Update docs
This commit is contained in:
hwdsl2
parent
f39c7fd27e
commit
5adab8c444
@ -142,8 +142,6 @@ Libreswan 支持通过使用 RSA 签名算法的 X.509 Machine Certificates 来
|
||||
|
||||
[[支持者] **屏幕录影：** 在 macOS 上导入 IKEv2 配置并连接](https://ko-fi.com/post/Support-this-project-and-get-access-to-supporter-o-X8X5FVFZC)
|
||||
|
||||
**注：** macOS 14 (Sonoma) 存在一个问题，可能会导致 IKEv2 VPN 在 24-48 分钟之后断开连接。其他 macOS 版本不受影响。首先[检查你的 macOS 版本](https://support.apple.com/zh-cn/HT201260)。有关详细信息和解决方法，请参阅 [macOS Sonoma 客户端断开连接](#macos-sonoma-客户端断开连接)。
|
||||
|
||||
首先，将生成的 `.mobileconfig` 文件安全地传送到你的 Mac，然后双击并按提示操作，以导入为 macOS 配置描述文件。如果你的 Mac 运行 macOS Big Sur 或更新版本，打开系统偏好设置并转到描述文件部分以完成导入。对于 macOS Ventura 和更新版本，打开系统设置并搜索描述文件。在完成之后，检查并确保 "IKEv2 VPN" 显示在系统偏好设置 -> 描述文件中。
|
||||
|
||||
要连接到 VPN：
|
||||
@ -190,6 +188,8 @@ Libreswan 支持通过使用 RSA 签名算法的 X.509 Machine Certificates 来
|
||||
|
||||
如果在连接过程中遇到错误，请参见 [故障排除](#ikev2-故障排除)。
|
||||
|
||||
**注：** macOS 14 (Sonoma) 存在一个小问题，可能会导致 IKEv2 VPN 每 24-48 分钟断开并重新连接一次。其他 macOS 版本不受影响。有关详细信息和解决方法，请参阅 [macOS Sonoma 客户端重新连接](#macos-sonoma-客户端重新连接)。
|
||||
|
||||
<details>
|
||||
<summary>
|
||||
删除 IKEv2 VPN 连接。
|
||||
@ -544,7 +544,7 @@ sudo chmod 600 ca.cer client.cer client.key
|
||||
**另见：** [检查日志及 VPN 状态](clients-zh.md#检查日志及-vpn-状态)，[IKEv1 故障排除](clients-zh.md#ikev1-故障排除) 和 [高级用法](advanced-usage-zh.md)。
|
||||
|
||||
* [无法连接到 VPN 服务器](#无法连接到-vpn-服务器)
|
||||
* [macOS Sonoma 客户端断开连接](#macos-sonoma-客户端断开连接)
|
||||
* [macOS Sonoma 客户端重新连接](#macos-sonoma-客户端重新连接)
|
||||
* [无法连接多个 IKEv2 客户端](#无法连接多个-ikev2-客户端)
|
||||
* [IKE 身份验证凭证不可接受](#ike-身份验证凭证不可接受)
|
||||
* [参数错误 policy match error](#参数错误-policy-match-error)
|
||||
@ -561,9 +561,11 @@ sudo chmod 600 ca.cer client.cer client.key
|
||||
|
||||
[检查日志及 VPN 状态](clients-zh.md#检查日志及-vpn-状态)是否有错误。如果你遇到 retransmission 相关错误并且无法连接，说明 VPN 客户端和服务器之间的网络可能有问题。如果你从中国大陆进行连接，请考虑改用 IPsec VPN 以外的其他解决方案。
|
||||
|
||||
### macOS Sonoma 客户端断开连接
|
||||
### macOS Sonoma 客户端重新连接
|
||||
|
||||
macOS 14 (Sonoma) 存在[一个问题](https://github.com/hwdsl2/setup-ipsec-vpn/issues/1486)，可能会导致 IKEv2 VPN 在 24-48 分钟之后断开连接。其他 macOS 版本不受影响。首先[检查你的 macOS 版本](https://support.apple.com/zh-cn/HT201260)。要解决此问题：
|
||||
macOS 14 (Sonoma) 存在[一个小问题](https://github.com/hwdsl2/setup-ipsec-vpn/issues/1486)，可能会导致 IKEv2 VPN 每 24-48 分钟断开并重新连接一次。其他 macOS 版本不受影响。首先[检查你的 macOS 版本](https://support.apple.com/zh-cn/HT201260)。要解决此问题，请按以下步骤操作。
|
||||
|
||||
**注：** 应用此解决方案后，更新后的 VPN 服务器配置可能不适用于 Windows 或 Android 客户端。对于这些客户端，你可能需要在 `ikev2.conf` 中将 `pfs=yes` 更改回 `pfs=no`，然后运行 `service ipsec restart` 或重启 Docker 容器。
|
||||
|
||||
1. 编辑 VPN 服务器上的 `/etc/ipsec.d/ikev2.conf`。首先将 `pfs=no` 替换为 `pfs=yes`。然后找到这些行 `ike=...` 和 `phase2alg=...`，并将它们替换为以下内容，开头必须空两格：
|
||||
```
|
||||
@ -606,8 +608,6 @@ macOS 14 (Sonoma) 存在[一个问题](https://github.com/hwdsl2/setup-ipsec-vpn
|
||||
1. 运行 `sudo ikev2.sh` 为你的每个 macOS 和 iOS (iPhone/iPad) 设备导出（或添加）更新后的客户端配置文件。
|
||||
1. 从你的 macOS 和 iOS 设备中移除之前导入的 IKEv2 配置文件（如果有），然后导入更新后的 `.mobileconfig` 文件。请参阅[配置 IKEv2 VPN 客户端](#配置-ikev2-vpn-客户端)。Docker 用户请看[配置并使用 IKEv2 VPN](https://github.com/hwdsl2/docker-ipsec-vpn-server/blob/master/README-zh.md#配置并使用-ikev2-vpn)。
|
||||
|
||||
**注：** 更新后的 VPN 服务器配置可能不适用于 Windows 或 Android 客户端。对于这些客户端，你可能需要在 `ikev2.conf` 中将 `pfs=yes` 更改回 `pfs=no`，然后运行 `service ipsec restart` 或重启 Docker 容器。
|
||||
|
||||
### 无法连接多个 IKEv2 客户端
|
||||
|
||||
如果要同时连接在同一个 NAT（比如家用路由器）后面的多个 IKEv2 客户端，你需要为每个客户端生成唯一的证书。否则，你可能会遇到稍后连接的客户端影响现有客户端的 VPN 连接，从而导致无法访问 Internet 的问题。
|
||||
|
||||
@ -142,8 +142,6 @@ Using the following steps, you can remove the VPN connection and optionally rest
|
||||
|
||||
[[Supporters] **Screencast:** IKEv2 Import Configuration and Connect on macOS](https://ko-fi.com/post/Support-this-project-and-get-access-to-supporter-o-O5O7FVF8J)
|
||||
|
||||
**Note:** macOS 14 (Sonoma) has an issue that may cause IKEv2 VPN to disconnect after 24-48 minutes. Other macOS versions are not affected. First [check your macOS version](https://support.apple.com/en-us/HT201260). For more details and a workaround, see [macOS Sonoma clients disconnect](#macos-sonoma-clients-disconnect).
|
||||
|
||||
First, securely transfer the generated `.mobileconfig` file to your Mac, then double-click and follow the prompts to import as a macOS profile. If your Mac runs macOS Big Sur or newer, open System Preferences and go to the Profiles section to finish importing. For macOS Ventura and newer, open System Settings and search for Profiles. When finished, check to make sure "IKEv2 VPN" is listed under System Preferences -> Profiles.
|
||||
|
||||
To connect to the VPN:
|
||||
@ -190,6 +188,8 @@ Once connected, you can verify that your traffic is being routed properly by [lo
|
||||
|
||||
If you get an error when trying to connect, see [Troubleshooting](#ikev2-troubleshooting).
|
||||
|
||||
**Note:** macOS 14 (Sonoma) has a minor issue that may cause IKEv2 VPN to disconnect and reconnect once every 24-48 minutes. Other macOS versions are not affected. For more details and a workaround, see [macOS Sonoma clients reconnect](#macos-sonoma-clients-reconnect).
|
||||
|
||||
<details>
|
||||
<summary>
|
||||
Remove the IKEv2 VPN connection.
|
||||
@ -546,7 +546,7 @@ for the entire network, or use `192.168.0.10` for just one device, and so on.
|
||||
**See also:** [Check logs and VPN status](clients.md#check-logs-and-vpn-status), [IKEv1 troubleshooting](clients.md#ikev1-troubleshooting) and [Advanced usage](advanced-usage.md).
|
||||
|
||||
* [Cannot connect to the VPN server](#cannot-connect-to-the-vpn-server)
|
||||
* [macOS Sonoma clients disconnect](#macos-sonoma-clients-disconnect)
|
||||
* [macOS Sonoma clients reconnect](#macos-sonoma-clients-reconnect)
|
||||
* [Unable to connect multiple IKEv2 clients](#unable-to-connect-multiple-ikev2-clients)
|
||||
* [IKE authentication credentials are unacceptable](#ike-authentication-credentials-are-unacceptable)
|
||||
* [Policy match error](#policy-match-error)
|
||||
@ -563,9 +563,11 @@ For servers with an external firewall (e.g. [EC2](https://docs.aws.amazon.com/AW
|
||||
|
||||
[Check logs and VPN status](clients.md#check-logs-and-vpn-status) for errors. If you encounter retransmission related errors and are unable to connect, there may be network issues between the VPN client and server. If you are connecting from mainland China, consider switching to alternative solutions other than IPsec VPN.
|
||||
|
||||
### macOS Sonoma clients disconnect
|
||||
### macOS Sonoma clients reconnect
|
||||
|
||||
macOS 14 (Sonoma) has [an issue](https://github.com/hwdsl2/setup-ipsec-vpn/issues/1486) that may cause IKEv2 VPN to disconnect after 24-48 minutes. Other macOS versions are not affected. First [check your macOS version](https://support.apple.com/en-us/HT201260). To work around this issue:
|
||||
macOS 14 (Sonoma) has [a minor issue](https://github.com/hwdsl2/setup-ipsec-vpn/issues/1486) that may cause IKEv2 VPN to disconnect and reconnect once every 24-48 minutes. Other macOS versions are not affected. First [check your macOS version](https://support.apple.com/en-us/HT201260). To work around this issue, follow the steps below.
|
||||
|
||||
**Note:** After applying this workaround, the updated VPN server configuration may not work with Windows or Android clients. For those clients, you may need to change `pfs=yes` back to `pfs=no` in `ikev2.conf`, then run `service ipsec restart` or restart the Docker container.
|
||||
|
||||
1. Edit `/etc/ipsec.d/ikev2.conf` on the VPN server. First change `pfs=no` to `pfs=yes`. Then find the lines `ike=...` and `phase2alg=...`, and replace them with the following, indented by two spaces:
|
||||
```
|
||||
@ -608,8 +610,6 @@ macOS 14 (Sonoma) has [an issue](https://github.com/hwdsl2/setup-ipsec-vpn/issue
|
||||
1. Run `sudo ikev2.sh` to export (or add) updated client config files for each macOS and iOS (iPhone/iPad) device you have.
|
||||
1. Remove the previously imported IKEv2 profile (if any) from your macOS and iOS device(s), then import the updated `.mobileconfig` file(s). See [Configure IKEv2 VPN clients](#configure-ikev2-vpn-clients). Docker users, see [Configure and use IKEv2 VPN](https://github.com/hwdsl2/docker-ipsec-vpn-server/blob/master/README.md#configure-and-use-ikev2-vpn).
|
||||
|
||||
**Note:** The updated VPN server configuration may not work with Windows or Android clients. For those clients, you may need to change `pfs=yes` back to `pfs=no` in `ikev2.conf`, then run `service ipsec restart` or restart the Docker container.
|
||||
|
||||
### Unable to connect multiple IKEv2 clients
|
||||
|
||||
To connect multiple IKEv2 clients from behind the same NAT (e.g. home router) at the same time, you will need to generate a unique certificate for each client. Otherwise, you could encounter the issue where a later connected client affects the VPN connection of an existing client, which may lose Internet access.
|
||||
|
||||
Loading…
Reference in New Issue
Block a user