Checking for RSA private key (/etc/ipsec.secrets) [OK]
Checking that pluto is running [OK]
Pluto listening for IKE on udp 500 [OK]
Pluto listening for NAT-T on udp 4500 [OK]
Two or more interfaces found, checking IP forwarding [OK]
Checking NAT and MASQUERADEing [N/A]
Checking for 'ip' command [OK]
Checking for 'iptables' command [OK]
Opportunistic Encryption Support [DISABLED]

安装x2ltpd:

1
2
3
4
5
6
wget http://www.xelerance.com/wp-content/uploads/software/xl2tpd/xl2tpd-1.3.0.tar.gz
tar xvf xl2tpd-1.3.0.tar.gz
make install
mkdir /var/run/xl2tpd
ln -s /usr/local/sbin/l2tp-control /var/run/xl2tpd/l2tp-control
mkdir /etc/xl2tpd

配置xl2tpd:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
vi /etc/xl2tpd/xl2tpd.conf

[global]
listen-addr = $your_vps_ip #替换成你的vpsip
ipsec saref = yes
[lns default]
ip range = 192.168.30.10-192.168.30.20
local ip = 192.168.30.1
require chap = yes
refuse pap = yes
require authentication = yes
ppp debug = yes
pppoptfile = /etc/ppp/options.xl2tpd
length bit = yes

vi /etc/ppp/options.xl2tpd

require-mschap-v2
ipcp-accept-local
ipcp-accept-remote
ms-dns 8.8.8.8
ms-dns 8.8.4.4
asyncmap 0
noccp
auth
crtscts
hide-password
debug
modem
lock
proxyarp
name l2tpd
#lcp-echo-interval 30
#lcp-echo-failure 4

配置用户和密码:

1
2
3
4
5
vi /etc/ppp/chap-secrets

# Secrets for authentication using CHAP
# client server secret IP addresses
name * password *

配置转发规则:

1
2
iptables -t nat -A POSTROUTING -s 192.168.30.0/24 -o eth0 -j MASQUERADE
iptables -t nat -A POSTROUTING -s 192.168.30.0/24 -j SNAT --to-source $your_vps_ip

启动xl2tp:

1
xl2tpd -D &

现在应该已经正常运行了,可以在你的手机或者电脑上新建一个l2tp连接测试. 自启动配置: 为了保证每次vps重启后都正常启动l2tp服务,我们还需做下面操作:

1
2
3
4
5
iptables-save > /etc/iptables
echo "iptables-restore /etc/iptables" >> /etc/rc.local
echo "/usr/local/sbin/xl2tpd -D &" >> /etc/rc.local
chkconfig --add ipsec
chkconfig --level 2345 ipsec on