Centos上搭建基于L2TP的VPN_linux教程_开发教程

1.一些预先准备的环境

yum install -y make gcc gmp-devel xmlto bison flex xmlto libpcap-devel lsof vim-enhanced man

复制代码

2.安装

yum install openswan ppp xl2tpd

复制代码

3.配置

（1）编辑 /etc/ipsec.conf

vi /etc/ipsec.conf

复制代码

替换为如下内容，把下面0.0.0.0换成腾讯云服务器的外网IP，其他的不用修改。

注意：第一行两个**的地方是s e t u（自行更改，字母之间无空格）

config **p

nat_traversal=yes

virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12

oe=off

protostack=netkey

conn L2TP-PSK-NAT

rightsubnet=vhost:%priv

also=L2TP-PSK-noNAT

conn L2TP-PSK-noNAT

authby=secret

pfs=no

auto=add

keyingtries=3

rekey=no

ikelifetime=8h

keylife=1h

type=transport

left=0.0.0.0

leftprotoport=17/1701

right=%any

rightprotoport=17/%any

复制代码

（2）编辑/etc/ipsec.secrets

vi /etc/ipsec.secrets

include /etc/ipsec.d/*.secrets

0.0.0.0 %any: PSK "YourPsk"

复制代码

0.0.0.0换成腾讯云服务器的外网IP, YourPsk你自己定一个。

（3）修改/添加 /etc/sysctl.conf并生效

vim /etc/sysctl.conf

复制代码

在/etc/sysctl.conf的末尾加上如下内容。

net.ipv4.ip_forward = 1

net.ipv4.conf.default.rp_filter = 0

net.ipv4.conf.all.send_redirects = 0

net.ipv4.conf.default.send_redirects = 0

net.ipv4.conf.all.log_martians = 0

net.ipv4.conf.default.log_martians = 0

net.ipv4.conf.default.accept_source_route = 0

net.ipv4.conf.all.accept_redirects = 0

net.ipv4.conf.default.accept_redirects = 0

net.ipv4.icmp_ignore_bogus_error_responses = 1

复制代码

生效上面的修改使用如下命令

sysctl -p

复制代码

（4）验证ipsec运行状态

ipsec restart

ipsec verify

复制代码

如果出现如下内容，说明已经成功

Checking your system to see if IPsec got installed and started correctly:

Version check and ipsec on-path [OK]

Linux Openswan U2.6.32/K2.6.32-431.20.3.0.1.el6.centos.plus.x86_64 (netkey)

Checking for IPsec support in kernel [OK]

SAref kernel support [N/A]

NETKEY: Testing for disabled ICMP send_redirects [OK]

NETKEY detected, testing for disabled ICMP accept_redirects [OK]

Checking that pluto is running [OK]

Pluto listening for IKE on udp 500 [OK]

Pluto listening for NAT-T on udp 4500 [OK]

Checking for 'ip' command [OK]

Checking /bin/sh is not /bin/dash [OK]

Checking for 'iptables' command [OK]

Opportunistic Encryption Support [DISABLED]

复制代码

（5）编辑 /etc/xl2tpd/xl2tpd.conf 这一步可以跳过

ip range 写客户端的内网IP段，local ip写客户端内网IP

vim /etc/xl2tpd/xl2tpd.conf

[lns default]

ip range = 10.3.154.192-10.3.154.254

local ip = 10.3.154.202

require chap = yes

refuse pap = yes

require authentication = yes

name = LinuxVPNserver

ppp debug = yes

pppoptfile = /etc/ppp/options.xl2tpd

length bit = yes

复制代码

（6）配置用户名,密码:编辑 /etc/ppp/chap-secrets

vim /etc/ppp/chap-secrets

复制代码

username 写登录vpn的用户名，userpass 写登录vpn的密码

# Secrets for authentication using CHAP

# client server secret IP addresses

username * "userpass" *

复制代码

（7）重启xl2tp

service xl2tpd restart

复制代码

（8）添加自启动

chkconfig xl2tpd on

chkconfig iptables on

chkconfig ipsec on

复制代码

接下来就是你通过电脑连接vpn

首先，需要修改注册表regedit

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Services/RasMan/Parameters]

ProhibitIPSec的值修改为1

如果没有ProhibitIPSec项，需要点击右键新建dword，重命名为ProhibitIPSec，值设置为1

其次，重启你的本地电脑（必须重启哦）

(责任编辑：好模板)