前段时间买了个linode vps，已经搭建了shadowsocks翻墙，感觉只弄这个太亏了， 毕竟linode白花花的银子在流淌着呀，所以必须搭建个L2TP server以进一步利用VPS。
第一步：准备工作
首先的首先，给系统的软件都升一下级:
yum update
再来，安装下面需要的软件，和编辑和编译环境相关的，都装上吧，下面有些在安装时会用到，比如lsof之类。
yum install -y make gcc gmp-devel xmlto bison flex xmlto libpcap-devel lsof vim-enhanced man
第二步：安装
下面正式开始安装l2tp VPN
yum install openswan ppp xl2tpd
如果找不到的软件，那么可以去http://pkgs.org/找rpm包。比如xl2tpd我就找不到，去pkgs.org就可以搜到：
CentOS 6
Atomic:
xl2tpd-1.2.7-1.el6.art.i686.rpm
Layer 2 Tunnelling Protocol Daemon (RFC 2661)
xl2tpd-1.2.7-1.el6.art.x86_64.rpm
Layer 2 Tunnelling Protocol Daemon (RFC 2661)
EPEL:
xl2tpd-1.3.1-7.el6.i686.rpm
Layer 2 Tunnelling Protocol Daemon (RFC 2661)
xl2tpd-1.3.1-7.el6.x86_64.rpm
Layer 2 Tunnelling Protocol Daemon (RFC 2661)
根据自己的系统是i686还是x86_64找个对应的最新的xl2tpd-1.3.1-7下下来安装。其他包找不到同理一样做。都要找最新的！
yum install xl2tpd-1.3.1-7.el6.x86_64.rpm
第三步：配置
1. 编辑 /etc/ipsec.conf
vim /etc/ipsec.conf
把下面xx.xxx.xxx.xxx换成你自己VPS实际的外网固定IP。其他的不动。
config setup
nat_traversal=yes
virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12
oe=off
protostack=netkey
conn L2TP-PSK-NAT
rightsubnet=vhost:%priv
also=L2TP-PSK-noNAT
conn L2TP-PSK-noNAT
authby=secret
pfs=no
auto=add
keyingtries=3
rekey=no
ikelifetime=8h
keylife=1h
type=transport
left=xxx.xxx.xxx.xxx
leftprotoport=17/1701
right=%any
rightprotoport=17/%any
2. 编辑/etc/ipsec.secrets
vim /etc/ipsec.secrets
xxx.xxx.xxx.xxx %any: PSK "YourPsk"
xx.xxx.xxx.xxx换成你自己VPS实际的外网固定IP, YourPsk你自己定一个，到时候连VPN的时候可以用，比如可以填csdn.net
注意空格。
3. 修改/添加 /etc/sysctl.conf
vim /etc/sysctl.conf
确保下面的字段都有，对应的值或下面一样。省事的话直接在/etc/sysctl.conf的末尾直接把下面内容的粘过去。
net.ipv4.ip_forward = 1
net.ipv4.conf.default.rp_filter = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0
net.ipv4.conf.all.log_martians = 0
net.ipv4.conf.default.log_martians = 0
net.ipv4.conf.default.accept_source_route = 0
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv4.icmp_ignore_bogus_error_responses = 1
4.让修改后的sysctl.conf生效
sysctl -p
可能会有一些ipv6的错误，不用管他, 还好linode支持ipv6，没报下面的错误。
error: "net.bridge.bridge-nf-call-ip6tables" is an unknown key
error: "net.bridge.bridge-nf-call-iptables" is an unknown key
error: "net.bridge.bridge-nf-call-arptables" is an unknown key
5. 验证ipsec运行状态
ipsec setup restart
ipsec verify
verify的内容如下所示，那么就离成功不远了。
Checking your system to see if IPsec got installed and started correctly:
Version check and ipsec on-path [OK]
Linux Openswan U2.6.32/K2.6.32-431.11.2.el6.i686 (netkey)
Checking for IPsec support in kernel [OK]
SAref kernel support [N/A]
NETKEY: Testing for disabled ICMP send_redirects [OK]
NETKEY detected, testing for disabled ICMP accept_redirects [OK]
Checking that pluto is running [OK]
Pluto listening for IKE on udp 500 [OK]
Pluto listening for NAT-T on udp 4500 [OK]
Checking for 'ip' command [OK]
Checking /bin/sh is not /bin/dash [OK]
Checking for 'iptables' command [OK]
Opportunistic Encryption Support [DISABLED]
如果有问题，你就得上网搜解决办法，否则下面进行不下去。比如有时你得把selinux关掉
把SELINUX设置成disabled，然后reboot一下机器就生效了。
vim /etc/sysconfig/selinux
SELINUX=disabled
6. 编辑 /etc/xl2tpd/xl2tpd.conf
vim /etc/xl2tpd/xl2tpd.conf
[global]
ipsec saref = yes
listen-addr = xxx.xxx.xxx.xxx ;服务器地址
[lns default]
ip range = 192.168.1.2-192.168.1.100 ;这里是VPN client的内网ip地址范围
local ip = 192.168.1.1 ;这里是VPN server的内网地址
refuse chap = yes
refuse pap = yes
require authentication = yes
ppp debug = yes
pppoptfile = /etc/ppp/options.xl2tpd
length bit = yes
7. 编辑 /etc/ppp/options.xl2tpd
vim /etc/ppp/options.xl2tpd
require-mschap-v2
ms-dns 8.8.8.8
ms-dns 8.8.4.4
asyncmap 0
auth
crtscts
lock
hide-password
modem
debug
name l2tpd
proxyarp
lcp-echo-interval 30
lcp-echo-failure 4
8。 配置用户名,密码:编辑 /etc/ppp/chap-secrets
vim /etc/ppp/chap-secrets
client和secret自己填，server和IP留*号，
# Secrets for authentication using CHAP
# client server secret IP addresses
username * userpass *
9. 重启xl2tp
service xl2tpd restart
10. 开放端口以及转发
原样执行下面所有命令，
#Allow ipsec traffic
iptables -A INPUT -m policy --dir in --pol ipsec -j ACCEPT
iptables -A FORWARD -m policy --dir in --pol ipsec -j ACCEPT
#Do not NAT VPN traffic
iptables -t nat -A POSTROUTING -m policy --dir out --pol none -j MASQUERADE
#Forwarding rules for VPN
iptables -A FORWARD -i ppp+ -p all -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
#Ports for Openswan / xl2tpd
iptables -A INPUT -m policy --dir in --pol ipsec -p udp --dport 1701 -j ACCEPT
iptables -A INPUT -p udp --dport 500 -j ACCEPT
iptables -A INPUT -p udp --dport 4500 -j ACCEPT
iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -o eth0 -j MASQUERADE
再执行下面保存iptables
service iptables save
service iptables restart
11. 添加自启动
chkconfig xl2tpd on
chkconfig iptables on
chkconfig ipsec on
12. 重启
reboot
完成！回头再来写一个一键安装脚本。
调试：
连不上的时候先关闭iptables来调试。
service iptables stop
确定能连上以后再打开iptables
service iptables start
如果这时连不上了，那么就是iptables的问题了
特别注意iptables里的顺序， INPUT和FORWARD里的REJECT一定是写在最后面，否则写在他们之后的port就都被REJECT了！
下面是我自己的iptables，可供参考
*nat
:PREROUTING ACCEPT [82:15507]
:POSTROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [6:447]
-A POSTROUTING -m policy --dir out --pol none -j MASQUERADE
COMMIT
# Completed on Fri Apr 4 05:44:30 2014
# Generated by iptables-save v1.4.7 on Fri Apr 4 05:44:30 2014
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [490:286471]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -m policy --dir in --pol ipsec -j ACCEPT
-A INPUT -p udp -m policy --dir in --pol ipsec -m udp --dport 1701 -j ACCEPT
-A INPUT -p udp -m udp --dport 500 -j ACCEPT
-A INPUT -p udp -m udp --dport 4500 -j ACCEPT
-A INPUT -p esp -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -m policy --dir in --pol ipsec -j ACCEPT
-A FORWARD -i ppp+ -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT
--------------------------------------------------------------------------------------------------------------
FAQs
错误1:
SAref kernel support [N/A]
/etc/xl2tpd/xl2tpd.conf这个文件里
[global]
ipsec saref = no
Linux Openswan U2.6.38/K2.6.18-308.el5 (netkey)
以netkey方式运行不支持局域网多个nat客户;
开启SAref kernel support后以klips方式运行支持
错误2:
Two or more interfaces found, checking IP forwarding
修改ip_forward,只要 cat /proc/sys/net/ipv4/ip_forward 返回结果是1就没事
echo 1 >/proc/sys/net/ipv4/ip_forward
错误3:
Please enable /proc/sys/net/core/xfrm_larval_drop
echo 1 > /proc/sys/net/core/xfrm_larval_drop
错误4:
缺少rngd服务
重新安装rngd
yum -y install rng-tools
但是尝试用service rngd start启动后提示
Starting rngd: can't open entropy source(tpm or intel/amd rng)
Maybe RNG device modules are not loaded
解决方法：
vi /etc/sysconfig/rngd
EXTRAOPTIONS="-r /dev/urandom"
sudo reboot
service rngd start
