\u524d\u6bb5\u65f6\u95f4\u4e70\u4e86\u4e2alinode vps\uff0c\u5df2\u7ecf\u642d\u5efa\u4e86shadowsocks\u7ffb\u5899\uff0c\u611f\u89c9\u53ea\u5f04\u8fd9\u4e2a\u592a\u4e8f\u4e86\uff0c \u6bd5\u7adflinode\u767d\u82b1\u82b1\u7684\u94f6\u5b50\u5728\u6d41\u6dcc\u7740\u5440\uff0c\u6240\u4ee5\u5fc5\u987b\u642d\u5efa\u4e2aL2TP server\u4ee5\u8fdb\u4e00\u6b65\u5229\u7528VPS\u3002<\/p>\n
\u7b2c\u4e00\u6b65\uff1a\u51c6\u5907\u5de5\u4f5c
\n\u9996\u5148\u7684\u9996\u5148\uff0c\u7ed9\u7cfb\u7edf\u7684\u8f6f\u4ef6\u90fd\u5347\u4e00\u4e0b\u7ea7:<\/p>\n
yum update
\n\u518d\u6765\uff0c\u5b89\u88c5\u4e0b\u9762\u9700\u8981\u7684\u8f6f\u4ef6\uff0c\u548c\u7f16\u8f91\u548c\u7f16\u8bd1\u73af\u5883\u76f8\u5173\u7684\uff0c\u90fd\u88c5\u4e0a\u5427\uff0c\u4e0b\u9762\u6709\u4e9b\u5728\u5b89\u88c5\u65f6\u4f1a\u7528\u5230\uff0c\u6bd4\u5982lsof\u4e4b\u7c7b\u3002
\nyum install -y make gcc gmp-devel xmlto bison flex xmlto libpcap-devel lsof vim-enhanced man
\n\u7b2c\u4e8c\u6b65\uff1a\u5b89\u88c5<\/p>\n
\u4e0b\u9762\u6b63\u5f0f\u5f00\u59cb\u5b89\u88c5l2tp VPN
\nyum install openswan ppp xl2tpd
\n\u5982\u679c\u627e\u4e0d\u5230\u7684\u8f6f\u4ef6\uff0c\u90a3\u4e48\u53ef\u4ee5\u53bbhttp:\/\/pkgs.org\/\u627erpm\u5305\u3002\u6bd4\u5982xl2tpd\u6211\u5c31\u627e\u4e0d\u5230\uff0c\u53bbpkgs.org\u5c31\u53ef\u4ee5\u641c\u5230\uff1a
\nCentOS 6
\nAtomic:
\nxl2tpd-1.2.7-1.el6.art.i686.rpm
\nLayer 2 Tunnelling Protocol Daemon (RFC 2661)
\nxl2tpd-1.2.7-1.el6.art.x86_64.rpm
\nLayer 2 Tunnelling Protocol Daemon (RFC 2661)
\nEPEL:
\nxl2tpd-1.3.1-7.el6.i686.rpm
\nLayer 2 Tunnelling Protocol Daemon (RFC 2661)
\nxl2tpd-1.3.1-7.el6.x86_64.rpm
\nLayer 2 Tunnelling Protocol Daemon (RFC 2661)
\n\u6839\u636e\u81ea\u5df1\u7684\u7cfb\u7edf\u662fi686\u8fd8\u662fx86_64\u627e\u4e2a\u5bf9\u5e94\u7684\u6700\u65b0\u7684xl2tpd-1.3.1-7\u4e0b\u4e0b\u6765\u5b89\u88c5\u3002\u5176\u4ed6\u5305\u627e\u4e0d\u5230\u540c\u7406\u4e00\u6837\u505a\u3002\u90fd\u8981\u627e\u6700\u65b0\u7684\uff01
\nyum install xl2tpd-1.3.1-7.el6.x86_64.rpm
\n\u7b2c\u4e09\u6b65\uff1a\u914d\u7f6e
\n1. \u7f16\u8f91 \/etc\/ipsec.conf<\/p>\n
vim \/etc\/ipsec.conf
\n\u628a\u4e0b\u9762xx.xxx.xxx.xxx\u6362\u6210\u4f60\u81ea\u5df1VPS\u5b9e\u9645\u7684\u5916\u7f51\u56fa\u5b9aIP\u3002\u5176\u4ed6\u7684\u4e0d\u52a8\u3002
\nconfig setup
\nnat_traversal=yes
\nvirtual_private=%v4:10.0.0.0\/8,%v4:192.168.0.0\/16,%v4:172.16.0.0\/12
\noe=off
\nprotostack=netkey<\/p>\n
conn L2TP-PSK-NAT
\nrightsubnet=vhost:%priv
\nalso=L2TP-PSK-noNAT<\/p>\n
conn L2TP-PSK-noNAT
\nauthby=secret
\npfs=no
\nauto=add
\nkeyingtries=3
\nrekey=no
\nikelifetime=8h
\nkeylife=1h
\ntype=transport
\nleft=xxx.xxx.xxx.xxx
\nleftprotoport=17\/1701
\nright=%any
\nrightprotoport=17\/%any<\/p>\n
2. \u7f16\u8f91\/etc\/ipsec.secrets
\nvim \/etc\/ipsec.secrets
\nxxx.xxx.xxx.xxx %any: PSK \"YourPsk\"
\nxx.xxx.xxx.xxx\u6362\u6210\u4f60\u81ea\u5df1VPS\u5b9e\u9645\u7684\u5916\u7f51\u56fa\u5b9aIP, YourPsk\u4f60\u81ea\u5df1\u5b9a\u4e00\u4e2a\uff0c\u5230\u65f6\u5019\u8fdeVPN\u7684\u65f6\u5019\u53ef\u4ee5\u7528\uff0c\u6bd4\u5982\u53ef\u4ee5\u586bcsdn.net
\n\u6ce8\u610f\u7a7a\u683c\u3002<\/p>\n
3. \u4fee\u6539\/\u6dfb\u52a0 \/etc\/sysctl.conf<\/p>\n
vim \/etc\/sysctl.conf
\n\u786e\u4fdd\u4e0b\u9762\u7684\u5b57\u6bb5\u90fd\u6709\uff0c\u5bf9\u5e94\u7684\u503c\u6216\u4e0b\u9762\u4e00\u6837\u3002\u7701\u4e8b\u7684\u8bdd\u76f4\u63a5\u5728\/etc\/sysctl.conf\u7684\u672b\u5c3e\u76f4\u63a5\u628a\u4e0b\u9762\u5185\u5bb9\u7684\u7c98\u8fc7\u53bb\u3002<\/p>\n
net.ipv4.ip_forward = 1
\nnet.ipv4.conf.default.rp_filter = 0
\nnet.ipv4.conf.all.send_redirects = 0
\nnet.ipv4.conf.default.send_redirects = 0
\nnet.ipv4.conf.all.log_martians = 0
\nnet.ipv4.conf.default.log_martians = 0
\nnet.ipv4.conf.default.accept_source_route = 0
\nnet.ipv4.conf.all.accept_redirects = 0
\nnet.ipv4.conf.default.accept_redirects = 0
\nnet.ipv4.icmp_ignore_bogus_error_responses = 1<\/p>\n
4.\u8ba9\u4fee\u6539\u540e\u7684sysctl.conf\u751f\u6548
\nsysctl -p
\n\u53ef\u80fd\u4f1a\u6709\u4e00\u4e9bipv6\u7684\u9519\u8bef\uff0c\u4e0d\u7528\u7ba1\u4ed6, \u8fd8\u597dlinode\u652f\u6301ipv6\uff0c\u6ca1\u62a5\u4e0b\u9762\u7684\u9519\u8bef\u3002<\/p>\n
error: \"net.bridge.bridge-nf-call-ip6tables\" is an unknown key<\/p>\n
error: \"net.bridge.bridge-nf-call-iptables\" is an unknown key
\nerror: \"net.bridge.bridge-nf-call-arptables\" is an unknown key<\/p>\n
5. \u9a8c\u8bc1ipsec\u8fd0\u884c\u72b6\u6001
\nipsec setup restart
\nipsec verify<\/p>\n
verify\u7684\u5185\u5bb9\u5982\u4e0b\u6240\u793a\uff0c\u90a3\u4e48\u5c31\u79bb\u6210\u529f\u4e0d\u8fdc\u4e86\u3002
\nChecking your system to see if IPsec got installed and started correctly:
\nVersion check and ipsec on-path [OK]
\nLinux Openswan U2.6.32\/K2.6.32-431.11.2.el6.i686 (netkey)
\nChecking for IPsec support in kernel [OK]
\nSAref kernel support [N\/A]
\nNETKEY: Testing for disabled ICMP send_redirects [OK]
\nNETKEY detected, testing for disabled ICMP accept_redirects [OK]
\nChecking that pluto is running [OK]
\nPluto listening for IKE on udp 500 [OK]
\nPluto listening for NAT-T on udp 4500 [OK]
\nChecking for 'ip' command [OK]
\nChecking \/bin\/sh is not \/bin\/dash [OK]
\nChecking for 'iptables' command [OK]
\nOpportunistic Encryption Support [DISABLED]
\n\u5982\u679c\u6709\u95ee\u9898\uff0c\u4f60\u5c31\u5f97\u4e0a\u7f51\u641c\u89e3\u51b3\u529e\u6cd5\uff0c\u5426\u5219\u4e0b\u9762\u8fdb\u884c\u4e0d\u4e0b\u53bb\u3002\u6bd4\u5982\u6709\u65f6\u4f60\u5f97\u628aselinux\u5173\u6389
\n\u628aSELINUX\u8bbe\u7f6e\u6210disabled\uff0c\u7136\u540ereboot\u4e00\u4e0b\u673a\u5668\u5c31\u751f\u6548\u4e86\u3002
\nvim \/etc\/sysconfig\/selinux
\nSELINUX=disabled
\n6. \u7f16\u8f91 \/etc\/xl2tpd\/xl2tpd.conf
\nvim \/etc\/xl2tpd\/xl2tpd.conf
\n[global]
\nipsec saref = yes
\nlisten-addr = xxx.xxx.xxx.xxx ;\u670d\u52a1\u5668\u5730\u5740
\n[lns default]
\nip range = 192.168.1.2-192.168.1.100 ;\u8fd9\u91cc\u662fVPN client\u7684\u5185\u7f51ip\u5730\u5740\u8303\u56f4
\nlocal ip = 192.168.1.1 ;\u8fd9\u91cc\u662fVPN server\u7684\u5185\u7f51\u5730\u5740
\nrefuse chap = yes
\nrefuse pap = yes
\nrequire authentication = yes
\nppp debug = yes
\npppoptfile = \/etc\/ppp\/options.xl2tpd
\nlength bit = yes
\n7. \u7f16\u8f91 \/etc\/ppp\/options.xl2tpd
\nvim \/etc\/ppp\/options.xl2tpd<\/p>\n
require-mschap-v2
\nms-dns 8.8.8.8
\nms-dns 8.8.4.4
\nasyncmap 0
\nauth
\ncrtscts
\nlock
\nhide-password
\nmodem
\ndebug
\nname l2tpd
\nproxyarp
\nlcp-echo-interval 30
\nlcp-echo-failure 4<\/p>\n
8\u3002 \u914d\u7f6e\u7528\u6237\u540d,\u5bc6\u7801:\u7f16\u8f91 \/etc\/ppp\/chap-secrets
\nvim \/etc\/ppp\/chap-secrets
\nclient\u548csecret\u81ea\u5df1\u586b\uff0cserver\u548cIP\u7559*\u53f7\uff0c
\n# Secrets for authentication using CHAP
\n# client server secret IP addresses
\nusername * userpass *
\n9. \u91cd\u542fxl2tp
\nservice xl2tpd restart<\/p>\n
10. \u5f00\u653e\u7aef\u53e3\u4ee5\u53ca\u8f6c\u53d1
\n\u539f\u6837\u6267\u884c\u4e0b\u9762\u6240\u6709\u547d\u4ee4\uff0c<\/p>\n
#Allow ipsec traffic
\niptables -A INPUT -m policy --dir in --pol ipsec -j ACCEPT
\niptables -A FORWARD -m policy --dir in --pol ipsec -j ACCEPT<\/p>\n
#Do not NAT VPN traffic
\niptables -t nat -A POSTROUTING -m policy --dir out --pol none -j MASQUERADE<\/p>\n
#Forwarding rules for VPN
\niptables -A FORWARD -i ppp+ -p all -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
\niptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT<\/p>\n
#Ports for Openswan \/ xl2tpd
\niptables -A INPUT -m policy --dir in --pol ipsec -p udp --dport 1701 -j ACCEPT
\niptables -A INPUT -p udp --dport 500 -j ACCEPT
\niptables -A INPUT -p udp --dport 4500 -j ACCEPT
\niptables -t nat -A POSTROUTING -s 192.168.1.0\/24 -o eth0 -j MASQUERADE<\/p>\n
\u518d\u6267\u884c\u4e0b\u9762\u4fdd\u5b58iptables
\nservice iptables save
\nservice iptables restart<\/p>\n
11. \u6dfb\u52a0\u81ea\u542f\u52a8
\nchkconfig xl2tpd on
\nchkconfig iptables on
\nchkconfig ipsec on<\/p>\n
12. \u91cd\u542f
\nreboot<\/p>\n
\u5b8c\u6210\uff01\u56de\u5934\u518d\u6765\u5199\u4e00\u4e2a\u4e00\u952e\u5b89\u88c5\u811a\u672c\u3002<\/p>\n
\u8c03\u8bd5\uff1a
\n\u8fde\u4e0d\u4e0a\u7684\u65f6\u5019\u5148\u5173\u95ediptables\u6765\u8c03\u8bd5\u3002
\nservice iptables stop
\n\u786e\u5b9a\u80fd\u8fde\u4e0a\u4ee5\u540e\u518d\u6253\u5f00iptables
\nservice iptables start<\/p>\n
\u5982\u679c\u8fd9\u65f6\u8fde\u4e0d\u4e0a\u4e86\uff0c\u90a3\u4e48\u5c31\u662fiptables\u7684\u95ee\u9898\u4e86
\n\u7279\u522b\u6ce8\u610fiptables\u91cc\u7684\u987a\u5e8f\uff0c INPUT\u548cFORWARD\u91cc\u7684REJECT\u4e00\u5b9a\u662f\u5199\u5728\u6700\u540e\u9762\uff0c\u5426\u5219\u5199\u5728\u4ed6\u4eec\u4e4b\u540e\u7684port\u5c31\u90fd\u88abREJECT\u4e86\uff01
\n\u4e0b\u9762\u662f\u6211\u81ea\u5df1\u7684iptables\uff0c\u53ef\u4f9b\u53c2\u8003<\/p>\n
*nat
\n:PREROUTING ACCEPT [82:15507]
\n:POSTROUTING ACCEPT [0:0]
\n:OUTPUT ACCEPT [6:447]
\n-A POSTROUTING -m policy --dir out --pol none -j MASQUERADE
\nCOMMIT
\n# Completed on Fri Apr 4 05:44:30 2014
\n# Generated by iptables-save v1.4.7 on Fri Apr 4 05:44:30 2014
\n*filter
\n:INPUT ACCEPT [0:0]
\n:FORWARD ACCEPT [0:0]
\n:OUTPUT ACCEPT [490:286471]
\n-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
\n-A INPUT -p icmp -j ACCEPT
\n-A INPUT -i lo -j ACCEPT
\n-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
\n-A INPUT -m policy --dir in --pol ipsec -j ACCEPT
\n-A INPUT -p udp -m policy --dir in --pol ipsec -m udp --dport 1701 -j ACCEPT
\n-A INPUT -p udp -m udp --dport 500 -j ACCEPT
\n-A INPUT -p udp -m udp --dport 4500 -j ACCEPT
\n-A INPUT -p esp -j ACCEPT
\n-A INPUT -j REJECT --reject-with icmp-host-prohibited
\n-A FORWARD -m policy --dir in --pol ipsec -j ACCEPT
\n-A FORWARD -i ppp+ -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
\n-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
\n-A FORWARD -j REJECT --reject-with icmp-host-prohibited
\nCOMMIT<\/p>\n
--------------------------------------------------------------------------------------------------------------<\/p>\n
FAQs
\n\u9519\u8bef1:
\nSAref kernel support [N\/A]
\n\/etc\/xl2tpd\/xl2tpd.conf\u8fd9\u4e2a\u6587\u4ef6\u91cc<\/p>\n
[global]
\nipsec saref = no
\nLinux Openswan U2.6.38\/K2.6.18-308.el5 (netkey)
\n\u4ee5netkey\u65b9\u5f0f\u8fd0\u884c\u4e0d\u652f\u6301\u5c40\u57df\u7f51\u591a\u4e2anat\u5ba2\u6237;
\n\u5f00\u542fSAref kernel support\u540e\u4ee5klips\u65b9\u5f0f\u8fd0\u884c\u652f\u6301<\/p>\n
\u9519\u8bef2:
\nTwo or more interfaces found, checking IP forwarding
\n\u4fee\u6539ip_forward,\u53ea\u8981 cat \/proc\/sys\/net\/ipv4\/ip_forward \u8fd4\u56de\u7ed3\u679c\u662f1\u5c31\u6ca1\u4e8b
\necho 1 >\/proc\/sys\/net\/ipv4\/ip_forward<\/p>\n
\u9519\u8bef3:
\nPlease enable \/proc\/sys\/net\/core\/xfrm_larval_drop
\necho 1 > \/proc\/sys\/net\/core\/xfrm_larval_drop<\/p>\n
\u9519\u8bef4:
\n\u7f3a\u5c11rngd\u670d\u52a1<\/p>\n
\u91cd\u65b0\u5b89\u88c5rngd
\nyum -y install rng-tools<\/p>\n
\u4f46\u662f\u5c1d\u8bd5\u7528service rngd start\u542f\u52a8\u540e\u63d0\u793a
\nStarting rngd: can't open entropy source(tpm or intel\/amd rng)
\nMaybe RNG device modules are not loaded
\n\u89e3\u51b3\u65b9\u6cd5\uff1a<\/p>\n
vi \/etc\/sysconfig\/rngd<\/p>\n
EXTRAOPTIONS=\"-r \/dev\/urandom\"<\/p>\n
sudo reboot<\/p>\n
service rngd start<\/p>\n","protected":false},"excerpt":{"rendered":"
\u524d\u6bb5\u65f6\u95f4\u4e70\u4e86\u4e2alinode vps\uff0c\u5df2\u7ecf\u642d\u5efa\u4e86shadowsocks\u7ffb\u5899\uff0c\u611f\u89c9\u53ea\u5f04\u8fd9\u4e2a\u592a\u4e8f\u4e86\uff0c \u6bd5\u7adflinode\u767d\u82b1\u82b1\u7684\u94f6\u5b50\u5728\u6d41\u6dcc\u7740\u5440\uff0c\u6240\u4ee5\u5fc5\u987b\u642d\u5efa\u4e2aL2TP server\u4ee5\u8fdb\u4e00\u6b65\u5229\u7528VPS\u3002 \u7b2c\u4e00\u6b65\uff1a\u51c6\u5907\u5de5\u4f5c \u9996\u5148\u7684\u9996\u5148\uff0c\u7ed9\u7cfb\u7edf\u7684\u8f6f\u4ef6\u90fd\u5347\u4e00\u4e0b\u7ea7: yum update \u518d\u6765\uff0c\u5b89\u88c5\u4e0b\u9762\u9700\u8981\u7684\u8f6f\u4ef6\uff0c\u548c\u7f16\u8f91\u548c\u7f16\u8bd1\u73af\u5883\u76f8\u5173\u7684\uff0c\u90fd\u88c5\u4e0a\u5427\uff0c\u4e0b\u9762\u6709\u4e9b\u5728\u5b89\u88c5\u65f6\u4f1a\u7528\u5230\uff0c\u6bd4\u5982lsof\u4e4b\u7c7b\u3002 yum install -y make gcc gmp-devel xmlto bison flex xmlto libpcap-devel lsof vim-enhanced man \u7b2c\u4e8c\u6b65\uff1a\u5b89\u88c5 \u4e0b\u9762\u6b63\u5f0f\u5f00\u59cb\u5b89\u88c5l2tp VPN yum install openswan ppp xl2tpd \u5982\u679c\u627e\u4e0d\u5230\u7684\u8f6f\u4ef6\uff0c\u90a3\u4e48\u53ef\u4ee5\u53bbhttp:\/\/pkgs.org\/\u627erpm\u5305\u3002\u6bd4\u5982xl2tpd\u6211\u5c31\u627e\u4e0d\u5230\uff0c\u53bbpkgs.org\u5c31\u53ef\u4ee5\u641c\u5230\uff1a CentOS 6 Atomic: xl2tpd-1.2.7-1.el6.art.i686.rpm Layer 2 Tunnelling Protocol Daemon (RFC 2661) xl2tpd-1.2.7-1.el6.art.x86_64.rpm Layer 2 Tunnelling Protocol Daemon (RFC 2661) EPEL: xl2tpd-1.3.1-7.el6.i686.rpm Layer 2…<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-265","post","type-post","status-publish","format-standard","hentry","category-linux"],"aioseo_notices":[],"brizy_media":[],"_links":{"self":[{"href":"https:\/\/peloo.net\/index.php?rest_route=\/wp\/v2\/posts\/265","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/peloo.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/peloo.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/peloo.net\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/peloo.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=265"}],"version-history":[{"count":3,"href":"https:\/\/peloo.net\/index.php?rest_route=\/wp\/v2\/posts\/265\/revisions"}],"predecessor-version":[{"id":268,"href":"https:\/\/peloo.net\/index.php?rest_route=\/wp\/v2\/posts\/265\/revisions\/268"}],"wp:attachment":[{"href":"https:\/\/peloo.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=265"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/peloo.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=265"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/peloo.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=265"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}