在CentOS 7中搭建PPTP、L2TP、IPSec服务

CentOS 前端之家
前端之家收集整理的这篇文章主要介绍了在CentOS 7中搭建PPTP、L2TP、IPSec服务，前端之家小编觉得挺不错的，现在分享给大家，也给大家做个参考。

在百度搜索了很多关于CentOS7搭建VPN的教程，但是有很多走不完全套的，因此浪费了很多时间，在这里我把查到能走通的教程整理了一遍，分享给大家。

更新组件

整个安装过程不用经过编译，组件都是在yum中下载，首先我们更新一下所有组件：

  1. yum update -y

这里有个地方需要注意的是：有些主机的硬件并不支持最新内核，因此在不确定的情况下就不要升级内核了，用以下的命令：

  1. yum –exclude=kernel* update -y

更新需要较长时间，请耐心等待。

非常重要的小插曲

撰写这篇文章并且共享出来，主要是为了能和大家互相学习和交流，但是正在看这篇文章的不乏一些现在就有自己的服务器或VPS，急着马上搭建好一台自己的VPN服务器的同学，如果你是这类同学，请不用心急，因为我制作好了自动运行脚本，脚本的内容和文章内容是一样的，把脚本下载到服务器，运行并配置自己的账号密码、ip和客户端ip即可。

脚本下载地址：https://github.com/BoizZ/PPTP-L2TP-IPSec-VPN-auto-installation-script-for-CentOS-7

运行脚本：sh vpn-script-for-centos7.sh

好，那么希望继续学习的同学请往下看。

安装epel源

为什么要安装epel源呢？是因为必要组件xl2tpd在基础的yum源里面是没有的。

  1. yum install epel-release -y

安装依赖组件

安装完epel源以后就可以直接安装依赖组件了。

  1. yum install -y openswan ppp pptpd xl2tpd wget

修改配置文件

需要等待所有依赖组件安装完成才能执行以下步骤（小标题括号内是文件路径）。

ipsec.conf配置文件（/etc/ipsec.conf）

  1. # /etc/ipsec.conf - Libreswan IPsec configuration file
  2. # This file:  /etc/ipsec.conf
  3. #
  4. # Enable when using this configuration file with openswan instead of libreswan
  5. #version 2
  6. #
  7. # Manual:     ipsec.conf.5
  8. # basic configuration
  9. config setup
  10.     # NAT-TRAVERSAL support,see README.NAT-Traversal
  11.     nat_traversal=yes
  12.     # exclude networks used on server side by adding %v4:!a.b.c.0/24
  13.     virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12
  14.     # OE is now off by default. Uncomment and change to on,to enable.
  15.     oe=off
  16.     # which IPsec stack to use. auto will try netkey,then klips then mast
  17.     protostack=netkey
  18.     force_keepalive=yes
  19.     keep_alive=1800
  20. conn L2TP-PSK-NAT
  21.     rightsubnet=vhost:%priv
  22.     also=L2TP-PSK-noNAT
  23. conn L2TP-PSK-noNAT
  24.     authby=secret
  25.     pfs=no
  26.     auto=add
  27.     keyingtries=3
  28.     rekey=no
  29.     ikelifetime=8h
  30.     keylife=1h
  31.     type=transport
  32.     left=$serverip
  33.     leftid=$serverip
  34.     leftprotoport=17/1701
  35.     right=%any
  36.     rightprotoport=17/%any
  37.     dpddelay=40
  38.     dpdtimeout=130
  39.     dpdaction=clear
  40. # For example connections,see your distribution's documentation directory,# or the documentation which could be located at
  41. #  /usr/share/docs/libreswan-3.*/ or look at https://www.libreswan.org/
  42. #
  43. # There is also a lot of information in the manual page,"man ipsec.conf"
  44. # You may put your configuration (.conf) file in the "/etc/ipsec.d/" directory
  45. # by uncommenting this line
  46. #include /etc/ipsec.d/*.conf

设置预共享密钥配置文件（/etc/ipsec.secrets）

  1. #include /etc/ipsec.d/*.secrets
  2. $serverip username PSK password

注解：第二行中username为登录名，password为登录密码

pptpd.conf配置文件(/etc/pptpd.conf)

  1. #ppp /usr/sbin/pppd
  2. option /etc/ppp/options.pptpd
  3. #debug
  4. # stimeout 10
  5. #noipparam
  6. logwtmp
  7. #vrf test
  8. #bcrelay eth1
  9. #delegate
  10. #connections 100
  11. localip 10.0.1.2
  12. remoteip 10.0.1.200-254

xl2tpd.conf配置文件(/etc/xl2tpd/xl2tpd.conf)

  1. ;
  2. ; This is a minimal sample xl2tpd configuration file for use
  3. ; with L2TP over IPsec.
  4. ;
  5. ; The idea is to provide an L2TP daemon to which remote Windows L2TP/IPsec
  6. ; clients connect. In this example,the internal (protected) network
  7. ; is 192.168.1.0/24.  A special IP range within this network is reserved
  8. ; for the remote clients: 192.168.1.128/25
  9. ; (i.e. 192.168.1.128 ... 192.168.1.254)
  10. ;
  11. ; The listen-addr parameter can be used if you want to bind the L2TP daemon
  12. ; to a specific IP address instead of to all interfaces. For instance,; you could bind it to the interface of the internal LAN (e.g. 192.168.1.98
  13. ; in the example below). Yet another IP address (local ip,e.g. 192.168.1.99)
  14. ; will be used by xl2tpd as its address on pppX interfaces.
  15. [global]
  16. ; ipsec saref = yes
  17. listen-addr = 104.171.165.91
  18. auth file = /etc/ppp/chap-secrets
  19. port = 1701
  20. [lns default]
  21. ip range = 10.0.1.100-10.0.1.254
  22. local ip = 10.0.1.1
  23. refuse chap = yes
  24. refuse pap = yes
  25. require authentication = yes
  26. name = L2TPVPN
  27. ppp debug = yes
  28. pppoptfile = /etc/ppp/options.xl2tpd
  29. length bit = yes

options.pptpd配置文件(/etc/ppp/options.pptpd)

  1. # Authentication
  2. name pptpd
  3. #chapms-strip-domain
  4. # Encryption
  5. # BSD licensed ppp-2.4.2 upstream with MPPE only,kernel module ppp_mppe.o
  6. # {{{
  7. refuse-pap
  8. refuse-chap
  9. refuse-mschap
  10. # Require the peer to authenticate itself using MS-CHAPv2 [Microsoft
  11. # Challenge Handshake Authentication Protocol,Version 2] authentication.
  12. require-mschap-v2
  13. # Require MPPE 128-bit encryption
  14. # (note that MPPE requires the use of MSCHAP-V2 during authentication)
  15. require-mppe-128
  16. # }}}
  17. # OpenSSL licensed ppp-2.4.1 fork with MPPE only,kernel module mppe.o
  18. # {{{
  19. #-chap
  20. #-chapms
  21. # Require the peer to authenticate itself using MS-CHAPv2 [Microsoft
  22. # Challenge Handshake Authentication Protocol,Version 2] authentication.
  23. #+chapms-v2
  24. # Require MPPE encryption
  25. # (note that MPPE requires the use of MSCHAP-V2 during authentication)
  26. #mppe-40    # enable either 40-bit or 128-bit,not both
  27. #mppe-128
  28. #mppe-stateless
  29. # }}}
  30. ms-dns 8.8.4.4
  31. ms-dns 8.8.8.8
  32. #ms-wins 10.0.0.3
  33. #ms-wins 10.0.0.4
  34. proxyarp
  35. #10.8.0.100
  36. # Logging
  37. #debug
  38. #dump
  39. lock
  40. nobsdcomp 
  41. novj
  42. novjccomp
  43. nologfd

options.xl2tpd配置文件(/etc/ppp/options.xl2tpd)

  1. rm -f /etc/ppp/options.xl2tpd
  2. cat >>/etc/ppp/options.xl2tpd<<EOF
  3. #require-pap
  4. #require-chap
  5. #require-mschap
  6. ipcp-accept-local
  7. ipcp-accept-remote
  8. require-mschap-v2
  9. ms-dns 8.8.8.8
  10. ms-dns 8.8.4.4
  11. asyncmap 0
  12. auth
  13. crtscts
  14. lock
  15. hide-password
  16. modem
  17. debug
  18. name l2tpd
  19. proxyarp
  20. lcp-echo-interval 30
  21. lcp-echo-failure 4
  22. mtu 1400
  23. noccp
  24. connect-delay 5000
  25. # To allow authentication against a Windows domain EXAMPLE,and require the
  26. # user to be in a group "VPN Users". Requires the samba-winbind package
  27. # require-mschap-v2
  28. # plugin winbind.so
  29. # ntlm_auth-helper '/usr/bin/ntlm_auth --helper-protocol=ntlm-server-1 --require-membership-of="EXAMPLE\VPN Users"'
  30. # You need to join the domain on the server,for example using samba:
  31. # http://rootmanager.com/ubuntu-ipsec-l2tp-windows-domain-auth/setting-up-openswan-xl2tpd-with-native-windows-clients-lucid.html

创建chap-secrets配置文件，即用户列表及密码(/etc/ppp/chap-secrets)

  1. # Secrets for authentication using CHAP
  2. # client     server     secret               IP addresses
  3. username          pptpd     password               *
  4. username          l2tpd     password               *

注解：第三第四行中username为登录名，password为登录密码

系统配置

允许IP转发

  1. sysctl -w net.ipv4.ip_forward=1
  2. sysctl -w net.ipv4.conf.all.rp_filter=0
  3. sysctl -w net.ipv4.conf.default.rp_filter=0
  4. sysctl -w net.ipv4.conf.$eth.rp_filter=0
  5. sysctl -w net.ipv4.conf.all.send_redirects=0
  6. sysctl -w net.ipv4.conf.default.send_redirects=0
  7. sysctl -w net.ipv4.conf.all.accept_redirects=0
  8. sysctl -w net.ipv4.conf.default.accept_redirects=0

注解：以上均是命令，复制上去运行即可
也可以修改配置文件(/etc/sysctl.conf)：

  1. net.ipv4.ip_forward = 1
  2. net.ipv4.conf.all.rp_filter = 0
  3. net.ipv4.conf.default.rp_filter = 0
  4. net.ipv4.conf.$eth.rp_filter = 0
  5. net.ipv4.conf.all.send_redirects = 0
  6. net.ipv4.conf.default.send_redirects = 0
  7. net.ipv4.conf.all.accept_redirects = 0
  8. net.ipv4.conf.default.accept_redirects = 0

允许防火墙端口

创建文件/usr/lib/firewalld/services/pptpd.xml并修改：

  1. <?xml version="1.0" encoding="utf-8"?>
  2. <service>
  3.   <short>pptpd</short>
  4.   <description>PPTP</description>
  5.   <port protocol="tcp" port="1723"/>
  6. </service>

创建文件/usr/lib/firewalld/services/l2tpd.xml并修改：

  1. <?xml version="1.0" encoding="utf-8"?>
  2. <service>
  3.   <short>l2tpd</short>
  4.   <description>L2TP IPSec</description>
  5.   <port protocol="udp" port="500"/>
  6.   <port protocol="udp" port="4500"/>
  7.   <port protocol="udp" port="1701"/>
  8. </service>

初始化并重启防火墙：

  1. firewall-cmd --reload
  2. firewall-cmd --permanent --add-service=pptpd
  3. firewall-cmd --permanent --add-service=l2tpd
  4. firewall-cmd --permanent --add-service=ipsec
  5. firewall-cmd --permanent --add-masquerade
  6. firewall-cmd --permanent --direct --add-rule ipv4 filter FORWARD 0 -p tcp -i ppp+ -j TCPMSS --syn --set-mss 1356
  7. firewall-cmd --reload

这里是由于CentOS7自带firewall，并且不预装iptables，因此自己也不多此一举去安装了，因为效果都是一样的。

启动并设置开机自启动服务

  1. systemctl enable pptpd ipsec xl2tpd
  2. systemctl restart pptpd ipsec xl2tpd

大功告成

最后一步，并且是最重要的一步，当然是连接一下自己刚建好的VPN服务器啦！

现在估计你和我有同样的喜悦，当然如果中间出现什么问题的话，交流区在下方，很乐意大家踊跃参与！

猜你在找的CentOS相关文章

Centos7离线安装gcc4.8
有时候CentOS工作在无互联网的环境下，需要在离线环境下安装一些组件，这次实现的是模拟在...
CentOS7离线安装devtoolset-9并编译redis6.0.5
首先参照https://www.cnblogs.com/wdw984/p/13330074.html，来进行如何安装Centos和离线下...
使用Nginx在80端口上代理多个.NET CORE网站
有两个.NET CORE3.1网站部署在CentOS7上（内网IP是192.168.2.32），现在想实现访问http://...
CentOS7中配置vsftpd
1、yum -y install vsftpd 安装vsftpd 2、配置vsftpd的配置文件（/etc/vsftpd/vsftpd.conf...
CentOS7离线安装Mysql8.0
首先去mysql官网下载mysql的离线rpm安装包（https://downloads.mysql.com/archives/commun...
CentOS中增加网络连接数的方法
CentOS默认对外访问，发起的TCP链接总数小于28232个。 可以通过以下命令的结果计算出来 $ ...
VMware安装Centos7虚拟机
首先安装虚拟机很简单，所以呢，具体的安装过程就引用别人的博客，这篇文字很详细，引用之...
[Linux] 解决CentOS下Requires: libjson-c.so错误
当安装某些rpm包的时候 , 会爆出这个错误 Requires: libjson-c.so json-c是c语言下的json库...
阿里云centos7安装mysql8数据库
linux系统安装mysql8
centos安装mysql
一、安装 二、修改密码 三、修改远程连接权限(为了使用navicat)
LinuxWindowsCentOSUbuntuNginxWebServiceScalaMemcacheApacheRedisDockerBashAzureTomcatLNMPShell数据结构服务器运维网络安全
xebugnodemondocker-copydcoselasticsearcwindows-contdocker-windodocker-awsamazon-cloudenvoyproxyhashicorp-vaswisscomdevkafka-pythonzscalerphoton-osdocker-swarmkamongoogle-cloudconcoursewso2-ampersistent-vapi-managerprocess-manamanjarojenkins-workhypriotremoteapikeystonejsbitcoindbitcoin-test