Update docs
- Add troubleshooting section for Android MTU/MSS issues - Remove "Access VPN server's subnet". This seems to work fine using the default configuration, without additional IPTables rules
This commit is contained in:
hwdsl2
parent
b028661f6f
commit
09c68fda01
@ -155,10 +155,10 @@ sh vpnsetup.sh
|
||||
|
||||
同一个 VPN 账户可以在你的多个设备上使用。但是由于 IPsec/L2TP 的局限性，如果需要同时连接在同一个 NAT （比如家用路由器）后面的多个设备到 VPN 服务器，你必须仅使用 <a href="docs/clients-xauth-zh.md" target="_blank">IPsec/XAuth 模式</a>。
|
||||
|
||||
对于有外部防火墙的服务器（比如 <a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-network-security.html" target="_blank">EC2</a>/<a href="https://cloud.google.com/vpc/docs/firewalls" target="_blank">GCE</a>），请为 VPN 打开 UDP 端口 500 和 4500。阿里云用户请参见 [#433](https://github.com/hwdsl2/setup-ipsec-vpn/issues/433)。
|
||||
|
||||
如果需要添加，修改或者删除 VPN 用户账户，请参见 <a href="docs/manage-users-zh.md" target="_blank">管理 VPN 用户</a>。该文档包含辅助脚本，以方便管理 VPN 用户。
|
||||
|
||||
对于有外部防火墙的服务器（比如 <a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-network-security.html" target="_blank">EC2</a>/<a href="https://cloud.google.com/vpc/docs/firewalls" target="_blank">GCE</a>），请为 VPN 打开 UDP 端口 500 和 4500。阿里云用户请参见 [#433](https://github.com/hwdsl2/setup-ipsec-vpn/issues/433)。
|
||||
|
||||
在 VPN 已连接时，客户端配置为使用 <a href="https://developers.google.com/speed/public-dns/" target="_blank">Google Public DNS</a>。如果偏好其它的域名解析服务，编辑 `/etc/ppp/options.xl2tpd` 和 `/etc/ipsec.conf` 并替换 `8.8.8.8` 和 `8.8.4.4`，然后重启服务器。高级用户可以在运行 VPN 脚本时定义 `VPN_DNS_SRV1` 和 `VPN_DNS_SRV2`（可选）。
|
||||
|
||||
使用内核支持有助于提高 IPsec/L2TP 性能。它在以下系统上可用： Ubuntu 16.04-20.04, Debian 9-10 和 CentOS 6-8. Ubuntu 系统需要安装 `linux-modules-extra-$(uname -r)`（或者 `linux-image-extra`），然后运行 `service xl2tpd restart`。
|
||||
|
||||
@ -155,10 +155,10 @@ Enjoy your very own VPN! :sparkles::tada::rocket::sparkles:
|
||||
|
||||
The same VPN account can be used by your multiple devices. However, due to an IPsec/L2TP limitation, if you wish to connect multiple devices simultaneously from behind the same NAT (e.g. home router), you must use only <a href="docs/clients-xauth.md" target="_blank">IPsec/XAuth mode</a>.
|
||||
|
||||
For servers with an external firewall (e.g. <a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-network-security.html" target="_blank">EC2</a>/<a href="https://cloud.google.com/vpc/docs/firewalls" target="_blank">GCE</a>), open UDP ports 500 and 4500 for the VPN. Aliyun users, see [#433](https://github.com/hwdsl2/setup-ipsec-vpn/issues/433).
|
||||
|
||||
If you wish to add, edit or remove VPN user accounts, see <a href="docs/manage-users.md" target="_blank">Manage VPN Users</a>. Helper scripts are included for convenience.
|
||||
|
||||
For servers with an external firewall (e.g. <a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-network-security.html" target="_blank">EC2</a>/<a href="https://cloud.google.com/vpc/docs/firewalls" target="_blank">GCE</a>), open UDP ports 500 and 4500 for the VPN. Aliyun users, see [#433](https://github.com/hwdsl2/setup-ipsec-vpn/issues/433).
|
||||
|
||||
Clients are set to use <a href="https://developers.google.com/speed/public-dns/" target="_blank">Google Public DNS</a> when the VPN is active. If another DNS provider is preferred, replace `8.8.8.8` and `8.8.4.4` in both `/etc/ppp/options.xl2tpd` and `/etc/ipsec.conf`, then reboot your server. Advanced users can define `VPN_DNS_SRV1` and optionally `VPN_DNS_SRV2` when running the VPN setup script.
|
||||
|
||||
Using kernel support could improve IPsec/L2TP performance. It is available on Ubuntu 16.04-20.04, Debian 9-10 and CentOS 6-8. Ubuntu users: Install `linux-modules-extra-$(uname -r)` (or `linux-image-extra`), then run `service xl2tpd restart`.
|
||||
|
||||
@ -209,12 +209,12 @@ Fedora 28 （和更新版本）和 CentOS 8/7 用户可以使用更高效的 [IP
|
||||
* [Windows 10 升级](#windows-10-升级)
|
||||
* [Windows 8/10 DNS 泄漏](#windows-810-dns-泄漏)
|
||||
* [macOS VPN 流量](#macos-vpn-流量)
|
||||
* [Android MTU/MSS 问题](#android-mtumss-问题)
|
||||
* [Android 6 和 7](#android-6-和-7)
|
||||
* [iOS 13 和 macOS 10.15](#ios-13-和-macos-1015)
|
||||
* [iOS/Android 睡眠模式](#iosandroid-睡眠模式)
|
||||
* [Debian 10 内核](#debian-10-内核)
|
||||
* [Chromebook 连接问题](#chromebook-连接问题)
|
||||
* [访问 VPN 服务器的网段](#访问-vpn-服务器的网段)
|
||||
* [其它错误](#其它错误)
|
||||
* [额外的步骤](#额外的步骤)
|
||||
|
||||
@ -288,6 +288,23 @@ OS X (macOS) 用户： 如果你成功地使用 IPsec/L2TP 模式连接，但是
|
||||
|
||||
如果你的计算机仍然不能通过 VPN 连接发送通信，检查一下服务顺序。进入系统偏好设置中的网络部分，单击左侧连接列表下方的齿轮按钮，选择 "设定服务顺序"。然后将 VPN 连接拖动到顶端。
|
||||
|
||||
### Android MTU/MSS 问题
|
||||
|
||||
某些 Android 设备有 MTU/MSS 问题，表现为使用 IPsec/XAuth ("Cisco IPsec") 模式可以连接到 VPN 但是无法打开网站。如果你遇到该问题，尝试在 VPN 服务器上运行以下命令。如果成功解决，你可以将这些命令添加到 `/etc/rc.local` 以使它们重启后继续有效。
|
||||
|
||||
```
|
||||
iptables -t mangle -A FORWARD -m policy --pol ipsec --dir in \
|
||||
-p tcp -m tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1361:1536 \
|
||||
-j TCPMSS --set-mss 1360
|
||||
iptables -t mangle -A FORWARD -m policy --pol ipsec --dir out \
|
||||
-p tcp -m tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1361:1536 \
|
||||
-j TCPMSS --set-mss 1360
|
||||
|
||||
echo 1 > /proc/sys/net/ipv4/ip_no_pmtu_disc
|
||||
```
|
||||
|
||||
参考链接：<a href="https://wiki.strongswan.org/projects/strongswan/wiki/ForwardingAndSplitTunneling#MTUMSS-issues" target="_blank">[1]</a> <a href="https://www.zeitgeist.se/2013/11/26/mtu-woes-in-ipsec-tunnels-how-to-fix/" target="_blank">[2]</a>。
|
||||
|
||||
### Android 6 和 7
|
||||
|
||||
如果你的 Android 6.x 或者 7.x 设备无法连接，请尝试以下步骤：
|
||||
@ -317,22 +334,6 @@ Debian 10 用户： 运行 `uname -r` 以检查你的服务器的 Linux 内核
|
||||
|
||||
Chromebook 用户： 如果你无法连接，请尝试以下步骤：编辑 VPN 服务器上的 `/etc/ipsec.conf`。找到这一行 `phase2alg=...` 并在结尾加上 `,aes_gcm-null` 。保存修改并运行 `service ipsec restart`。
|
||||
|
||||
### 访问 VPN 服务器的网段
|
||||
|
||||
如果要允许 VPN 客户端访问 VPN 服务器所在的网段，你需要在搭建 VPN 服务器之后手动添加 IPTables 规则。例如，如果网段是 `192.168.0.0/24`：
|
||||
|
||||
```
|
||||
# For IPsec/L2TP
|
||||
iptables -I FORWARD 2 -i ppp+ -d 192.168.0.0/24 -j ACCEPT
|
||||
iptables -I FORWARD 2 -s 192.168.0.0/24 -o ppp+ -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
|
||||
|
||||
# For IPsec/XAuth ("Cisco IPsec")
|
||||
iptables -I FORWARD 2 -s 192.168.43.0/24 -d 192.168.0.0/24 -j ACCEPT
|
||||
iptables -I FORWARD 2 -s 192.168.0.0/24 -d 192.168.43.0/24 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
|
||||
```
|
||||
|
||||
为了让这些 IPTables 规则在重启后继续有效，你可以将它们添加到文件 `/etc/iptables.rules` 和/或 `/etc/iptables/rules.v4` (Ubuntu/Debian)，或者 `/etc/sysconfig/iptables` (CentOS/RHEL)。
|
||||
|
||||
### 其它错误
|
||||
|
||||
如果你遇到其它错误，请参见以下链接：
|
||||
|
||||
@ -209,12 +209,12 @@ First check <a href="https://github.com/nm-l2tp/NetworkManager-l2tp/wiki/Prebuil
|
||||
* [Windows 10 upgrades](#windows-10-upgrades)
|
||||
* [Windows 8/10 DNS leaks](#windows-810-dns-leaks)
|
||||
* [macOS VPN traffic](#macos-vpn-traffic)
|
||||
* [Android MTU/MSS issues](#android-mtumss-issues)
|
||||
* [Android 6 and 7](#android-6-and-7)
|
||||
* [iOS 13 and macOS 10.15](#ios-13-and-macos-1015)
|
||||
* [iOS/Android sleep mode](#iosandroid-sleep-mode)
|
||||
* [Debian 10 kernel](#debian-10-kernel)
|
||||
* [Chromebook issues](#chromebook-issues)
|
||||
* [Access VPN server's subnet](#access-vpn-servers-subnet)
|
||||
* [Other errors](#other-errors)
|
||||
* [Additional steps](#additional-steps)
|
||||
|
||||
@ -288,6 +288,23 @@ OS X (macOS) users: If you can successfully connect using IPsec/L2TP mode, but y
|
||||
|
||||
If your computer is still not sending traffic over the VPN check the service order. From the main network preferences screen, select "set service order" in the cog drop down under the list of connections. Drag the VPN connection to the top.
|
||||
|
||||
### Android MTU/MSS issues
|
||||
|
||||
Some Android devices have MTU/MSS issues, that they are able to connect to the VPN using IPsec/XAuth ("Cisco IPsec") mode, but cannot open websites. If you encounter this problem, try running the following commands on the VPN server. If successful, you may add these commands to `/etc/rc.local` to persist after reboot.
|
||||
|
||||
```
|
||||
iptables -t mangle -A FORWARD -m policy --pol ipsec --dir in \
|
||||
-p tcp -m tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1361:1536 \
|
||||
-j TCPMSS --set-mss 1360
|
||||
iptables -t mangle -A FORWARD -m policy --pol ipsec --dir out \
|
||||
-p tcp -m tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1361:1536 \
|
||||
-j TCPMSS --set-mss 1360
|
||||
|
||||
echo 1 > /proc/sys/net/ipv4/ip_no_pmtu_disc
|
||||
```
|
||||
|
||||
References: <a href="https://wiki.strongswan.org/projects/strongswan/wiki/ForwardingAndSplitTunneling#MTUMSS-issues" target="_blank">[1]</a> <a href="https://www.zeitgeist.se/2013/11/26/mtu-woes-in-ipsec-tunnels-how-to-fix/" target="_blank">[2]</a>.
|
||||
|
||||
### Android 6 and 7
|
||||
|
||||
If your Android 6.x or 7.x device cannot connect, try these steps:
|
||||
@ -317,22 +334,6 @@ To fix, you may switch to the standard Linux kernel by installing e.g. the `linu
|
||||
|
||||
Chromebook users: If you are unable to connect, try these steps: Edit `/etc/ipsec.conf` on the VPN server. Find the line `phase2alg=...` and append `,aes_gcm-null` at the end. Save the file and run `service ipsec restart`.
|
||||
|
||||
### Access VPN server's subnet
|
||||
|
||||
If you wish to allow VPN clients to access the VPN server's subnet, you'll need to manually add IPTables rules after setting up the VPN server. For example, if the subnet is `192.168.0.0/24`:
|
||||
|
||||
```
|
||||
# For IPsec/L2TP
|
||||
iptables -I FORWARD 2 -i ppp+ -d 192.168.0.0/24 -j ACCEPT
|
||||
iptables -I FORWARD 2 -s 192.168.0.0/24 -o ppp+ -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
|
||||
|
||||
# For IPsec/XAuth ("Cisco IPsec")
|
||||
iptables -I FORWARD 2 -s 192.168.43.0/24 -d 192.168.0.0/24 -j ACCEPT
|
||||
iptables -I FORWARD 2 -s 192.168.0.0/24 -d 192.168.43.0/24 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
|
||||
```
|
||||
|
||||
To make these IPTables rules persist after reboot, you may add them to file `/etc/iptables.rules` and/or `/etc/iptables/rules.v4` (Ubuntu/Debian), or `/etc/sysconfig/iptables` (CentOS/RHEL).
|
||||
|
||||
### Other errors
|
||||
|
||||
If you encounter other errors, refer to the links below:
|
||||
|
||||
@ -331,10 +331,9 @@ wget https://git.io/ikev2setup -O ikev2setup.sh && sudo bash ikev2setup.sh
|
||||
## 已知问题
|
||||
|
||||
1. Windows 自带的 VPN 客户端可能不支持 IKEv2 fragmentation。在有些网络上，这可能会导致连接错误或其它连接问题。你可以尝试换用 <a href="clients-zh.md" target="_blank">IPsec/L2TP</a> 或 <a href="clients-xauth-zh.md" target="_blank">IPsec/XAuth</a> 模式。
|
||||
1. Ubuntu 18.04 用户在尝试将生成的 `.p12` 文件导入到 Windows 时可能会遇到错误 "输入的密码不正确"。这是由 `NSS` 中的一个问题导致的。更多信息请看 <a href="https://github.com/hwdsl2/setup-ipsec-vpn/issues/414#issuecomment-460495258" target="_blank">这里</a>。
|
||||
1. 如果你使用 strongSwan Android VPN 客户端，则必须将服务器上的 Libreswan <a href="../README-zh.md#升级libreswan" target="_blank">升级</a> 到版本 3.26 或以上。
|
||||
1. 如果你的 VPN 客户端可以连接但是无法打开任何网站，可以尝试编辑服务器上的 `/etc/ipsec.conf`。找到 `conn ikev2-cp` 部分的 `phase2alg=` 一行并删除 `aes_gcm-null,`。保存文件并运行 `service ipsec restart`。
|
||||
1. Ubuntu 18.04 和 CentOS 用户在尝试将生成的 `.p12` 文件导入到 Windows 时可能会遇到错误 "输入的密码不正确"。这是由 `NSS` 中的一个问题导致的。更多信息请看 <a href="https://github.com/hwdsl2/setup-ipsec-vpn/issues/414#issuecomment-460430354" target="_blank">这里</a>。
|
||||
1. 目前还不支持同时连接在同一个 NAT （比如家用路由器）后面的多个 IKEv2 客户端。对于这个用例，请换用 <a href="clients-xauth-zh.md" target="_blank">IPsec/XAuth</a> 模式。
|
||||
|
||||
## 参考链接
|
||||
|
||||
|
||||
@ -331,10 +331,9 @@ Once successfully connected, you can verify that your traffic is being routed pr
|
||||
## Known issues
|
||||
|
||||
1. The built-in VPN client in Windows may not support IKEv2 fragmentation. On some networks, this can cause the connection to fail or have other issues. You may instead try the <a href="clients.md" target="_blank">IPsec/L2TP</a> or <a href="clients-xauth.md" target="_blank">IPsec/XAuth</a> mode.
|
||||
1. Ubuntu 18.04 users may encounter the error "The password you entered is incorrect" when trying to import the generated `.p12` file into Windows. This is due to a bug in `NSS`. Read more <a href="https://github.com/hwdsl2/setup-ipsec-vpn/issues/414#issuecomment-460495258" target="_blank">here</a>.
|
||||
1. If using the strongSwan Android VPN client, you must <a href="../README.md#upgrade-libreswan" target="_blank">upgrade Libreswan</a> on your server to version 3.26 or above.
|
||||
1. If your VPN client can connect but cannot open any website, try editing `/etc/ipsec.conf` on the VPN server. Find the line `phase2alg=` under section `conn ikev2-cp` and delete `aes_gcm-null,`. Save the file and run `service ipsec restart`.
|
||||
1. Ubuntu 18.04 and CentOS users may encounter the error "The password you entered is incorrect" when trying to import the generated `.p12` file into Windows. This is due to a bug in `NSS`. Read more <a href="https://github.com/hwdsl2/setup-ipsec-vpn/issues/414#issuecomment-460430354" target="_blank">here</a>.
|
||||
1. Connecting multiple IKEv2 clients simultaneously from behind the same NAT (e.g. home router) is not supported at this time. For this use case, please instead use <a href="clients-xauth.md" target="_blank">IPsec/XAuth</a> mode.
|
||||
|
||||
## References
|
||||
|
||||
|
||||
Loading…
Reference in New Issue
Block a user