本文基于centos6.5安装openswan-2.6.32-37.el6.x86_64
首先安装预环境:
yum -y install gmp gmp-devel gawk flex bison
安装软件
yum install -y openswan lsof traceroute
for vpn in /proc/sys/net/ipv4/conf/*;do echo 0 > $vpn/accept_redirects;echo 0 > $vpn/send_redirects;done
sed -i 's#net.ipv4.ip_forward = 0#net.ipv4.ip_forward = 1#g' /etc/sysctl.conf
sed -i 's#net.ipv4.conf.default.rp_filter = 1#net.ipv4.conf.default.rp_filter = 0#g' /etc/sysctl.conf
查看内核参数,确保禁止重定向sysctl -a | egrep "ipv4.*(accept|send)_redirects"
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv4.conf.default.send_redirects = 0
net.ipv4.conf.lo.accept_redirects = 0
net.ipv4.conf.lo.send_redirects = 0
net.ipv4.conf.eth0.accept_redirects = 0
net.ipv4.conf.eth0.send_redirects = 0
重新装入/etc/sysctl.conf
sysctl -p
config setup@H_502_40@
plutodebug=all@H_502_40@
plutostderrlog=/var/log/ipsec.log@H_502_40@
@H_502_40@# Debug-logging controls: "none" for (almost) none,"all" for lots.@H_502_40@
@H_502_40@# klipsdebug=none@H_502_40@
@H_502_40@# plutodebug="control parsing"@H_502_40@
@H_502_40@# For Red Hat Enterprise Linux and Fedora,leave protostack=netkey@H_502_40@
@H_502_40@protostack=netkey@H_502_40@
@H_502_40@nat_traversal=yes@H_502_40@
@H_502_40@virtual_private=@H_502_40@
@H_502_40@# Enable this if you see "Failed to find any available worker"@H_502_40@
@H_502_40@# nhelpers=0@H_502_40@
#You may put your configuration (.conf) file in the "/etc/ipsec.d/" and uncomment this.@H_502_40@
include /etc/@H_502_40@ipsec.d/*.conf@H_502_40@
修改lan-to-lan的配置文件vi /etc/ipsec.d/lan1-to-lan2.conf@H_502_40@
conn lan1-to-lan2 #唯一标识一个连接的名字
@H_502_40@
@H_502_40@type=tunnel@H_502_40@
@H_502_40@authby=secret@H_502_40@
@H_502_40@left=%defaultroute@H_502_40@
@H_502_40@leftid=本端公网地址1@H_502_40@@H_502_40@
@H_502_40@leftnexthop=%defaultroute@H_502_40@
@H_502_40@leftsubnet=192.168.90.0/24@H_502_40@@H_502_40@
@H_502_40@right=对端公网地址@H_502_40@@H_502_40@
@H_502_40@rightsubnet=10.248.200.0/21 #可以配置vhost:%no,%priv 匹配对端子网,但必须保证一边有明确的子网配置。@H_502_40@@H_502_40@@H_502_40@@H_502_40@
@H_502_40@aut@H_502_40@o=start@H_502_40@
vi /etc/ipsec.d/idcsubnet1-to-awsvpc1.secrets #配置方式 源ID 目的ID:PSK “密码” 密码两端要配置相同@H_502_40@
@H_502_40@@H_502_40@@H_502_40@本端公网地址 对端公网地址: PSK "123456"@H_502_40@
配置完成后,建立VPN的两端都需要重启ipsec服务加载配置文件,笔者就是在建VPN时,没有重启中心端的ipsec服务,导致VPN一直建立不起来,相关命令 #service ipsec start/stop/restart@H_502_40@@H_502_40@@H_502_40@@H_502_40@
设置开机启动 ,命令#@H_502_40@@H_502_40@chkconfig ipsec on
命令#ipsec verify,没有fail项即可
命令#service ipsec status ,检查进程状态,tunnel up数量
命令#ip xfrm policy,检查tunnel的详细信息,源/目的subnet、下一跳等@H_502_40@