Update docs
[ci skip]
This commit is contained in:
hwdsl2
parent
c8bfb7c741
commit
5cbadb643b
@ -1,6 +1,6 @@
|
||||
# IPsec VPN 服务器一键安装脚本
|
||||
|
||||
[](https://travis-ci.org/hwdsl2/setup-ipsec-vpn) [](https://github.com/hwdsl2/setup-ipsec-vpn/stargazers) [](https://github.com/hwdsl2/docker-ipsec-vpn-server) [](https://github.com/hwdsl2/docker-ipsec-vpn-server)
|
||||
[](https://travis-ci.org/hwdsl2/setup-ipsec-vpn) [](https://github.com/hwdsl2/setup-ipsec-vpn/stargazers) [](https://github.com/hwdsl2/docker-ipsec-vpn-server/blob/master/README-zh.md) [](https://github.com/hwdsl2/docker-ipsec-vpn-server/blob/master/README-zh.md)
|
||||
|
||||
使用 Linux 脚本一键快速搭建自己的 IPsec VPN 服务器。支持 IPsec/L2TP 和 Cisco IPsec 协议，可用于 Ubuntu/Debian/CentOS 系统。你只需要提供自己的 VPN 登录凭证，然后运行脚本自动完成安装。
|
||||
|
||||
@ -47,7 +47,7 @@ wget https://git.io/vpnsetup -O vpnsetup.sh && sudo sh vpnsetup.sh
|
||||
## 功能特性
|
||||
|
||||
- **新:** 增加支持更高效的 `IPsec/XAuth ("Cisco IPsec")` 模式
|
||||
- **新:** 现在可以下载 VPN 服务器的预构建 <a href="https://github.com/hwdsl2/docker-ipsec-vpn-server" target="_blank">Docker 镜像</a>
|
||||
- **新:** 现在可以下载 VPN 服务器的预构建 <a href="https://github.com/hwdsl2/docker-ipsec-vpn-server/blob/master/README-zh.md" target="_blank">Docker 镜像</a>
|
||||
- 全自动的 IPsec VPN 服务器配置，无需用户输入
|
||||
- 封装所有的 VPN 流量在 UDP 协议，不需要 ESP 协议支持
|
||||
- 可直接作为 Amazon EC2 实例创建时的用户数据使用
|
||||
@ -177,7 +177,7 @@ wget https://git.io/vpnupgrade-centos -O vpnupgrade.sh
|
||||
|
||||
## 另见
|
||||
|
||||
- <a href="https://github.com/hwdsl2/docker-ipsec-vpn-server" target="_blank">IPsec VPN Server on Docker</a>
|
||||
- <a href="https://github.com/hwdsl2/docker-ipsec-vpn-server/blob/master/README-zh.md" target="_blank">IPsec VPN Server on Docker</a>
|
||||
- <a href="https://github.com/gaomd/docker-ikev2-vpn-server" target="_blank">IKEv2 VPN Server on Docker</a>
|
||||
- <a href="https://github.com/jlund/streisand" target="_blank">Streisand</a>
|
||||
- <a href="https://github.com/SoftEtherVPN/SoftEtherVPN" target="_blank">SoftEther VPN</a>
|
||||
|
||||
@ -4,9 +4,9 @@
|
||||
|
||||
*注: 你也可以使用 [IPsec/L2TP 模式](clients-zh.md) 连接，或者配置 [IKEv2](ikev2-howto-zh.md)。*
|
||||
|
||||
在成功<a href="https://github.com/hwdsl2/setup-ipsec-vpn" target="_blank">搭建自己的 VPN 服务器</a>之后，你可以按照下面的步骤来配置你的设备。IPsec/XAuth ("Cisco IPsec") 在 Android, iOS 和 OS X 上均受支持，无需安装额外的软件。Windows 用户可以使用免费的 <a href="https://www.shrew.net/download/vpn" target="_blank">Shrew Soft 客户端</a>。如果无法连接,请首先检查是否输入了正确的 VPN 登录凭证。
|
||||
在成功<a href="https://github.com/hwdsl2/setup-ipsec-vpn/blob/master/README-zh.md" target="_blank">搭建自己的 VPN 服务器</a>之后，你可以按照下面的步骤来配置你的设备。IPsec/XAuth ("Cisco IPsec") 在 Android, iOS 和 OS X 上均受支持，无需安装额外的软件。Windows 用户可以使用免费的 <a href="https://www.shrew.net/download/vpn" target="_blank">Shrew Soft 客户端</a>。如果无法连接,请首先检查是否输入了正确的 VPN 登录凭证。
|
||||
|
||||
IPsec/XAuth 模式也称为 "Cisco IPsec"，它通常能够比 IPsec/L2TP 更高效地传输数据。
|
||||
IPsec/XAuth 模式也称为 "Cisco IPsec"。该模式通常能够比 IPsec/L2TP 更高效地传输数据。
|
||||
|
||||
---
|
||||
* 平台名称
|
||||
|
||||
@ -6,7 +6,7 @@
|
||||
|
||||
After <a href="https://github.com/hwdsl2/setup-ipsec-vpn" target="_blank">setting up your own VPN server</a>, follow these steps to configure your devices. IPsec/XAuth ("Cisco IPsec") is natively supported by Android, iOS and OS X. There is no additional software to install. Windows users can use the free <a href="https://www.shrew.net/download/vpn" target="_blank">Shrew Soft client</a>. In case you are unable to connect, first check to make sure the VPN credentials were entered correctly.
|
||||
|
||||
IPsec/XAuth mode is also called "Cisco IPsec". It is generally faster than IPsec/L2TP with less overhead.
|
||||
IPsec/XAuth mode is also called "Cisco IPsec". This mode is generally faster than IPsec/L2TP with less overhead.
|
||||
|
||||
---
|
||||
* Platforms
|
||||
|
||||
@ -4,7 +4,7 @@
|
||||
|
||||
*注: 你也可以使用 [IPsec/XAuth 模式](clients-xauth-zh.md) 连接，或者配置 [IKEv2](ikev2-howto-zh.md)。*
|
||||
|
||||
在成功<a href="https://github.com/hwdsl2/setup-ipsec-vpn" target="_blank">搭建自己的 VPN 服务器</a>之后，你可以按照下面的步骤来配置你的设备。IPsec/L2TP 在 Android, iOS, OS X 和 Windows 上均受支持，无需安装额外的软件。设置过程通常只需要几分钟。如果无法连接,请首先检查是否输入了正确的 VPN 登录凭证。
|
||||
在成功<a href="https://github.com/hwdsl2/setup-ipsec-vpn/blob/master/README-zh.md" target="_blank">搭建自己的 VPN 服务器</a>之后，你可以按照下面的步骤来配置你的设备。IPsec/L2TP 在 Android, iOS, OS X 和 Windows 上均受支持，无需安装额外的软件。设置过程通常只需要几分钟。如果无法连接,请首先检查是否输入了正确的 VPN 登录凭证。
|
||||
|
||||
另一个带图片的<a href="https://usefulpcguide.com/17318/create-your-own-vpn/" target="_blank">安装指南</a>可供参考，它由 Tony Tran 编写。
|
||||
|
||||
@ -390,9 +390,9 @@ strongswan down myvpn
|
||||
|
||||
更多的故障排除信息请参见以下链接：
|
||||
|
||||
* https://documentation.meraki.com/MX-Z/Client_VPN/Troubleshooting_Client_VPN#Common_Connection_Issues
|
||||
* https://blogs.technet.microsoft.com/rrasblog/2009/08/12/troubleshooting-common-vpn-related-errors/
|
||||
* http://www.tp-link.com/en/faq-1029.html
|
||||
https://documentation.meraki.com/MX-Z/Client_VPN/Troubleshooting_Client_VPN#Common_Connection_Issues
|
||||
https://blogs.technet.microsoft.com/rrasblog/2009/08/12/troubleshooting-common-vpn-related-errors/
|
||||
http://www.tp-link.com/en/faq-1029.html
|
||||
|
||||
## 致谢
|
||||
|
||||
|
||||
@ -387,11 +387,11 @@ If you are unable to connect using Android 6 (Marshmallow) or 7 (Nougat):
|
||||
|
||||
### Other Errors
|
||||
|
||||
Refer to the links below for more troubleshooting tips:
|
||||
For additional troubleshooting tips, refer to the links below:
|
||||
|
||||
* https://documentation.meraki.com/MX-Z/Client_VPN/Troubleshooting_Client_VPN#Common_Connection_Issues
|
||||
* https://blogs.technet.microsoft.com/rrasblog/2009/08/12/troubleshooting-common-vpn-related-errors/
|
||||
* http://www.tp-link.com/en/faq-1029.html
|
||||
https://documentation.meraki.com/MX-Z/Client_VPN/Troubleshooting_Client_VPN#Common_Connection_Issues
|
||||
https://blogs.technet.microsoft.com/rrasblog/2009/08/12/troubleshooting-common-vpn-related-errors/
|
||||
http://www.tp-link.com/en/faq-1029.html
|
||||
|
||||
## Credits
|
||||
|
||||
|
||||
@ -19,7 +19,7 @@ Libreswan 支持通过使用 RSA 签名算法的 X.509 Machine Certificates 来
|
||||
|
||||
下面举例说明如何在 Libreswan 上配置 IKEv2。以下命令必须用 `root` 账户运行。
|
||||
|
||||
在继续之前，请确保你已经成功地 <a href="https://github.com/hwdsl2/setup-ipsec-vpn" target="_blank">搭建自己的 VPN 服务器</a>。
|
||||
在继续之前，请确保你已经成功地 <a href="https://github.com/hwdsl2/setup-ipsec-vpn/blob/master/README-zh.md" target="_blank">搭建自己的 VPN 服务器</a>。
|
||||
|
||||
1. 获取服务器的公共和私有 IP 地址，并确保它们的值非空。注意，这两个 IP 地址可以相同。
|
||||
|
||||
@ -27,9 +27,9 @@ Libreswan 支持通过使用 RSA 签名算法的 X.509 Machine Certificates 来
|
||||
$ PUBLIC_IP=$(wget -t 3 -T 15 -qO- http://ipv4.icanhazip.com)
|
||||
$ PRIVATE_IP=$(ip -4 route get 1 | awk '{print $NF;exit}')
|
||||
$ echo "$PUBLIC_IP"
|
||||
(Your public IP is displayed)
|
||||
（检查显示的 public IP）
|
||||
$ echo "$PRIVATE_IP"
|
||||
(Your private IP is displayed)
|
||||
（检查显示的 private IP）
|
||||
```
|
||||
|
||||
1. 在 `/etc/ipsec.conf` 文件中添加一个新的 IKEv2 连接:
|
||||
@ -175,7 +175,7 @@ Libreswan 支持通过使用 RSA 签名算法的 X.509 Machine Certificates 来
|
||||
```bash
|
||||
$ certutil -S -c "Example CA" -n "vpnclient" -s "O=Example,CN=vpnclient" -k rsa -g 4096 -v 36 -d sql:/etc/ipsec.d -t ",," -1 -6 -8 "vpnclient"
|
||||
|
||||
-- repeat same extensions as above --
|
||||
-- 重复与上面相同的 extensions --
|
||||
|
||||
$ pk12util -o vpnclient.p12 -n "vpnclient" -d sql:/etc/ipsec.d
|
||||
|
||||
@ -238,7 +238,7 @@ Libreswan 支持通过使用 RSA 签名算法的 X.509 Machine Certificates 来
|
||||
|
||||
## 已知问题
|
||||
|
||||
Windows 7 和更新版本自带的 VPN 客户端不支持 IKEv2 fragmentation。在有些网络上，这可能会导致连接错误 "Error 809"，或者可能在连接后无法打开任何网站。如果出现这些问题，请首先尝试 <a href="clients-zh.md#故障排除" target="_blank">这个解决方案</a>。如果仍然无法解决，请使用 <a href="clients-zh.md" target="_blank">IPsec/L2TP</a> 或者 <a href="clients-xauth-zh.md" target="_blank">IPsec/XAuth</a> 模式连接。
|
||||
Windows 7 和更新版本自带的 VPN 客户端不支持 IKEv2 fragmentation。在有些网络上，这可能会导致连接错误，或者可能在连接后无法打开任何网站。如果出现这些问题，请首先尝试 <a href="clients-zh.md#故障排除" target="_blank">这个解决方案</a>。如果仍然无法解决，请使用 <a href="clients-zh.md" target="_blank">IPsec/L2TP</a> 或者 <a href="clients-xauth-zh.md" target="_blank">IPsec/XAuth</a> 模式连接。
|
||||
|
||||
## 参考链接
|
||||
|
||||
|
||||
@ -27,9 +27,9 @@ Before continuing, make sure you have successfully <a href="https://github.com/h
|
||||
$ PUBLIC_IP=$(wget -t 3 -T 15 -qO- http://ipv4.icanhazip.com)
|
||||
$ PRIVATE_IP=$(ip -4 route get 1 | awk '{print $NF;exit}')
|
||||
$ echo "$PUBLIC_IP"
|
||||
(Your public IP is displayed)
|
||||
(Check the displayed public IP)
|
||||
$ echo "$PRIVATE_IP"
|
||||
(Your private IP is displayed)
|
||||
(Check the displayed private IP)
|
||||
```
|
||||
|
||||
1. Add a new IKEv2 connection to `/etc/ipsec.conf`:
|
||||
@ -224,7 +224,7 @@ Before continuing, make sure you have successfully <a href="https://github.com/h
|
||||
|
||||
https://wiki.strongswan.org/projects/strongswan/wiki/Win7Connect
|
||||
|
||||
(Optional) To enable stronger ciphers, you may add <a href="https://wiki.strongswan.org/projects/strongswan/wiki/Windows7#AES-256-CBC-and-MODP2048" target="_blank">this registry key</a> and reboot.
|
||||
(Optional) You may enable stronger ciphers by adding <a href="https://wiki.strongswan.org/projects/strongswan/wiki/Windows7#AES-256-CBC-and-MODP2048" target="_blank">this registry key</a> and reboot.
|
||||
|
||||
#### Windows Phone 8.1 and above
|
||||
|
||||
@ -238,7 +238,7 @@ Before continuing, make sure you have successfully <a href="https://github.com/h
|
||||
|
||||
## Known Issues
|
||||
|
||||
The built-in VPN client in Windows 7 and newer does not support IKEv2 fragmentation. On some networks, this can cause the connection to fail with "Error 809", or you may be unable to open any website after connecting. If this happens, first try <a href="clients.md#troubleshooting" target="_blank">this workaround</a>. If it doesn't work, please connect using <a href="clients.md" target="_blank">IPsec/L2TP</a> or <a href="clients-xauth.md" target="_blank">IPsec/XAuth</a> mode instead.
|
||||
The built-in VPN client in Windows 7 and newer does not support IKEv2 fragmentation. On some networks, this can cause the connection to fail, or you may be unable to open any website after connecting. If this happens, first try <a href="clients.md#troubleshooting" target="_blank">this workaround</a>. If it doesn't work, please connect using <a href="clients.md" target="_blank">IPsec/L2TP</a> or <a href="clients-xauth.md" target="_blank">IPsec/XAuth</a> mode instead.
|
||||
|
||||
## References
|
||||
|
||||
|
||||
Loading…
Reference in New Issue
Block a user