linux下搭建Ipsec+L2TP VPN服务（线上）

归志宁无五亩园，读书本意在元元。这篇文章主要讲述linux下搭建Ipsec+L2TP VPN服务（线上）相关的知识，希望能为你提供帮助。
安装软件及依赖包

yum -y install epel-release
yum -y install ipsec-tools
yum -y install gmp gmp-devel gawk flex bison
yum -y install openswan ppp xl2tpd

内核调优：cat /etc/sysctl.conf

net.ipv4.ip_forward = 1
net.ipv4.conf.default.rp_filter = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0
net.ipv4.conf.all.log_martians = 0
net.ipv4.conf.default.log_martians = 0
net.ipv4.conf.default.accept_source_route = 0
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv4.icmp_ignore_bogus_error_responses = 1
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0

net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_fin_timeout = 30
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_tw_recycle = 1
net.ipv4.ip_local_port_range = 1000 65000
net.ipv4.tcp_max_syn_backlog = 8192
net.ipv4.tcp_max_tw_buckets = 5000

kernel.shmmax = 67108864
fs.file-max = 65535

修改ipsec的配置文件：

cd /etc/ipsec.d/
ls ./*.conf|xargs -I mv .bak
vim L2TP.conf
cat /etc/ipsec.d/L2TP.conf
conn L2TP-PSK-NAT
rightsubnet=vhost:%priv
also=L2TP-PSK-noNAT

conn L2TP-PSK-noNAT
authby=secret
pfs=no
auto=add
keyingtries=3
rekey=no
ikelifetime=8h
keylife=1h
type=transport
left=165.227.2.134
leftprotoport=17/1701
right=%any
rightprotoport=17/%any

4.配置IPSEC的密钥：

165.227.2.134 %any: PSK "123456"

验证IPSEC的运行状态：只要没有faild即可

6. 编辑/etc/xl2tpd/xl2tpd.conf

7.编辑/etc/ppp/options.xl2tpd

设置VPN账户密码：

【linux下搭建Ipsec+L2TP VPN服务（线上）】启动服务：

防火墙测量设置：
主要是以下几条要添加即可.

iptables -A FORWARD -s 10.0.0.0/8 -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j TCPMSS --set-mss 1356
iptables -t nat -A POSTROUTING -s 10.0.0.0/8 -j SNAT --to-source 165.227.2.134
iptables -I INPUT -p udp -m udp -m state --state NEW --dport 1701 -j ACCEPT
iptables -I INPUT -p udp -m udp -m state --state NEW --dport 500 -j ACCEPT
iptables -I INPUT -p esp -j ACCEPT
/etc/init.d/iptables save

苹果手机测试：

电脑端测试：VPN.pbk