查看“建立 L2TP/IPSEC VPN”的源代码

<span data-link_translate_fr_title="Mettre en place un VPN L2TP/IPSEC"  data-link_translate_fr_url="Mettre en place un VPN L2TP/IPSEC"></span>[[:fr:Mettre en place un VPN L2TP/IPSEC]][[fr:Mettre en place un VPN L2TP/IPSEC]]
<span data-link_translate_en_title="Establish a L2TP/IPSEC VPN"  data-link_translate_en_url="Establish a L2TP/IPSEC VPN"></span>[[:en:Establish a L2TP/IPSEC VPN]][[en:Establish a L2TP/IPSEC VPN]]
<span data-link_translate_es_title="Establecer una VPN de L2TP/IPSEC"  data-link_translate_es_url="Establecer una VPN de L2TP/IPSEC"></span>[[:es:Establecer una VPN de L2TP/IPSEC]][[es:Establecer una VPN de L2TP/IPSEC]]
<span data-link_translate_pt_title="Estabelecer uma VPN L2TP/IPSEC"  data-link_translate_pt_url="Estabelecer uma VPN L2TP/IPSEC"></span>[[:pt:Estabelecer uma VPN L2TP/IPSEC]][[pt:Estabelecer uma VPN L2TP/IPSEC]]
<span data-link_translate_it_title="Stabilire una connessione VPN L2TP/IPSEC"  data-link_translate_it_url="Stabilire una connessione VPN L2TP/IPSEC"></span>[[:it:Stabilire una connessione VPN L2TP/IPSEC]][[it:Stabilire una connessione VPN L2TP/IPSEC]]
<span data-link_translate_nl_title="Stellen een L2TP/IPSEC VPN"  data-link_translate_nl_url="Stellen een L2TP/IPSEC VPN"></span>[[:nl:Stellen een L2TP/IPSEC VPN]][[nl:Stellen een L2TP/IPSEC VPN]]
<span data-link_translate_de_title="Etablieren Sie ein L2TP/IPSEC-VPN"  data-link_translate_de_url="Etablieren Sie ein L2TP/IPSEC-VPN"></span>[[:de:Etablieren Sie ein L2TP/IPSEC-VPN]][[de:Etablieren Sie ein L2TP/IPSEC-VPN]]
<span data-link_translate_zh_title="建立 L2TP/IPSEC VPN"  data-link_translate_zh_url="建立 L2TP/IPSEC VPN"></span>[[:zh:建立 L2TP/IPSEC VPN]][[zh:建立 L2TP/IPSEC VPN]]
<span data-link_translate_ar_title="إنشاء L2TP/IPSEC VPN"  data-link_translate_ar_url="إنشاء L2TP/IPSEC VPN"></span>[[:ar:إنشاء L2TP/IPSEC VPN]][[ar:إنشاء L2TP/IPSEC VPN]]
<span data-link_translate_ja_title="L2TP と IPSEC VPN を確立します。"  data-link_translate_ja_url="L2TP と IPSEC VPN を確立します。"></span>[[:ja:L2TP と IPSEC VPN を確立します。]][[ja:L2TP と IPSEC VPN を確立します。]]
<span data-link_translate_pl_title="Ustanowić połączenie sieci VPN L2TP/IPSEC"  data-link_translate_pl_url="Ustanowić połączenie sieci VPN L2TP/IPSEC"></span>[[:pl:Ustanowić połączenie sieci VPN L2TP/IPSEC]][[pl:Ustanowić połączenie sieci VPN L2TP/IPSEC]]
<span data-link_translate_ru_title="Установить L2TP/IPSEC VPN"  data-link_translate_ru_url="Установить L2TP/IPSEC VPN"></span>[[:ru:Установить L2TP/IPSEC VPN]][[ru:Установить L2TP/IPSEC VPN]]
<span data-link_translate_ro_title="Stabilească un VPN L2TP/IPSEC"  data-link_translate_ro_url="Stabilească un VPN L2TP/IPSEC"></span>[[:ro:Stabilească un VPN L2TP/IPSEC]][[ro:Stabilească un VPN L2TP/IPSEC]]
<span data-link_translate_he_title="הקמת VPN של L2TP/IPSEC"  data-link_translate_he_url="הקמת VPN של L2TP/IPSEC"></span>[[:he:הקמת VPN של L2TP/IPSEC]][[he:הקמת VPN של L2TP/IPSEC]]
<br />这篇文章是从由软件进行自动翻译。你可以[[:fr:Mettre en place un VPN L2TP/IPSEC|看到这篇文章的源代码]]<br /><span data-translate="fr"></span><br />
<span data-link_translate="he"></span><span data-link_translate="ro"></span><span data-link_translate="ru"></span><span data-link_translate="pl"></span><span data-link_translate="ja"></span><span data-link_translate="ar"></span><span data-link_translate="zh"></span><span data-link_translate="de"></span><span data-link_translate="nl"></span><span data-link_translate="it"></span><span data-link_translate="pt"></span><span data-link_translate="es"></span><span data-link_translate="he"></span><span data-link_translate="ro"></span><span data-link_translate="ru"></span><span data-link_translate="pl"></span><span data-link_translate="ja"></span><span data-link_translate="ar"></span><span data-link_translate="zh"></span><span data-link_translate="de"></span><span data-link_translate="nl"></span><span data-link_translate="it"></span><span data-link_translate="pt"></span><span data-link_translate="es"></span><span data-link_translate="en"></span><span data-link_translate="he"></span><span data-link_translate="ro"></span><span data-link_translate="ru"></span><span data-link_translate="pl"></span><span data-link_translate="ja"></span><span data-link_translate="ar"></span><span data-link_translate="zh"></span><span data-link_translate="de"></span><span data-link_translate="nl"></span><span data-link_translate="it"></span><span data-link_translate="pt"></span><span data-link_translate="es"></span><span data-link_translate="en"></span><span data-link_translate="he"></span><span data-link_translate="ro"></span><span data-link_translate="ru"></span><span data-link_translate="pl"></span><span data-link_translate="ja"></span><span data-link_translate="ar"></span><span data-link_translate="zh"></span><span data-link_translate="de"></span><span data-link_translate="nl"></span><span data-link_translate="it"></span><span data-link_translate="pt"></span><span data-link_translate="es"></span><span data-link_translate="en"></span><span data-link_translate="he"></span><span data-link_translate="ro"></span><span data-link_translate="ru"></span><span data-link_translate="pl"></span><span data-link_translate="ja"></span><span data-link_translate="ar"></span><span data-link_translate="zh"></span><span data-link_translate="de"></span><span data-link_translate="nl"></span><span data-link_translate="it"></span><span data-link_translate="pt"></span><span data-link_translate="es"></span><span data-link_translate="en"></span><span data-link_translate="he"></span><span data-link_translate="ro"></span><span data-link_translate="ru"></span><span data-link_translate="pl"></span><span data-link_translate="ja"></span><span data-link_translate="ar"></span><span data-link_translate="zh"></span><span data-link_translate="de"></span><span data-link_translate="nl"></span><span data-link_translate="it"></span><span data-link_translate="pt"></span><span data-link_translate="es"></span><span data-link_translate="en"></span><span data-link_translate="he"></span><span data-link_translate="he"></span><span data-link_translate="he"></span><span data-link_translate="he"></span><span data-link_translate="he"></span><span data-link_translate="he"></span><span data-link_translate="ro"></span><span data-link_translate="ru"></span><span data-link_translate="pl"></span><span data-link_translate="ja"></span><span data-link_translate="ar"></span><span data-link_translate="zh"></span><span data-link_translate="ro"></span><span data-link_translate="pl"></span><span data-link_translate="de"></span><span data-link_translate="nl"></span><span data-link_translate="it"></span><span data-link_translate="pt"></span><span data-link_translate="es"></span><span data-link_translate="en"></span><!-- Début de l'article. Placez votre texte ci-après et n'hésitez pas à personnaliser les chapitres selon votre besoin -->

==介绍== <!--T:1-->
一个 VPN (虚拟专用网) est un système permettant de créer un lien direct entre des ordinateurs distants. On utilise notamment ce terme dans le milieu de la dématérialisation fiscale et dans le travail à distance, ainsi que pour l'accès à des structures de type {{Template:Cloud computing}}. L'avantage du L2TP (图层 2 隧道效应的压力协议) réside dans l'utilisation d'une clé pré partagée en plus des identifiants de connexion habituels. A cela s'ajoute IPSEC, une technologie d'encapsulation cryptée dans la trame IP.

==系统必备组件== <!--T:2-->
要学习本教程，您必须具有 :<br/>

* 下一个 Linux 发行版的机器 (Debian 8Fedora，CentOS，Ubuntu，覆盆子 Pi...)   ''不能在 Debian 下 8 由于 OpenSwan 的存储库中已不存在''<br/>
* 知道您的公共 ip 地址，如果你不知道 [http://http://www.mon-ip.com/ 在这里 ！]<br/>

==教程== <!--T:3-->
首先，登录你的根 (或通过用户谁有超级用户权限).您可以使用腻子连接到一台机器通过 SSH 远程或只需打开一个终端，如果您有权访问您的计算机的图形界面。

===更新和安装软件包===
首先，更新您的计算机并安装必要的存储库 :<br/>
<syntaxhighlight lang="bash">
apt-get update && apt-get upgrade -y
apt-get install openswan xl2tpd ppp lsof
</syntaxhighlight>

''OpenSwan 会问你一些问题，回答 y 具有默认值。'.
<br/><br/>

===将规则添加到防火墙===
然后我们会将规则添加到 iptables 允许 VPN 通讯 (替换 %SERVERIP% 通过 ip 的你 {{Template:Serveur}}) :
<syntaxhighlight lang="bash">
iptables -t nat -A POSTROUTING -j SNAT --to-source %SERVERIP% -o eth0
</syntaxhighlight>

<br/>
然后运行下面的命令来启用路由 IP 数据包:
<syntaxhighlight lang="bash">
echo "net.ipv4.ip_forward = 1" |  tee -a /etc/sysctl.conf
echo "net.ipv4.conf.all.accept_redirects = 0" |  tee -a /etc/sysctl.conf
echo "net.ipv4.conf.all.send_redirects = 0" |  tee -a /etc/sysctl.conf
echo "net.ipv4.conf.default.rp_filter = 0" |  tee -a /etc/sysctl.conf
echo "net.ipv4.conf.default.accept_source_route = 0" |  tee -a /etc/sysctl.conf
echo "net.ipv4.conf.default.send_redirects = 0" |  tee -a /etc/sysctl.conf
echo "net.ipv4.icmp_ignore_bogus_error_responses = 1" |  tee -a /etc/sysctl.conf
for vpn in /proc/sys/net/ipv4/conf/*; do echo 0 > $vpn/accept_redirects; echo 0 > $vpn/send_redirects; done
sysctl -p
</syntaxhighlight>

使持续到重新启动这台机器 :
<syntaxhighlight lang="bash">
nano /etc/rc.local
</syntaxhighlight>

然后，只是以前在末尾添加 '''退出 0''' :
<syntaxhighlight lang="bash">
for vpn in /proc/sys/net/ipv4/conf/*; do echo 0 > $vpn/accept_redirects; echo 0 > $vpn/send_redirects; done
iptables -t nat -A POSTROUTING -j SNAT --to-source %SERVERIP% -o eth+
</syntaxhighlight>

<br/>
===执行IPSEC===
<br/>

创建一个新的配置文件 ipsec :
<syntaxhighlight lang="bash">
mv /etc/ipsec.conf /etc/ipsec.conf.bak && nano /etc/ipsec.conf
</syntaxhighlight>
然后坚持这 : ''不忘了替换 %SERVERIP% 通过 IP 地址的 {{Template:Serveur}}''
<syntaxhighlight lang="bash">
version 2 # conforms to second version of ipsec.conf specification

config setup
    dumpdir=/var/run/pluto/
    #in what directory should things started by setup (notably the Pluto daemon) be allowed to dump core?

    nat_traversal=yes
    #whether to accept/offer to support NAT (NAPT, also known as "IP Masqurade") workaround for IPsec

    virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v6:fd00::/8,%v6:fe80::/10
    #contains the networks that are allowed as subnet= for the remote client. In other words, the address ranges that may live behind a NAT router through which a client connects.

    protostack=netkey
    #decide which protocol stack is going to be used.

    force_keepalive=yes
    keep_alive=60
    # Send a keep-alive packet every 60 seconds.

conn L2TP-PSK-noNAT
    authby=secret
    #shared secret. Use rsasig for certificates.

    pfs=no
    #Disable pfs

    auto=add
    #the ipsec tunnel should be started and routes created when the ipsec daemon itself starts.

    keyingtries=3
    #Only negotiate a conn. 3 times.

    ikelifetime=8h
    keylife=1h

    ike=aes256-sha1,aes128-sha1,3des-sha1
    phase2alg=aes256-sha1,aes128-sha1,3des-sha1
    # https://lists.openswan.org/pipermail/users/2014-April/022947.html
    # specifies the phase 1 encryption scheme, the hashing algorithm, and the diffie-hellman group. The modp1024 is for Diffie-Hellman 2. Why 'modp' instead of dh? DH2 is a 1028 bit encryption algorithm that modulo's a prime number, e.g. modp1028. See RFC 5114 for details or the wiki page on diffie hellmann, if interested.

    type=transport
    #because we use l2tp as tunnel protocol

    left=%SERVERIP%
    #fill in server IP above

    leftprotoport=17/1701
    right=%any
    rightprotoport=17/%any

    dpddelay=10
    # Dead Peer Dectection (RFC 3706) keepalives delay
    dpdtimeout=20
    #  length of time (in seconds) we will idle without hearing either an R_U_THERE poll from our peer, or an R_U_THERE_ACK reply.
    dpdaction=clear
    # When a DPD enabled peer is declared dead, what action should be taken. clear means the eroute and SA with both be cleared.
</syntaxhighlight>

On crée ensuite le ''preshared secret'' (预共享的密钥) :
<syntaxhighlight lang="bash">
nano /etc/ipsec.secrets
</syntaxhighlight>
然后输入这条线 :
<syntaxhighlight lang="bash">
%SERVERIP%  %any:   PSK "VotreClePlusOuMoinsSecurisee"
</syntaxhighlight>
请考虑替换 %SERVERIP% par l'IP de votre {{Template:Serveur}}. Si vous séchez pour la création de votre clé vous pouvez utilisez la commande suivante :
<syntaxhighlight lang="bash">
openssl rand -hex 30
</syntaxhighlight>

<br/>
我们检查一切都好，因此您使用此命令 :
<syntaxhighlight lang="bash">
ipsec verify
</syntaxhighlight>
你必须得到 :
<syntaxhighlight lang="bash">
Checking your system to see if IPsec got installed and started correctly:
Version check and ipsec on-path                                 [OK]
Linux Openswan U2.6.38/K3.13.0-24-generic (netkey)
Checking for IPsec support in kernel                            [OK]
 SAref kernel support                                           [N/A]
 NETKEY:  Testing XFRM related proc values                      [OK]
    [OK]
    [OK]
Checking that pluto is running                                  [OK]
 Pluto listening for IKE on udp 500                             [OK]
 Pluto listening for NAT-T on udp 4500                          [OK]
Checking for 'ip' command                                       [OK]
Checking /bin/sh is not /bin/dash                               [WARNING]
Checking for 'iptables' command                                 [OK]
Opportunistic Encryption Support                                [DISABLED]
</syntaxhighlight>

===Configuration de xl2tpd===

让我们开始编辑一个新的配置文件 :
<syntaxhighlight lang="bash">
mv /etc/xl2tpd/xl2tpd.conf /etc/xl2tpd/xl2tpd.conf.bak && nano /etc/xl2tpd/xl2tpd.conf
</syntaxhighlight>

然后坚持这 :
<syntaxhighlight lang="bash">
[global]
ipsec saref = yes
saref refinfo = 30

;debug avp = yes
;debug network = yes
;debug state = yes
;debug tunnel = yes

[lns default]
ip range = 172.16.1.30-172.16.1.100
local ip = 172.16.1.1
refuse pap = yes
require authentication = yes
;ppp debug = yes
pppoptfile = /etc/ppp/options.xl2tpd
length bit = yes
</syntaxhighlight>

===PPP 配置===
对于这部分，我们将再创建一个新的配置文件 ''(在一个句子中太新 :3)'' :

<syntaxhighlight lang="bash">
mv /etc/ppp/options.xl2tpd /etc/ppp/options.xl2tpd.bak && nano /etc/ppp/options.xl2tpd
</syntaxhighlight>

然后插入这 :
<syntaxhighlight lang="bash">
require-mschap-v2
ms-dns 8.8.8.8
ms-dns 8.8.4.4
auth
mtu 1200
mru 1000
crtscts
hide-password
modem
name l2tpd
proxyarp
lcp-echo-interval 30
lcp-echo-failure 4
</syntaxhighlight>

在这里，我使用谷歌，免费为您修改并使用您所选择的公共 DNS ! ;)

===添加用户===

最后 ! 这关键的一步将允许您设置为您的 vpn 用户的登录名和密码，只需编辑这个文件 :
<syntaxhighlight lang="bash">
nano /etc/ppp/chap-secrets
</syntaxhighlight>
典型的线下:
<syntaxhighlight lang="bash">
jean          l2tpd   0F92E5FC2414101EA            *
</syntaxhighlight>
<br/>
'''注意 : 此文件是区分大小写，如果你把一个字母要大写，你需要保持它，当您键入您的登录名或密码.'''
<br/><br/>

===最后重新启动 : ===
<syntaxhighlight lang="bash">
/etc/init.d/ipsec restart && /etc/init.d/xl2tpd restart
</syntaxhighlight>

<!-- Fin de l'article -->
<br /><br />
这篇文章似乎对你有用 ? <vote />

<!--T:5-->

<!-- Commentaire -->
<comments />

<!-- Placez ci-dessous la ou les catégories auxquelles se rapporte votre article. Ex: [[Category:VPN]] [[Category:Linux]] -->
[[Category:VPN]] [[Category:Linux]]