Update docs
This commit is contained in:
hwdsl2
parent
9cd6cb50b7
commit
087306dbf5
18
README-zh.md
18
README-zh.md
@ -28,7 +28,7 @@ IPsec VPN 可以加密你的网络流量，以防止在通过因特网传送时
|
||||
|
||||
## 快速开始
|
||||
|
||||
首先，在你的 Linux 服务器* 上全新安装一个 Ubuntu LTS, Debian 或者 CentOS 系统。
|
||||
首先，在你的 Linux 服务器[*](#quick-start-note) 上全新安装一个 Ubuntu LTS, Debian 或者 CentOS 系统。
|
||||
|
||||
使用以下命令快速搭建 IPsec VPN 服务器：
|
||||
|
||||
@ -42,6 +42,7 @@ wget https://git.io/vpnsetup -O vpnsetup.sh && sudo sh vpnsetup.sh
|
||||
|
||||
如需了解其它安装选项，以及如何配置 VPN 客户端，请继续阅读以下部分。
|
||||
|
||||
<a name="quick-start-note"></a>
|
||||
\* 一个专用服务器或者虚拟专用服务器 (VPS)。OpenVZ VPS 不受支持。
|
||||
|
||||
## 功能特性
|
||||
@ -66,9 +67,9 @@ wget https://git.io/vpnsetup -O vpnsetup.sh && sudo sh vpnsetup.sh
|
||||
|
||||
**-或者-**
|
||||
|
||||
一个专用服务器，或者基于 KVM/Xen 的虚拟专用服务器 (VPS)，全新安装以上操作系统之一。OpenVZ VPS 不受支持，用户可以尝试使用比如 <a href="https://shadowsocks.org" target="_blank">Shadowsocks</a> 或者 <a href="https://github.com/Nyr/openvpn-install" target="_blank">OpenVPN</a>。
|
||||
一个专用服务器，或者基于 KVM/Xen 的虚拟专用服务器 (VPS)，全新安装以上操作系统之一。OpenVZ VPS 不受支持，用户可以另外尝试比如 <a href="https://shadowsocks.org" target="_blank">Shadowsocks</a> 或者 <a href="https://github.com/Nyr/openvpn-install" target="_blank">OpenVPN</a>。
|
||||
|
||||
这也包括各种公共云服务中的 Linux 虚拟机，比如 <a href="https://blog.ls20.com/digitalocean" target="_blank">DigitalOcean</a>, <a href="https://blog.ls20.com/vultr" target="_blank">Vultr</a>, <a href="https://blog.ls20.com/linode" target="_blank">Linode</a>, <a href="https://cloud.google.com/compute/" target="_blank">Google Compute Engine</a>, <a href="https://amazonlightsail.com" target="_blank">Amazon Lightsail</a>, <a href="https://azure.microsoft.com" target="_blank">Microsoft Azure</a>, <a href="http://www.softlayer.com/" target="_blank">IBM SoftLayer</a>, <a href="https://www.ovh.com/us/vps/" target="_blank">OVH</a> 和 <a href="https://www.rackspace.com" target="_blank">Rackspace</a>。
|
||||
这也包括各种公共云服务中的 Linux 虚拟机，比如 <a href="https://blog.ls20.com/digitalocean" target="_blank">DigitalOcean</a>, <a href="https://blog.ls20.com/vultr" target="_blank">Vultr</a>, <a href="https://blog.ls20.com/linode" target="_blank">Linode</a>, <a href="https://cloud.google.com/compute/" target="_blank">Google Compute Engine</a>, <a href="https://amazonlightsail.com" target="_blank">Amazon Lightsail</a>, <a href="https://azure.microsoft.com" target="_blank">Microsoft Azure</a>, <a href="https://www.ibm.com/cloud-computing/bluemix/virtual-servers" target="_blank">IBM Bluemix</a>, <a href="https://www.ovh.com/us/vps/" target="_blank">OVH</a> 和 <a href="https://www.rackspace.com" target="_blank">Rackspace</a>。
|
||||
|
||||
<a href="azure/README-zh.md" target="_blank"><img src="docs/images/azure-deploy-button.png" alt="Deploy to Azure" /></a> <a href="http://dovpn.carlfriess.com/" target="_blank"><img src="docs/images/do-install-button.png" alt="Install on DigitalOcean" /></a> <a href="https://www.linode.com/stackscripts/view/37239" target="_blank"><img src="docs/images/linode-deploy-button.png" alt="Deploy to Linode" /></a>
|
||||
|
||||
@ -124,10 +125,11 @@ VPN_PASSWORD='你的VPN密码' sh vpnsetup.sh
|
||||
|
||||
配置你的计算机或其它设备使用 VPN 。请参见：
|
||||
|
||||
<a href="docs/clients-zh.md" target="_blank">配置 IPsec/L2TP VPN 客户端</a>
|
||||
<a href="docs/clients-xauth-zh.md" target="_blank">配置 IPsec/XAuth ("Cisco IPsec") VPN 客户端</a>
|
||||
<a href="docs/clients-zh.md" target="_blank">**配置 IPsec/L2TP VPN 客户端**</a>
|
||||
|
||||
<a href="docs/ikev2-howto-zh.md" target="_blank">如何配置 IKEv2 VPN: Windows 和 Android</a>
|
||||
<a href="docs/clients-xauth-zh.md" target="_blank">**配置 IPsec/XAuth ("Cisco IPsec") VPN 客户端**</a>
|
||||
|
||||
<a href="docs/ikev2-howto-zh.md" target="_blank">**如何配置 IKEv2 VPN: Windows 和 Android**</a>
|
||||
|
||||
如果在连接过程中遇到错误，请参见 <a href="docs/clients-zh.md#故障排除" target="_blank">故障排除</a>。
|
||||
|
||||
@ -139,7 +141,7 @@ VPN_PASSWORD='你的VPN密码' sh vpnsetup.sh
|
||||
|
||||
**Windows 用户** 在首次连接之前需要<a href="docs/clients-zh.md#windows-错误-809" target="_blank">修改一次注册表</a>，以解决 VPN 服务器 和/或 客户端与 NAT （比如家用路由器）的兼容问题。
|
||||
|
||||
同一个 VPN 账户可以在你的多个设备上使用。但是由于 IPsec/L2TP 的局限性，如果需要同时连接在同一个 NAT （比如家用路由器）后面的多个设备到 VPN 服务器，你必须仅使用 <a href="docs/clients-xauth-zh.md" target="_blank">IPsec/XAuth 模式</a>。另外，你的服务器必须运行 [Libreswan 3.19 或更新版本](#升级libreswan)。
|
||||
同一个 VPN 账户可以在你的多个设备上使用。但是由于 IPsec/L2TP 的局限性，如果需要同时连接在同一个 NAT （比如家用路由器）后面的多个设备到 VPN 服务器，你必须仅使用 <a href="docs/clients-xauth-zh.md" target="_blank">IPsec/XAuth 模式</a>。
|
||||
|
||||
对于有外部防火墙的服务器（比如 <a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-network-security.html" target="_blank">EC2</a>/<a href="https://cloud.google.com/compute/docs/vpc/firewalls" target="_blank">GCE</a>），请为 VPN 打开 UDP 端口 500 和 4500。
|
||||
|
||||
@ -155,7 +157,7 @@ VPN_PASSWORD='你的VPN密码' sh vpnsetup.sh
|
||||
|
||||
## 升级Libreswan
|
||||
|
||||
提供两个额外的脚本 <a href="extras/vpnupgrade.sh" target="_blank">vpnupgrade.sh</a> 和 <a href="extras/vpnupgrade_centos.sh" target="_blank">vpnupgrade_centos.sh</a>，可用于升级 <a href="https://libreswan.org" target="_blank">Libreswan</a> （<a href="https://github.com/libreswan/libreswan/blob/master/CHANGES" target="_blank">更新日志</a> | <a href="https://lists.libreswan.org/mailman/listinfo/swan-announce" target="_blank">通知列表</a>）。请在运行前根据需要修改 `swan_ver` 变量。检查已安装版本： `ipsec --version`.
|
||||
提供两个额外的脚本 <a href="extras/vpnupgrade.sh" target="_blank">vpnupgrade.sh</a> 和 <a href="extras/vpnupgrade_centos.sh" target="_blank">vpnupgrade_centos.sh</a>，可用于升级 <a href="https://libreswan.org" target="_blank">Libreswan</a> （<a href="https://github.com/libreswan/libreswan/blob/master/CHANGES" target="_blank">更新日志</a> | <a href="https://lists.libreswan.org/mailman/listinfo/swan-announce" target="_blank">通知列表</a>）。请在运行前根据需要修改 `swan_ver` 变量。查看已安装版本： `ipsec --version`.
|
||||
|
||||
```bash
|
||||
# Ubuntu & Debian
|
||||
|
||||
16
README.md
16
README.md
@ -28,7 +28,7 @@ We will use <a href="https://libreswan.org/" target="_blank">Libreswan</a> as th
|
||||
|
||||
## Quick start
|
||||
|
||||
First, prepare your Linux server* with a fresh install of Ubuntu LTS, Debian or CentOS.
|
||||
First, prepare your Linux server[*](#quick-start-note) with a fresh install of Ubuntu LTS, Debian or CentOS.
|
||||
|
||||
Use this one-liner to set up an IPsec VPN server:
|
||||
|
||||
@ -42,6 +42,7 @@ Your VPN login details will be randomly generated, and displayed on the screen w
|
||||
|
||||
For other installation options and how to set up VPN clients, read the sections below.
|
||||
|
||||
<a name="quick-start-note"></a>
|
||||
\* A dedicated server or virtual private server (VPS). OpenVZ VPS is not supported.
|
||||
|
||||
## Features
|
||||
@ -68,7 +69,7 @@ Please see <a href="https://blog.ls20.com/ipsec-l2tp-vpn-auto-setup-for-ubuntu-1
|
||||
|
||||
A dedicated server or KVM/Xen-based virtual private server (VPS), freshly installed with one of the above OS. OpenVZ VPS is not supported, users could instead try <a href="https://github.com/Nyr/openvpn-install" target="_blank">OpenVPN</a> or <a href="https://shadowsocks.org" target="_blank">Shadowsocks</a>.
|
||||
|
||||
This also includes Linux VMs in public clouds, such as <a href="https://blog.ls20.com/digitalocean" target="_blank">DigitalOcean</a>, <a href="https://blog.ls20.com/vultr" target="_blank">Vultr</a>, <a href="https://blog.ls20.com/linode" target="_blank">Linode</a>, <a href="https://cloud.google.com/compute/" target="_blank">Google Compute Engine</a>, <a href="https://amazonlightsail.com" target="_blank">Amazon Lightsail</a>, <a href="https://azure.microsoft.com" target="_blank">Microsoft Azure</a>, <a href="http://www.softlayer.com/" target="_blank">IBM SoftLayer</a>, <a href="https://www.ovh.com/us/vps/" target="_blank">OVH</a> and <a href="https://www.rackspace.com" target="_blank">Rackspace</a>.
|
||||
This also includes Linux VMs in public clouds, such as <a href="https://blog.ls20.com/digitalocean" target="_blank">DigitalOcean</a>, <a href="https://blog.ls20.com/vultr" target="_blank">Vultr</a>, <a href="https://blog.ls20.com/linode" target="_blank">Linode</a>, <a href="https://cloud.google.com/compute/" target="_blank">Google Compute Engine</a>, <a href="https://amazonlightsail.com" target="_blank">Amazon Lightsail</a>, <a href="https://azure.microsoft.com" target="_blank">Microsoft Azure</a>, <a href="https://www.ibm.com/cloud-computing/bluemix/virtual-servers" target="_blank">IBM Bluemix</a>, <a href="https://www.ovh.com/us/vps/" target="_blank">OVH</a> and <a href="https://www.rackspace.com" target="_blank">Rackspace</a>.
|
||||
|
||||
<a href="azure/README.md" target="_blank"><img src="docs/images/azure-deploy-button.png" alt="Deploy to Azure" /></a> <a href="http://dovpn.carlfriess.com/" target="_blank"><img src="docs/images/do-install-button.png" alt="Install on DigitalOcean" /></a> <a href="https://www.linode.com/stackscripts/view/37239" target="_blank"><img src="docs/images/linode-deploy-button.png" alt="Deploy to Linode" /></a>
|
||||
|
||||
@ -124,10 +125,11 @@ Follow the same steps as above, but replace `https://git.io/vpnsetup` with `http
|
||||
|
||||
Get your computer or device to use the VPN. Please refer to:
|
||||
|
||||
<a href="docs/clients.md" target="_blank">Configure IPsec/L2TP VPN Clients</a>
|
||||
<a href="docs/clients-xauth.md" target="_blank">Configure IPsec/XAuth ("Cisco IPsec") VPN Clients</a>
|
||||
<a href="docs/clients.md" target="_blank">**Configure IPsec/L2TP VPN Clients**</a>
|
||||
|
||||
<a href="docs/ikev2-howto.md" target="_blank">How-To: IKEv2 VPN for Windows and Android</a>
|
||||
<a href="docs/clients-xauth.md" target="_blank">**Configure IPsec/XAuth ("Cisco IPsec") VPN Clients**</a>
|
||||
|
||||
<a href="docs/ikev2-howto.md" target="_blank">**How-To: IKEv2 VPN for Windows and Android**</a>
|
||||
|
||||
If you get an error when trying to connect, see <a href="docs/clients.md#troubleshooting" target="_blank">Troubleshooting</a>.
|
||||
|
||||
@ -139,7 +141,7 @@ Enjoy your very own VPN! :sparkles::tada::rocket::sparkles:
|
||||
|
||||
For **Windows users**, this <a href="docs/clients.md#windows-error-809" target="_blank">one-time registry change</a> is required if the VPN server and/or client is behind NAT (e.g. home router).
|
||||
|
||||
The same VPN account can be used by your multiple devices. However, due to an IPsec/L2TP limitation, if you wish to connect multiple devices simultaneously from behind the same NAT (e.g. home router), you must use only <a href="docs/clients-xauth.md" target="_blank">IPsec/XAuth mode</a>. Also, your server must run [Libreswan 3.19 or newer](#upgrade-libreswan).
|
||||
The same VPN account can be used by your multiple devices. However, due to an IPsec/L2TP limitation, if you wish to connect multiple devices simultaneously from behind the same NAT (e.g. home router), you must use only <a href="docs/clients-xauth.md" target="_blank">IPsec/XAuth mode</a>.
|
||||
|
||||
For servers with an external firewall (e.g. <a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-network-security.html" target="_blank">EC2</a>/<a href="https://cloud.google.com/compute/docs/vpc/firewalls" target="_blank">GCE</a>), open UDP ports 500 and 4500 for the VPN.
|
||||
|
||||
@ -155,7 +157,7 @@ The scripts will backup existing config files before making changes, with `.old-
|
||||
|
||||
## Upgrade Libreswan
|
||||
|
||||
The additional scripts <a href="extras/vpnupgrade.sh" target="_blank">vpnupgrade.sh</a> and <a href="extras/vpnupgrade_centos.sh" target="_blank">vpnupgrade_centos.sh</a> can be used to upgrade <a href="https://libreswan.org" target="_blank">Libreswan</a> (<a href="https://github.com/libreswan/libreswan/blob/master/CHANGES" target="_blank">changelog</a> | <a href="https://lists.libreswan.org/mailman/listinfo/swan-announce" target="_blank">announce</a>). Edit the `swan_ver` variable as necessary. Check installed version: `ipsec --version`.
|
||||
The additional scripts <a href="extras/vpnupgrade.sh" target="_blank">vpnupgrade.sh</a> and <a href="extras/vpnupgrade_centos.sh" target="_blank">vpnupgrade_centos.sh</a> can be used to upgrade <a href="https://libreswan.org" target="_blank">Libreswan</a> (<a href="https://github.com/libreswan/libreswan/blob/master/CHANGES" target="_blank">changelog</a> | <a href="https://lists.libreswan.org/mailman/listinfo/swan-announce" target="_blank">announce</a>). Edit the `swan_ver` variable as necessary. Check which version is installed: `ipsec --version`.
|
||||
|
||||
```bash
|
||||
# Ubuntu & Debian
|
||||
|
||||
@ -20,7 +20,7 @@
|
||||
* [故障排除](#故障排除)
|
||||
* [Windows 错误 809](#windows-错误-809)
|
||||
* [Windows 错误 628](#windows-错误-628)
|
||||
* [Android 6 and 7](#android-6-and-7)
|
||||
* [Android 6 及以上版本](#android-6-及以上版本)
|
||||
* [Chromebook](#chromebook)
|
||||
* [其它错误](#其它错误)
|
||||
* [额外的步骤](#额外的步骤)
|
||||
@ -182,10 +182,10 @@ yum -y install strongswan xl2tpd
|
||||
创建 VPN 变量 （替换为你自己的值）：
|
||||
|
||||
```bash
|
||||
VPN_SERVER_IP='your_vpn_server_ip'
|
||||
VPN_IPSEC_PSK='your_ipsec_pre_shared_key'
|
||||
VPN_USER='your_vpn_username'
|
||||
VPN_PASSWORD='your_vpn_password'
|
||||
VPN_SERVER_IP='你的VPN服务器IP'
|
||||
VPN_IPSEC_PSK='你的IPsec预共享密钥'
|
||||
VPN_USER='你的VPN用户名'
|
||||
VPN_PASSWORD='你的VPN密码'
|
||||
```
|
||||
|
||||
配置 strongSwan：
|
||||
@ -316,13 +316,13 @@ ip route
|
||||
从新的默认路由中排除你的 VPN 服务器 IP （替换为你自己的值）：
|
||||
|
||||
```bash
|
||||
route add YOUR_VPN_SERVER_IP gw X.X.X.X
|
||||
route add 你的VPN服务器IP gw X.X.X.X
|
||||
```
|
||||
|
||||
如果你的 VPN 客户端是一个远程服务器，则必须从新的默认路由中排除你本地电脑的公有 IP，以避免 SSH 会话被断开 （替换为你自己的公有 IP，可在 <a href="https://www.ipchicken.com" target="_blank">这里</a> 查看）：
|
||||
如果你的 VPN 客户端是一个远程服务器，则必须从新的默认路由中排除你的本地电脑的公有 IP，以避免 SSH 会话被断开 （替换为<a href="https://www.ipchicken.com" target="_blank">实际值</a>）：
|
||||
|
||||
```bash
|
||||
route add YOUR_LOCAL_PC_PUBLIC_IP gw X.X.X.X
|
||||
route add 你的本地电脑的公有IP gw X.X.X.X
|
||||
```
|
||||
|
||||
添加一个新的默认路由，并且开始通过 VPN 服务器发送数据：
|
||||
@ -395,13 +395,12 @@ strongswan down myvpn
|
||||
|
||||
|
||||
|
||||
### Android 6 and 7
|
||||
### Android 6 及以上版本
|
||||
|
||||
如果你无法使用 Android 6 (Marshmallow) 或者 7 (Nougat) 连接：
|
||||
如果你无法使用 Android 6 或以上版本连接：
|
||||
|
||||
1. 单击 VPN 连接旁边的设置按钮，选择 "Show advanced options" 并且滚动到底部。如果选项 "Backward compatible mode" 存在，请启用它并重试连接。如果不存在，请尝试下一步。
|
||||
1. **注：** 最新版本的 VPN 脚本已经包含这个更改。
|
||||
（适用于 Android 7.1.2 及以上版本） 编辑 VPN 服务器上的 `/etc/ipsec.conf`。在 `ike=` 和 `phase2alg=` 两行的末尾添加 `,aes256-sha2_512` 字样。保存修改并运行 `service ipsec restart`。(<a href="https://github.com/hwdsl2/setup-ipsec-vpn/commit/f58afbc84ba421216ca2615d3e3654902e9a1852" target="_blank">参见</a>)
|
||||
1. （适用于 Android 7.1.2 及以上版本） 编辑 VPN 服务器上的 `/etc/ipsec.conf`。在 `ike=` 和 `phase2alg=` 两行的末尾添加 `,aes256-sha2_512` 字样。保存修改并运行 `service ipsec restart`。(<a href="https://github.com/hwdsl2/setup-ipsec-vpn/commit/f58afbc84ba421216ca2615d3e3654902e9a1852" target="_blank">参见</a>) 注：最新版本的 VPN 脚本已经包含这个更改。
|
||||
1. 编辑 VPN 服务器上的 `/etc/ipsec.conf`。找到 `sha2-truncbug=yes` 并将它替换为 `sha2-truncbug=no`，开头必须空两格。保存修改并运行 `service ipsec restart`。(<a href="https://libreswan.org/wiki/FAQ#Configuration_Matters" target="_blank">参见</a>)
|
||||
|
||||
|
||||
@ -414,9 +413,9 @@ Chromebook 用户： 如果你无法连接，请尝试 <a href="https://bugs.chr
|
||||
|
||||
如果你遇到其它错误，请参见以下链接：
|
||||
|
||||
* http://www.tp-link.com/en/faq-1029.html
|
||||
* https://documentation.meraki.com/MX-Z/Client_VPN/Troubleshooting_Client_VPN#Common_Connection_Issues
|
||||
* https://blogs.technet.microsoft.com/rrasblog/2009/08/12/troubleshooting-common-vpn-related-errors/
|
||||
* http://www.tp-link.com/en/faq-1029.html
|
||||
|
||||
### 额外的步骤
|
||||
|
||||
@ -433,13 +432,16 @@ service xl2tpd restart
|
||||
|
||||
然后重启你的 VPN 客户端设备，并重试连接。如果仍然无法连接，可以尝试删除并重新创建 VPN 连接，按照本文档中的步骤操作。请确保输入了正确的 VPN 登录凭证。
|
||||
|
||||
检查 Libreswan (IPsec) 日志是否有错误：
|
||||
检查 Libreswan (IPsec) 和 xl2tpd 日志是否有错误：
|
||||
|
||||
```bash
|
||||
# Ubuntu & Debian
|
||||
grep pluto /var/log/auth.log
|
||||
grep xl2tpd /var/log/syslog
|
||||
|
||||
# CentOS & RHEL
|
||||
grep pluto /var/log/secure
|
||||
grep xl2tpd /var/log/messages
|
||||
```
|
||||
|
||||
查看 IPsec VPN 服务器状态：
|
||||
|
||||
@ -20,7 +20,7 @@ An alternative <a href="https://usefulpcguide.com/17318/create-your-own-vpn/" ta
|
||||
* [Troubleshooting](#troubleshooting)
|
||||
* [Windows Error 809](#windows-error-809)
|
||||
* [Windows Error 628](#windows-error-628)
|
||||
* [Android 6 and 7](#android-6-and-7)
|
||||
* [Android 6 and above](#android-6-and-above)
|
||||
* [Chromebook](#chromebook)
|
||||
* [Other errors](#other-errors)
|
||||
* [Additional steps](#additional-steps)
|
||||
@ -319,7 +319,7 @@ Exclude your VPN server's IP from the new default route (replace with actual val
|
||||
route add YOUR_VPN_SERVER_IP gw X.X.X.X
|
||||
```
|
||||
|
||||
If your VPN client is a remote server, you must also exclude your Local PC's public IP from the new default route, to prevent your SSH session from being disconnected (replace with your actual public IP <a href="https://encrypted.google.com/search?q=my+ip" target="_blank">from here</a>):
|
||||
If your VPN client is a remote server, you must also exclude your Local PC's public IP from the new default route, to prevent your SSH session from being disconnected (replace with <a href="https://encrypted.google.com/search?q=my+ip" target="_blank">actual value</a>):
|
||||
|
||||
```bash
|
||||
route add YOUR_LOCAL_PC_PUBLIC_IP gw X.X.X.X
|
||||
@ -394,13 +394,12 @@ To fix this error, please follow these steps:
|
||||
|
||||
|
||||
|
||||
### Android 6 and 7
|
||||
### Android 6 and above
|
||||
|
||||
If you are unable to connect using Android 6 (Marshmallow) or 7 (Nougat):
|
||||
If you are unable to connect using Android 6 or above:
|
||||
|
||||
1. Tap the "Settings" icon next to your VPN profile. Select "Show advanced options" and scroll down to the bottom. If the option "Backward compatible mode" exists, enable it and reconnect the VPN. If not, try the next step.
|
||||
1. **Note:** The latest version of VPN scripts already includes this change.
|
||||
(For Android 7.1.2 and newer) Edit `/etc/ipsec.conf` on the VPN server. Append `,aes256-sha2_512` to the end of both `ike=` and `phase2alg=` lines. Save the file and run `service ipsec restart`. (<a href="https://github.com/hwdsl2/setup-ipsec-vpn/commit/f58afbc84ba421216ca2615d3e3654902e9a1852" target="_blank">Ref</a>)
|
||||
1. (For Android 7.1.2 and newer) Edit `/etc/ipsec.conf` on the VPN server. Append `,aes256-sha2_512` to the end of both `ike=` and `phase2alg=` lines. Save the file and run `service ipsec restart`. (<a href="https://github.com/hwdsl2/setup-ipsec-vpn/commit/f58afbc84ba421216ca2615d3e3654902e9a1852" target="_blank">Ref</a>) Note that the latest version of VPN scripts already includes this change.
|
||||
1. Edit `/etc/ipsec.conf` on the VPN server. Find `sha2-truncbug=yes` and replace it with `sha2-truncbug=no`, indented with two spaces. Save the file and run `service ipsec restart`. (<a href="https://libreswan.org/wiki/FAQ#Configuration_Matters" target="_blank">Ref</a>)
|
||||
|
||||
|
||||
@ -413,9 +412,9 @@ Chromebook users: If you are unable to connect, try <a href="https://bugs.chromi
|
||||
|
||||
If you encounter other errors, refer to the links below:
|
||||
|
||||
* http://www.tp-link.com/en/faq-1029.html
|
||||
* https://documentation.meraki.com/MX-Z/Client_VPN/Troubleshooting_Client_VPN#Common_Connection_Issues
|
||||
* https://blogs.technet.microsoft.com/rrasblog/2009/08/12/troubleshooting-common-vpn-related-errors/
|
||||
* http://www.tp-link.com/en/faq-1029.html
|
||||
|
||||
### Additional steps
|
||||
|
||||
@ -432,13 +431,16 @@ If using Docker, run `docker restart ipsec-vpn-server`.
|
||||
|
||||
Then reboot your VPN client device, and retry the connection. If still unable to connect, try removing and recreating the VPN connection, by following the instructions in this document. Make sure that the VPN credentials are entered correctly.
|
||||
|
||||
Check the Libreswan (IPsec) log for errors:
|
||||
Check the Libreswan (IPsec) and xl2tpd logs for errors:
|
||||
|
||||
```bash
|
||||
# Ubuntu & Debian
|
||||
grep pluto /var/log/auth.log
|
||||
grep xl2tpd /var/log/syslog
|
||||
|
||||
# CentOS & RHEL
|
||||
grep pluto /var/log/secure
|
||||
grep xl2tpd /var/log/messages
|
||||
```
|
||||
|
||||
Check status of the IPsec VPN server:
|
||||
|
||||
@ -7,32 +7,32 @@
|
||||
首先，IPsec PSK (预共享密钥) 保存在文件 `/etc/ipsec.secrets` 中。如果要更换一个新的 PSK，可以编辑此文件。所有的 VPN 用户将共享同一个 IPsec PSK。
|
||||
|
||||
```bash
|
||||
%any %any : PSK "your_ipsec_pre_shared_key"
|
||||
%any %any : PSK "你的IPsec预共享密钥"
|
||||
```
|
||||
|
||||
对于 `IPsec/L2TP`，VPN 用户账户信息保存在文件 `/etc/ppp/chap-secrets`。该文件的格式如下：
|
||||
|
||||
```bash
|
||||
"your_vpn_username_1" l2tpd "your_vpn_password_1" *
|
||||
"your_vpn_username_2" l2tpd "your_vpn_password_2" *
|
||||
"你的VPN用户名1" l2tpd "你的VPN密码1" *
|
||||
"你的VPN用户名2" l2tpd "你的VPN密码2" *
|
||||
... ...
|
||||
```
|
||||
|
||||
你可以添加更多用户，每个用户对应文件中的一行。**不要**在用户名，密码或 PSK 中使用这些字符：`\ " '`
|
||||
你可以添加更多用户，每个用户对应文件中的一行。**不要** 在用户名，密码或 PSK 中使用这些字符：`\ " '`
|
||||
|
||||
对于 `IPsec/XAuth ("Cisco IPsec")`， VPN 用户账户信息保存在文件 `/etc/ipsec.d/passwd`。该文件的格式如下：
|
||||
|
||||
```bash
|
||||
your_vpn_username_1:your_vpn_password_1_hashed:xauth-psk
|
||||
your_vpn_username_2:your_vpn_password_2_hashed:xauth-psk
|
||||
你的VPN用户名1:你的VPN密码1的加盐哈希值:xauth-psk
|
||||
你的VPN用户名2:你的VPN密码2的加盐哈希值:xauth-psk
|
||||
... ...
|
||||
```
|
||||
|
||||
这个文件中的密码以 salted and hashed 的形式保存。该步骤可以借助比如 `openssl` 工具来完成：
|
||||
这个文件中的密码以加盐哈希值的形式保存。该步骤可以借助比如 `openssl` 工具来完成：
|
||||
|
||||
```bash
|
||||
# 以下命令的输出为 your_vpn_password_1_hashed
|
||||
openssl passwd -1 'your_vpn_password_1'
|
||||
# 以下命令的输出为：你的VPN密码1的加盐哈希值
|
||||
openssl passwd -1 '你的VPN密码1'
|
||||
```
|
||||
|
||||
在完成后重启服务：
|
||||
|
||||
Loading…
Reference in New Issue
Block a user