CentOS 7 中使用 PPTP、L2TP、IPSec 搭建 VPN 服务

# 查看主机是否支持pptp，返回结果为yes就表示通过
modprobe ppp-compress-18 && echo yes

# 查看是否开启了TUN
# 有的虚拟机主机需要开启，返回结果为**cat: /dev/net/tun: File descriptor in bad state**。就表示通过。
cat /dev/net/tun

yum install -y epel-release
yum update
yum install -y libreswan ppp pptp pptpd xl2tpd wget libreswan lsof

# /etc/ipsec.conf - Libreswan IPsec configuration file
#
# Manual:     ipsec.conf.5

config setup
    # Normally, pluto logs via syslog. If you want to log to a file,
    # specify below or to disable logging, eg for embedded systems, use
    # the file name /dev/null
    # Note: SElinux policies might prevent pluto writing to a log file at
    #       an unusual location.
    #logfile=/var/log/pluto.log
    #
    # Do not enable debug options to debug configuration issues!
    #
    # plutodebug "all", "none" or a combation from below:
    # "raw crypt parsing emitting control controlmore kernel pfkey
    #  natt x509 dpd dns oppo oppoinfo private".
    # Note: "private" is not included with "all", as it can show confidential
    #       information. It must be specifically specified
    # examples:
    # plutodebug="control parsing"
    # plutodebug="all crypt"
    # Again: only enable plutodebug when asked by a developer
    #plutodebug=none
    #
    # NAT-TRAVERSAL support
    nat_traversal=yes
    # exclude networks used on server side by adding %v4:!a.b.c.0/24
    # It seems that T-Mobile in the US and Rogers/Fido in Canada are
    # using 25/8 as "private" address space on their wireless networks.
    # This range has never been announced via BGP (at least up to 2015)
    virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:25.0.0.0/8,%v4:100.64.0.0/10,%v6:fd00::/8,%v6:fe80::/10
    oe=off
    protostack=netkey 
	force_keepalive=yes 
	keep_alive=1800 
conn L2TP-PSK-NAT 
	rightsubnet=vhost:%priv 
	also=L2TP-PSK-noNAT 
conn L2TP-PSK-noNAT 
	authby=secret 
	pfs=no 
	auto=add 
	keyingtries=3 
	rekey=no 
	ikelifetime=8h 
	keylife=1h 
	type=transport 
	# your IP addr
	left=your IP addr
	leftid=your IP addr
	leftprotoport=17/1701 
	right=%any 
	rightprotoport=17/%any 
	dpddelay=40 
	dpdtimeout=130 
	dpdaction=clear

# For example connections, see your distribution's documentation directory,
# or https://libreswan.org/wiki/
#
# There is also a lot of information in the manual page, "man ipsec.conf"
#
# It is best to add your IPsec connections as separate files in /etc/ipsec.d/
include /etc/ipsec.d/*.conf

# include /etc/ipsec.d/*.secrets
192.168.1.100 %any: PSK "password"

localip 192.168.0.1
remoteip 192.168.0.234-238,192.168.0.245

[global]
listen-addr = 192.168.1.100 # 去掉前面的分号，并将=后面改为服务器本地IP
auth file = /etc/ppp/chap-secrets
;port = 1701
;
; requires openswan-2.5.18 or higher - Also does not yet work in combination
; with kernel mode l2tp as present in linux 2.6.23+
ipsec saref = yes
; Use refinfo of 22 if using an SAref kernel patch based on openswan 2.6.35 or
;  when using any of the SAref kernel patches for kernels up to 2.6.35.
; saref refinfo = 30
;
; force userspace = yes
;
; debug tunnel = yes
; 一般不需要特殊配置以下内容不需要改动

[lns default]
ip range = 192.168.1.128-192.168.1.254 #设置ip池，ip range是分配给用户的ip，有多少个用户就需要分配多少ip，所以建议分配多一点
local ip = 192.168.1.99 # local ip是分配给本机的ip

require chap = yes
refuse pap = yes
require authentication = yes
name = LinuxVPNserver
ppp debug = yes
pppoptfile = /etc/ppp/options.xl2tpd
length bit = yes

ms-dns 8.8.4.4 
ms-dns 8.8.8.8

require-mschap-v2
ipcp-accept-local
ipcp-accept-remote
ms-dns  8.8.8.8
ms-dns  8.8.4.4
# ms-dns  192.168.1.1
# ms-dns  192.168.1.3
# ms-wins 192.168.1.2
# ms-wins 192.168.1.4
noccp
auth
hide-password
name l2tpd
crtscts
idle 1800
mtu 1410
mru 1410
nodefaultroute
debug
lock
proxyarp
lcp-echo-interval 30
lcp-echo-failure 4
noccp
connect-delay 5000

# Secrets for authentication using CHAP
# client        server  secret                  IP addresses
username    pptpd   password                    *
username    l2tpd   password                    *

net.ipv4.ip_forward = 1 // 此处的值改为1，开启内核转发
net.ipv4.conf.all.rp_filter = 0 
net.ipv4.conf.default.rp_filter = 0 
net.ipv4.conf.all.send_redirects = 0 
net.ipv4.conf.default.send_redirects = 0 
net.ipv4.conf.all.accept_redirects = 0 
net.ipv4.conf.default.accept_redirects = 0

sudo firewall-cmd --reload
sudo firewall-cmd --permanent --add-service=pptpd
sudo firewall-cmd --permanent --add-service=l2tpd
sudo firewall-cmd --permanent --add-service=ipsec
sudo firewall-cmd --permanent --add-masquerade
sudo firewall-cmd --permanent --direct --add-rule ipv4 filter FORWARD 0 -p tcp -i ppp+ -j TCPMSS --syn --set-mss 1356
sudo firewall-cmd --reload

xl2tpd[18684]: Enabling IPsec SAref processing for L2TP transport mode SAs
xl2tpd[18684]: IPsec SAref does not work with L2TP kernel mode yet, enabling force userspace=yes
xl2tpd[18684]: setsockopt recvref[30]: Protocol not available
xl2tpd[18684]: Not looking for kernel support.
xl2tpd[18684]: xl2tpd version xl2tpd-1.3.8 started on lingfeng PID:18684
xl2tpd[18684]: Written by Mark Spencer, Copyright (C) 1998, Adtran, Inc.
xl2tpd[18684]: Forked by Scott Balmos and David Stipp, (C) 2001
xl2tpd[18684]: Inherited by Jeff McAdams, (C) 2002
xl2tpd[18684]: Forked again by Xelerance (www.xelerance.com) (C) 2006-2016
xl2tpd[18684]: Listening on IP address 0.0.0.0, port 1701

Verifying installed system and configuration files

Version check and ipsec on-path                         [OK]
Libreswan 3.23 (netkey) on 3.10.0-862.9.1.el7.x86_64
Checking for IPsec support in kernel                    [OK]
 NETKEY: Testing XFRM related proc values
         ICMP default/send_redirects                    [OK]
         ICMP default/accept_redirects                  [OK]
         XFRM larval drop                               [OK]
Pluto ipsec.conf syntax                                 [OK]
Two or more interfaces found, checking IP forwarding    [OK]
Checking rp_filter                                      [ENABLED]
 /proc/sys/net/ipv4/conf/br-9170defe050d/rp_filter      [ENABLED]
 /proc/sys/net/ipv4/conf/docker0/rp_filter              [ENABLED]
 /proc/sys/net/ipv4/conf/eth0/rp_filter                 [ENABLED]
 /proc/sys/net/ipv4/conf/ip_vti0/rp_filter              [ENABLED]
 /proc/sys/net/ipv4/conf/vethabd2823/rp_filter          [ENABLED]
  rp_filter is not fully aware of IPsec and should be disabled
Checking that pluto is running                          [OK]
 Pluto listening for IKE on udp 500                     [OK]
 Pluto listening for IKE/NAT-T on udp 4500              [OK]
 Pluto ipsec.secret syntax                              [UNKNOWN]
 (run ipsec verify as root to test ipsec.secrets)
Checking 'ip' command                                   [OK]
Checking 'iptables' command                             [OK]
Checking 'prelink' command does not interfere with FIPS [OK]
Checking for obsolete ipsec.conf options                [OBSOLETE KEYWORD]
 Warning: ignored obsolete keyword 'nat_traversal'
 Warning: ignored obsolete keyword 'oe'
 Warning: ignored obsolete keyword 'force_keepalive'

ipsec verify: encountered 11 errors - see 'man ipsec_verify' for help

systemctl enable pptpd ipsec xl2tpd

systemctl restart pptpd ipsec xl2tpd