Update docs
This commit is contained in:
hwdsl2
parent
a3dae331b8
commit
215c9030ba
@ -253,6 +253,8 @@ sh vpnsetup.sh
|
||||
wget https://git.io/ikev2setup -O ikev2.sh && sudo bash ikev2.sh --auto
|
||||
```
|
||||
|
||||
以上命令使用自动模式和默认选项运行 <a href="docs/ikev2-howto-zh.md#使用辅助脚本" target="_blank">IKEv2 辅助脚本</a>。如果你想要自定义 IKEv2 安装选项，请在运行脚本时去掉 `--auto` 参数。
|
||||
|
||||
**注：** 如果无法通过 `wget` 下载，你也可以打开 <a href="vpnsetup.sh" target="_blank">vpnsetup.sh</a>，<a href="vpnsetup_centos.sh" target="_blank">vpnsetup_centos.sh</a> 或者 <a href="vpnsetup_amzn.sh" target="_blank">vpnsetup_amzn.sh</a>，然后点击右方的 **`Raw`** 按钮。按快捷键 `Ctrl-A` 全选， `Ctrl-C` 复制，然后粘贴到你喜欢的编辑器。
|
||||
|
||||
## 下一步
|
||||
|
||||
@ -253,6 +253,8 @@ After successful installation, it is recommended to <a href="docs/ikev2-howto.md
|
||||
wget https://git.io/ikev2setup -O ikev2.sh && sudo bash ikev2.sh --auto
|
||||
```
|
||||
|
||||
The command above runs the <a href="docs/ikev2-howto.md#using-helper-scripts" target="_blank">IKEv2 helper script</a> in auto mode, using default options. Remove the `--auto` parameter if you want to customize IKEv2 setup options.
|
||||
|
||||
**Note:** If unable to download via `wget`, you may also open <a href="vpnsetup.sh" target="_blank">vpnsetup.sh</a>, <a href="vpnsetup_centos.sh" target="_blank">vpnsetup_centos.sh</a> or <a href="vpnsetup_amzn.sh" target="_blank">vpnsetup_amzn.sh</a>, and click the **`Raw`** button on the right. Press `Ctrl-A` to select all, `Ctrl-C` to copy, then paste into your favorite editor.
|
||||
|
||||
## Next steps
|
||||
|
||||
@ -2,6 +2,8 @@
|
||||
|
||||
*其他语言版本: [English](ikev2-howto.md), [简体中文](ikev2-howto-zh.md).*
|
||||
|
||||
**注：** 你也可以使用 [IPsec/L2TP](clients-zh.md) 或者 [IPsec/XAuth](clients-xauth-zh.md) 模式连接。
|
||||
|
||||
* [导言](#导言)
|
||||
* [使用辅助脚本](#使用辅助脚本)
|
||||
* [配置 IKEv2 VPN 客户端](#配置-ikev2-vpn-客户端)
|
||||
@ -13,7 +15,7 @@
|
||||
|
||||
## 导言
|
||||
|
||||
现代操作系统（比如 Windows 7 和更新版本）支持 IKEv2 协议标准。因特网密钥交换 （英语：Internet Key Exchange，简称 IKE 或 IKEv2）是一种网络协议，归属于 IPsec 协议族之下，用以创建安全关联 (Security Association, SA)。与 IKE 版本 1 相比较，IKEv2 的 <a href="https://en.wikipedia.org/wiki/Internet_Key_Exchange#Improvements_with_IKEv2" target="_blank">功能改进</a> 包括比如通过 MOBIKE 实现 Standard Mobility 支持，以及更高的可靠性。
|
||||
现代操作系统（比如 Windows 7 和更新版本）支持 IKEv2 协议标准。因特网密钥交换（英语：Internet Key Exchange，简称 IKE 或 IKEv2）是一种网络协议，归属于 IPsec 协议族之下，用以创建安全关联 (Security Association, SA)。与 IKE 版本 1 相比较，IKEv2 的 <a href="https://en.wikipedia.org/wiki/Internet_Key_Exchange#Improvements_with_IKEv2" target="_blank">功能改进</a> 包括比如通过 MOBIKE 实现 Standard Mobility 支持，以及更高的可靠性。
|
||||
|
||||
Libreswan 支持通过使用 RSA 签名算法的 X.509 Machine Certificates 来对 IKEv2 客户端进行身份验证。该方法无需 IPsec PSK, 用户名或密码。它可以用于以下系统：
|
||||
|
||||
@ -28,23 +30,21 @@ Libreswan 支持通过使用 RSA 签名算法的 X.509 Machine Certificates 来
|
||||
|
||||
**新：** 辅助脚本现在可以为 macOS 和 iOS 客户端创建 .mobileconfig 文件，以简化客户端设置并提高 VPN 性能。
|
||||
|
||||
**重要：** 作为使用本指南的先决条件，在继续之前，你必须确保你已经成功地 <a href="../README-zh.md" target="_blank">搭建自己的 VPN 服务器</a>，并且（可选但推荐）将 Libreswan <a href="../README-zh.md#升级libreswan" target="_blank">升级</a> 到最新版本。**Docker 用户请看 <a href="https://github.com/hwdsl2/docker-ipsec-vpn-server/blob/master/README-zh.md#配置并使用-ikev2-vpn" target="_blank">这里</a>**。
|
||||
**重要：** 在继续之前，你应该已经成功地 <a href="../README-zh.md" target="_blank">搭建自己的 VPN 服务器</a>，并且（可选但推荐）<a href="../README-zh.md#升级libreswan" target="_blank">升级 Libreswan</a>。**Docker 用户请看 <a href="https://github.com/hwdsl2/docker-ipsec-vpn-server/blob/master/README-zh.md#配置并使用-ikev2-vpn" target="_blank">这里</a>**。
|
||||
|
||||
你可以使用这个辅助脚本来自动地在 VPN 服务器上配置 IKEv2：
|
||||
使用这个辅助脚本来自动地在 VPN 服务器上配置 IKEv2：
|
||||
|
||||
```
|
||||
wget https://git.io/ikev2setup -O ikev2.sh && sudo bash ikev2.sh --auto
|
||||
```
|
||||
|
||||
该 <a href="../extras/ikev2setup.sh" target="_blank">脚本</a> 必须使用 `bash` 而不是 `sh` 运行。以上命令使用自动模式和默认选项运行辅助脚本。如果你想要自定义 IKEv2 安装选项，请在运行脚本时去掉 `--auto` 参数。
|
||||
|
||||
在完成之后，请转到 [配置 IKEv2 VPN 客户端](#配置-ikev2-vpn-客户端)。如果要为更多的客户端生成证书，只需重新运行脚本。
|
||||
该 <a href="../extras/ikev2setup.sh" target="_blank">脚本</a> 必须使用 `bash` 而不是 `sh` 运行。以上命令使用自动模式和默认选项运行辅助脚本。如果你想要自定义 IKEv2 安装选项，请在运行脚本时去掉 `--auto` 参数。在完成之后，请转到 [配置 IKEv2 VPN 客户端](#配置-ikev2-vpn-客户端)。
|
||||
|
||||
## 配置 IKEv2 VPN 客户端
|
||||
|
||||
*其他语言版本: [English](ikev2-howto.md#configure-ikev2-vpn-clients), [简体中文](ikev2-howto-zh.md#配置-ikev2-vpn-客户端).*
|
||||
|
||||
**注：** 如果你在配置 IKEv2 时指定了服务器的域名（而不是 IP 地址），则必须在 **服务器地址** 和 **远程 ID** 字段中输入该域名。如果要为更多的客户端生成证书，只需重新运行[辅助脚本](#使用辅助脚本)。或者你可以看 [这一小节](#手动在-vpn-服务器上配置-ikev2) 的第 4 步。
|
||||
**注：** 如果你在配置 IKEv2 时指定了服务器的域名（而不是 IP 地址），则必须在 **服务器地址** 和 **远程 ID** 字段中输入该域名（如果适用）。如果要为更多的客户端生成证书，只需重新运行[辅助脚本](#使用辅助脚本)。或者你可以看 [这一小节](#手动在-vpn-服务器上配置-ikev2) 的第 4 步。
|
||||
|
||||
* [Windows 7, 8.x 和 10](#windows-7-8x-和-10)
|
||||
* [OS X (macOS)](#os-x-macos)
|
||||
@ -203,7 +203,7 @@ wget https://git.io/ikev2setup -O ikev2.sh && sudo bash ikev2.sh --auto
|
||||
|
||||
### 导出一个客户端证书
|
||||
|
||||
在默认情况下，IKEv2 [辅助脚本](#使用辅助脚本) 在运行后会导出客户端证书。如果你想要手动导出一个客户端证书，首先检查证书数据库：`certutil -L -d sql:/etc/ipsec.d`，然后参见 [这一小节](#手动在-vpn-服务器上配置-ikev2) 第 4 步中的 "导出 `.p12` 文件"。
|
||||
在默认情况下，[IKEv2 辅助脚本](#使用辅助脚本) 在运行后会导出客户端证书。如果你想要手动导出一个客户端证书，首先检查证书数据库：`certutil -L -d sql:/etc/ipsec.d`，然后参见 [这一小节](#手动在-vpn-服务器上配置-ikev2) 第 4 步中的 "导出 `.p12` 文件"。
|
||||
|
||||
### 吊销一个客户端证书
|
||||
|
||||
|
||||
@ -2,6 +2,8 @@
|
||||
|
||||
*Read this in other languages: [English](ikev2-howto.md), [简体中文](ikev2-howto-zh.md).*
|
||||
|
||||
**Note:** You may also connect using [IPsec/L2TP](clients.md) or [IPsec/XAuth](clients-xauth.md) mode.
|
||||
|
||||
* [Introduction](#introduction)
|
||||
* [Using helper scripts](#using-helper-scripts)
|
||||
* [Configure IKEv2 VPN clients](#configure-ikev2-vpn-clients)
|
||||
@ -28,23 +30,21 @@ After following this guide, you will be able to connect to the VPN using IKEv2 i
|
||||
|
||||
**New:** For macOS and iOS clients, the helper script can now create .mobileconfig files to simplify client setup and improve VPN performance.
|
||||
|
||||
**Important:** As a prerequisite to using this guide, and before continuing, you must make sure that you have successfully <a href="https://github.com/hwdsl2/setup-ipsec-vpn" target="_blank">set up your own VPN server</a>, and (optional but recommended) <a href="../README.md#upgrade-libreswan" target="_blank">upgraded Libreswan</a> to the latest version. **Docker users, see <a href="https://github.com/hwdsl2/docker-ipsec-vpn-server/blob/master/README.md#configure-and-use-ikev2-vpn" target="_blank">here</a>**.
|
||||
**Important:** Before continuing, you should have successfully <a href="https://github.com/hwdsl2/setup-ipsec-vpn" target="_blank">set up your own VPN server</a>, and (optional but recommended) <a href="../README.md#upgrade-libreswan" target="_blank">updated Libreswan</a>. **Docker users, see <a href="https://github.com/hwdsl2/docker-ipsec-vpn-server/blob/master/README.md#configure-and-use-ikev2-vpn" target="_blank">here</a>**.
|
||||
|
||||
You may use this helper script to automatically set up IKEv2 on the VPN server:
|
||||
Use this helper script to automatically set up IKEv2 on the VPN server:
|
||||
|
||||
```
|
||||
wget https://git.io/ikev2setup -O ikev2.sh && sudo bash ikev2.sh --auto
|
||||
```
|
||||
|
||||
The <a href="../extras/ikev2setup.sh" target="_blank">script</a> must be run using `bash`, not `sh`. The command above runs the helper script in auto mode, using default options. Remove the `--auto` parameter if you want to customize IKEv2 setup options.
|
||||
|
||||
When finished, continue to [configure IKEv2 VPN clients](#configure-ikev2-vpn-clients). If you want to generate certificates for additional VPN clients, just run the script again.
|
||||
The <a href="../extras/ikev2setup.sh" target="_blank">script</a> must be run using `bash`, not `sh`. The command above runs the helper script in auto mode, using default options. Remove the `--auto` parameter if you want to customize IKEv2 setup options. When finished, continue to [configure IKEv2 VPN clients](#configure-ikev2-vpn-clients).
|
||||
|
||||
## Configure IKEv2 VPN clients
|
||||
|
||||
*Read this in other languages: [English](ikev2-howto.md#configure-ikev2-vpn-clients), [简体中文](ikev2-howto-zh.md#配置-ikev2-vpn-客户端).*
|
||||
|
||||
**Note:** If you specified the server's DNS name (instead of its IP address) during IKEv2 setup, you must enter the DNS name in the **Server** and **Remote ID** fields. If you want to generate certificates for additional VPN clients, just run the [helper script](#using-helper-scripts) again. Or you may refer to step 4 in [this section](#manually-set-up-ikev2-on-the-vpn-server).
|
||||
**Note:** If you specified the server's DNS name (instead of its IP address) during IKEv2 setup, you must enter the DNS name in the **Server** and **Remote ID** fields (if applicable). If you want to generate certificates for additional VPN clients, just run the [helper script](#using-helper-scripts) again. Or you may refer to step 4 in [this section](#manually-set-up-ikev2-on-the-vpn-server).
|
||||
|
||||
* [Windows 7, 8.x and 10](#windows-7-8x-and-10)
|
||||
* [OS X (macOS)](#os-x-macos)
|
||||
@ -203,7 +203,7 @@ If you want to generate certificates for additional VPN clients, just run the [h
|
||||
|
||||
### Export a client certificate
|
||||
|
||||
By default, the IKEv2 [helper script](#using-helper-scripts) exports client certificates after running. If you want to manually export a client certificate, first check the database with `certutil -L -d sql:/etc/ipsec.d`, then refer to "export `.p12` file" in step 4 of [this section](#manually-set-up-ikev2-on-the-vpn-server).
|
||||
By default, the [IKEv2 helper script](#using-helper-scripts) exports client certificates after running. If you want to manually export a client certificate, first check the database with `certutil -L -d sql:/etc/ipsec.d`, then refer to "export `.p12` file" in step 4 of [this section](#manually-set-up-ikev2-on-the-vpn-server).
|
||||
|
||||
### Revoke a client certificate
|
||||
|
||||
|
||||
Loading…
Reference in New Issue
Block a user