Update docs
This commit is contained in:
hwdsl2
parent
7376fc02d2
commit
9072c0889c
205
README-zh.md
205
README-zh.md
@ -21,6 +21,7 @@ IPsec VPN 可以加密你的网络流量，以防止在通过因特网传送时
|
|||||||
- [下一步](#下一步)
|
- [下一步](#下一步)
|
||||||
- [重要提示](#重要提示)
|
- [重要提示](#重要提示)
|
||||||
- [升级Libreswan](#升级libreswan)
|
- [升级Libreswan](#升级libreswan)
|
||||||
|
- [管理 VPN 用户](#管理-vpn-用户)
|
||||||
- [高级用法](#高级用法)
|
- [高级用法](#高级用法)
|
||||||
- [问题和反馈](#问题和反馈)
|
- [问题和反馈](#问题和反馈)
|
||||||
- [卸载说明](#卸载说明)
|
- [卸载说明](#卸载说明)
|
||||||
@ -94,18 +95,18 @@ wget https://git.io/vpnsetup-amzn -O vpn.sh && sudo sh vpn.sh && sudo ikev2.sh -
|
|||||||
|
|
||||||
一个专用服务器或者虚拟专用服务器 (VPS)，全新安装以上操作系统之一。OpenVZ VPS 不受支持，用户可以另外尝试 [OpenVPN](https://github.com/Nyr/openvpn-install)。
|
一个专用服务器或者虚拟专用服务器 (VPS)，全新安装以上操作系统之一。OpenVZ VPS 不受支持，用户可以另外尝试 [OpenVPN](https://github.com/Nyr/openvpn-install)。
|
||||||
|
|
||||||
这也包括各种公共云服务中的 Linux 虚拟机，比如 [DigitalOcean](https://blog.ls20.com/digitalocean), [Vultr](https://blog.ls20.com/vultr), [Linode](https://blog.ls20.com/linode), [Google Compute Engine](https://cloud.google.com/compute/), [Amazon Lightsail](https://aws.amazon.com/lightsail/), [Microsoft Azure](https://azure.microsoft.com), [IBM Cloud](https://www.ibm.com/cloud/virtual-servers), [OVH](https://www.ovh.com/world/vps/) 和 [Rackspace](https://www.rackspace.com)。
|
这也包括各种公共云服务中的 Linux 虚拟机，比如 [DigitalOcean](https://blog.ls20.com/digitalocean), [Vultr](https://blog.ls20.com/vultr), [Linode](https://blog.ls20.com/linode), [Google Compute Engine](https://cloud.google.com/compute/), [Amazon Lightsail](https://aws.amazon.com/lightsail/), [Microsoft Azure](https://azure.microsoft.com), [OVH](https://www.ovhcloud.com/en/vps/) 和 [IBM Cloud](https://www.ibm.com/cloud/virtual-servers)。
|
||||||
|
|
||||||
[](aws/README-zh.md) [](azure/README-zh.md) [](http://dovpn.carlfriess.com/) [](https://cloud.linode.com/stackscripts/37239)
|
[](aws/README-zh.md) [](azure/README-zh.md) [](http://dovpn.carlfriess.com/) [](https://cloud.linode.com/stackscripts/37239)
|
||||||
|
|
||||||
[**» 我想建立并使用自己的 VPN ，但是没有可用的服务器**](https://blog.ls20.com/ipsec-l2tp-vpn-auto-setup-for-ubuntu-12-04-on-amazon-ec2/#gettingavps)
|
[**» 我想建立并使用自己的 VPN ，但是没有可用的服务器**](https://blog.ls20.com/ipsec-l2tp-vpn-auto-setup-for-ubuntu-12-04-on-amazon-ec2/#gettingavps)
|
||||||
|
|
||||||
高级用户可以在一个 $35 的 [Raspberry Pi](https://www.raspberrypi.org) 上搭建 VPN 服务器。参见 [[1]](https://elasticbyte.net/posts/setting-up-a-native-cisco-ipsec-vpn-server-using-a-raspberry-pi/) [[2]](https://www.stewright.me/2018/07/create-a-raspberry-pi-vpn-server-using-l2tpipsec/)。
|
高级用户可以在一个 [Raspberry Pi](https://www.raspberrypi.org) 上搭建 VPN 服务器。参见 [[1]](https://elasticbyte.net/posts/setting-up-a-native-cisco-ipsec-vpn-server-using-a-raspberry-pi/) [[2]](https://www.stewright.me/2018/07/create-a-raspberry-pi-vpn-server-using-l2tpipsec/)。
|
||||||
|
|
||||||
<a name="debian-10-note"></a>
|
<a name="debian-10-note"></a>
|
||||||
\* Debian 10 用户需要使用标准的 Linux 内核（而不是 "cloud" 版本）。更多信息请看 [这里](docs/clients-zh.md#debian-10-内核)。如果你在 EC2 上使用 Debian 10，你必须首先换用标准的 Linux 内核，然后运行 VPN 安装脚本。
|
\* Debian 10 用户需要 [使用标准的 Linux 内核](docs/clients-zh.md#debian-10-内核)。如果在 EC2 上使用 Debian 10，你必须首先换用标准的 Linux 内核，然后运行 VPN 安装脚本。
|
||||||
<a name="centos-8-note"></a>
|
<a name="centos-8-note"></a>
|
||||||
\*\* CentOS Linux 8 的支持将于2021年12月31日结束。更多信息请看 [这里](https://wiki.centos.org/About/Product)。
|
\*\* CentOS Linux 8 的支持 [将于2021年12月31日结束](https://wiki.centos.org/About/Product)。
|
||||||
|
|
||||||
:warning: **不要** 在你的 PC 或者 Mac 上运行这些脚本！它们只能用在服务器上！
|
:warning: **不要** 在你的 PC 或者 Mac 上运行这些脚本！它们只能用在服务器上！
|
||||||
|
|
||||||
@ -291,7 +292,7 @@ sudo ikev2.sh --auto
|
|||||||
|
|
||||||
对于有外部防火墙的服务器（比如 [EC2](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-security-groups.html)/[GCE](https://cloud.google.com/vpc/docs/firewalls)），请为 VPN 打开 UDP 端口 500 和 4500。阿里云用户请参见 [#433](https://github.com/hwdsl2/setup-ipsec-vpn/issues/433)。
|
对于有外部防火墙的服务器（比如 [EC2](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-security-groups.html)/[GCE](https://cloud.google.com/vpc/docs/firewalls)），请为 VPN 打开 UDP 端口 500 和 4500。阿里云用户请参见 [#433](https://github.com/hwdsl2/setup-ipsec-vpn/issues/433)。
|
||||||
|
|
||||||
在 VPN 已连接时，客户端配置为使用 [Google Public DNS](https://developers.google.com/speed/public-dns/)。如果偏好其它的域名解析服务，请看 [这里](#使用其他的-dns-服务器)。
|
在 VPN 已连接时，客户端配置为使用 [Google Public DNS](https://developers.google.com/speed/public-dns/)。如果偏好其它的域名解析服务，你可以 [使用其他的 DNS 服务器](docs/advanced-usage-zh.md)。
|
||||||
|
|
||||||
使用内核支持有助于提高 IPsec/L2TP 性能。它在所有 [受支持的系统](#系统要求) 上可用。Ubuntu 系统需要安装 `linux-modules-extra-$(uname -r)`（或者 `linux-image-extra`）软件包并运行 `service xl2tpd restart`。
|
使用内核支持有助于提高 IPsec/L2TP 性能。它在所有 [受支持的系统](#系统要求) 上可用。Ubuntu 系统需要安装 `linux-modules-extra-$(uname -r)`（或者 `linux-image-extra`）软件包并运行 `service xl2tpd restart`。
|
||||||
|
|
||||||
@ -299,7 +300,7 @@ sudo ikev2.sh --auto
|
|||||||
|
|
||||||
## 升级Libreswan
|
## 升级Libreswan
|
||||||
|
|
||||||
在 [extras/](extras/) 目录提供额外的脚本，可用于升级 [Libreswan](https://libreswan.org)（[更新日志](https://github.com/libreswan/libreswan/blob/master/CHANGES) | [通知列表](https://lists.libreswan.org/mailman/listinfo/swan-announce)）。请在运行前根据需要修改 `SWAN_VER` 变量。目前支持的最新版本是 `4.4`。查看已安装版本：`ipsec --version`。
|
在 [extras/](extras/) 目录提供额外的脚本，可用于升级 [Libreswan](https://libreswan.org)（[更新日志](https://github.com/libreswan/libreswan/blob/master/CHANGES) | [通知列表](https://lists.libreswan.org/mailman/listinfo/swan-announce)）。目前支持的最新版本是 `4.4`。查看已安装版本：`ipsec --version`。
|
||||||
|
|
||||||
<details open>
|
<details open>
|
||||||
<summary>
|
<summary>
|
||||||
@ -331,195 +332,13 @@ wget https://git.io/vpnupgrade-amzn -O vpnup.sh && sudo sh vpnup.sh
|
|||||||
```
|
```
|
||||||
</details>
|
</details>
|
||||||
|
|
||||||
|
## 管理 VPN 用户
|
||||||
|
|
||||||
|
请参见 [管理 VPN 用户](docs/manage-users-zh.md)。
|
||||||
|
|
||||||
## 高级用法
|
## 高级用法
|
||||||
|
|
||||||
*其他语言版本: [English](README.md#advanced-usage), [简体中文](README-zh.md#高级用法).*
|
请参见 [高级用法](docs/advanced-usage-zh.md)。
|
||||||
|
|
||||||
- [使用其他的 DNS 服务器](#使用其他的-dns-服务器)
|
|
||||||
- [域名和更改服务器 IP](#域名和更改服务器-ip)
|
|
||||||
- [VPN 内网 IP 和流量](#vpn-内网-ip-和流量)
|
|
||||||
- [VPN 分流](#vpn-分流)
|
|
||||||
- [访问 VPN 服务器的网段](#访问-vpn-服务器的网段)
|
|
||||||
- [仅限 IKEv2 的 VPN](#仅限-ikev2-的-vpn)
|
|
||||||
- [更改 IPTables 规则](#更改-iptables-规则)
|
|
||||||
|
|
||||||
### 使用其他的 DNS 服务器
|
|
||||||
|
|
||||||
在 VPN 已连接时，客户端配置为使用 [Google Public DNS](https://developers.google.com/speed/public-dns/)。如果偏好其它的域名解析服务，你可以编辑以下文件：`/etc/ppp/options.xl2tpd`, `/etc/ipsec.conf` 和 `/etc/ipsec.d/ikev2.conf`（如果存在），并替换 `8.8.8.8` 和 `8.8.4.4`。然后运行 `service ipsec restart` 和 `service xl2tpd restart`。
|
|
||||||
|
|
||||||
高级用户可以在运行 VPN 安装脚本和 [IKEv2 辅助脚本](docs/ikev2-howto-zh.md#使用辅助脚本) 时定义 `VPN_DNS_SRV1` 和 `VPN_DNS_SRV2`（可选）。比如你想使用 [Cloudflare 的 DNS 服务](https://1.1.1.1)：
|
|
||||||
|
|
||||||
```
|
|
||||||
sudo VPN_DNS_SRV1=1.1.1.1 VPN_DNS_SRV2=1.0.0.1 sh vpn.sh
|
|
||||||
sudo VPN_DNS_SRV1=1.1.1.1 VPN_DNS_SRV2=1.0.0.1 ikev2.sh --auto
|
|
||||||
```
|
|
||||||
|
|
||||||
### 域名和更改服务器 IP
|
|
||||||
|
|
||||||
对于 [IPsec/L2TP](docs/clients-zh.md) 和 [IPsec/XAuth ("Cisco IPsec")](docs/clients-xauth-zh.md) 模式，你可以在不需要额外配置的情况下使用一个域名（比如 `vpn.example.com`）而不是 IP 地址连接到 VPN 服务器。另外，一般来说，在服务器的 IP 更改后，比如在恢复一个映像到具有不同 IP 的新服务器后，VPN 会继续正常工作，虽然可能需要重启服务器。
|
|
||||||
|
|
||||||
对于 [IKEv2](docs/ikev2-howto-zh.md) 模式，如果你想要 VPN 在服务器的 IP 更改后继续正常工作，则必须在 [配置 IKEv2](docs/ikev2-howto-zh.md) 时指定一个域名作为 VPN 服务器的地址。该域名必须是一个全称域名(FQDN)。示例如下：
|
|
||||||
|
|
||||||
```
|
|
||||||
sudo VPN_DNS_NAME='vpn.example.com' ikev2.sh --auto
|
|
||||||
```
|
|
||||||
|
|
||||||
另外，你也可以自定义 IKEv2 安装选项，通过在运行 [辅助脚本](docs/ikev2-howto-zh.md#使用辅助脚本) 时去掉 `--auto` 参数来实现。
|
|
||||||
|
|
||||||
### VPN 内网 IP 和流量
|
|
||||||
|
|
||||||
在使用 [IPsec/L2TP](docs/clients-zh.md) 模式连接时，VPN 服务器在虚拟网络 `192.168.42.0/24` 内具有内网 IP `192.168.42.1`。为客户端分配的内网 IP 在这个范围内：`192.168.42.10` 到 `192.168.42.250`。要找到为特定的客户端分配的 IP，可以查看该 VPN 客户端上的连接状态。
|
|
||||||
|
|
||||||
在使用 [IPsec/XAuth ("Cisco IPsec")](docs/clients-xauth-zh.md) 或 [IKEv2](docs/ikev2-howto-zh.md) 模式连接时，VPN 服务器在虚拟网络 `192.168.43.0/24` 内 **没有** 内网 IP。为客户端分配的内网 IP 在这个范围内：`192.168.43.10` 到 `192.168.43.250`。
|
|
||||||
|
|
||||||
你可以使用这些 VPN 内网 IP 进行通信。但是请注意，为 VPN 客户端分配的 IP 是动态的，而且客户端设备上的防火墙可能会阻止这些流量。
|
|
||||||
|
|
||||||
对于 IPsec/L2TP 和 IPsec/XAuth ("Cisco IPsec") 模式，高级用户可以将静态 IP 分配给 VPN 客户端。这是可选的。展开以查看详细信息。IKEv2 模式 **不支持** 此功能。
|
|
||||||
|
|
||||||
<details>
|
|
||||||
<summary>
|
|
||||||
IPsec/L2TP 模式：为 VPN 客户端分配静态 IP
|
|
||||||
</summary>
|
|
||||||
|
|
||||||
下面的示例 **仅适用于** IPsec/L2TP 模式。这些命令必须用 `root` 账户运行。
|
|
||||||
|
|
||||||
1. 首先为要分配静态 IP 的每个 VPN 客户端创建一个新的 VPN 用户。参见 [管理 VPN 用户](docs/manage-users-zh.md)。该文档包含辅助脚本，以方便管理 VPN 用户。
|
|
||||||
1. 编辑 VPN 服务器上的 `/etc/xl2tpd/xl2tpd.conf`。将 `ip range = 192.168.42.10-192.168.42.250` 替换为比如 `ip range = 192.168.42.100-192.168.42.250`。这样可以缩小自动分配的 IP 地址池，从而使更多的 IP 可以作为静态 IP 分配给客户端。
|
|
||||||
1. 编辑 VPN 服务器上的 `/etc/ppp/chap-secrets`。例如，如果文件内容是：
|
|
||||||
```
|
|
||||||
"username1" l2tpd "password1" *
|
|
||||||
"username2" l2tpd "password2" *
|
|
||||||
"username3" l2tpd "password3" *
|
|
||||||
```
|
|
||||||
|
|
||||||
假设你要为 VPN 用户 `username2` 分配静态 IP `192.168.42.2`，为 VPN 用户 `username3` 分配静态 IP `192.168.42.3`，同时保持 `username1` 不变（从池中自动分配）。在编辑完成后，文件内容应该如下所示：
|
|
||||||
```
|
|
||||||
"username1" l2tpd "password1" *
|
|
||||||
"username2" l2tpd "password2" 192.168.42.2
|
|
||||||
"username3" l2tpd "password3" 192.168.42.3
|
|
||||||
```
|
|
||||||
|
|
||||||
**注：** 分配的静态 IP 必须来自子网 `192.168.42.0/24`，并且必须 **不是** 来自自动分配的 IP 地址池（参见上面的 `ip range`）。另外，`192.168.42.1` 保留给 VPN 服务器本身使用。在上面的示例中，你只能分配 `192.168.42.2-192.168.42.99` 范围内的静态 IP。
|
|
||||||
1. **（重要）** 重启 xl2tpd 服务：
|
|
||||||
```
|
|
||||||
service xl2tpd restart
|
|
||||||
```
|
|
||||||
</details>
|
|
||||||
|
|
||||||
<details>
|
|
||||||
<summary>
|
|
||||||
IPsec/XAuth ("Cisco IPsec") 模式：为 VPN 客户端分配静态 IP
|
|
||||||
</summary>
|
|
||||||
|
|
||||||
下面的示例 **仅适用于** IPsec/XAuth ("Cisco IPsec") 模式。这些命令必须用 `root` 账户运行。
|
|
||||||
|
|
||||||
1. 首先为要分配静态 IP 的每个 VPN 客户端创建一个新的 VPN 用户。参见 [管理 VPN 用户](docs/manage-users-zh.md)。该文档包含辅助脚本，以方便管理 VPN 用户。
|
|
||||||
1. 编辑 VPN 服务器上的 `/etc/ipsec.conf`。将 `rightaddresspool=192.168.43.10-192.168.43.250` 替换为比如 `rightaddresspool=192.168.43.100-192.168.43.250`。这样可以缩小自动分配的 IP 地址池，从而使更多的 IP 可以作为静态 IP 分配给客户端。
|
|
||||||
1. 编辑 VPN 服务器上的 `/etc/ipsec.d/ikev2.conf`（如果存在）。将 `rightaddresspool=192.168.43.10-192.168.43.250` 替换为与上一步 **相同的值**。
|
|
||||||
1. 编辑 VPN 服务器上的 `/etc/ipsec.d/passwd`。例如，如果文件内容是：
|
|
||||||
```
|
|
||||||
username1:password1hashed:xauth-psk
|
|
||||||
username2:password2hashed:xauth-psk
|
|
||||||
username3:password3hashed:xauth-psk
|
|
||||||
```
|
|
||||||
|
|
||||||
假设你要为 VPN 用户 `username2` 分配静态 IP `192.168.43.2`，为 VPN 用户 `username3` 分配静态 IP `192.168.43.3`，同时保持 `username1` 不变（从池中自动分配）。在编辑完成后，文件内容应该如下所示：
|
|
||||||
```
|
|
||||||
username1:password1hashed:xauth-psk
|
|
||||||
username2:password2hashed:xauth-psk:192.168.42.2
|
|
||||||
username3:password3hashed:xauth-psk:192.168.42.3
|
|
||||||
```
|
|
||||||
|
|
||||||
**注：** 分配的静态 IP 必须来自子网 `192.168.43.0/24`，并且必须 **不是** 来自自动分配的 IP 地址池（参见上面的 `rightaddresspool`）。在上面的示例中，你只能分配 `192.168.43.1-192.168.43.99` 范围内的静态 IP。
|
|
||||||
1. **（重要）** 重启 IPsec 服务：
|
|
||||||
```
|
|
||||||
service ipsec restart
|
|
||||||
```
|
|
||||||
</details>
|
|
||||||
|
|
||||||
在默认配置下，允许客户端之间的流量。如果你想要 **不允许** 客户端之间的流量，可以在 VPN 服务器上运行以下命令。将它们添加到 `/etc/rc.local` 以便在重启后继续有效。
|
|
||||||
|
|
||||||
```
|
|
||||||
iptables -I FORWARD 2 -i ppp+ -o ppp+ -s 192.168.42.0/24 -d 192.168.42.0/24 -j DROP
|
|
||||||
iptables -I FORWARD 3 -s 192.168.43.0/24 -d 192.168.43.0/24 -j DROP
|
|
||||||
```
|
|
||||||
|
|
||||||
### VPN 分流
|
|
||||||
|
|
||||||
在启用 [VPN 分流 (split tunneling)](https://wiki.strongswan.org/projects/strongswan/wiki/ForwardingAndSplitTunneling#Split-Tunneling) 时，VPN 客户端将仅通过 VPN 隧道发送特定目标子网的流量。其他流量 **不会** 通过 VPN 隧道。VPN 分流 [有一些局限性](https://wiki.strongswan.org/projects/strongswan/wiki/ForwardingAndSplitTunneling#Split-Tunneling)，而且并非所有的 VPN 客户端都支持。
|
|
||||||
|
|
||||||
高级用户可以为 [IPsec/XAuth ("Cisco IPsec")](docs/clients-xauth-zh.md) 和/或 [IKEv2](docs/ikev2-howto-zh.md) 模式启用 VPN 分流。这是可选的。IPsec/L2TP 模式 **不支持** 此功能。
|
|
||||||
|
|
||||||
<details>
|
|
||||||
<summary>
|
|
||||||
IPsec/XAuth ("Cisco IPsec") 模式：启用 VPN 分流 (split tunneling)
|
|
||||||
</summary>
|
|
||||||
|
|
||||||
下面的示例 **仅适用于** IPsec/XAuth ("Cisco IPsec") 模式。这些命令必须用 `root` 账户运行。
|
|
||||||
|
|
||||||
1. 编辑 VPN 服务器上的 `/etc/ipsec.conf`。在 `conn xauth-psk` 小节中，将 `leftsubnet=0.0.0.0/0` 替换为你想要 VPN 客户端通过 VPN 隧道发送流量的子网。例如：
|
|
||||||
对于单个子网：
|
|
||||||
```
|
|
||||||
leftsubnet=10.123.123.0/24
|
|
||||||
```
|
|
||||||
对于多个子网（使用 `leftsubnets`）：
|
|
||||||
```
|
|
||||||
leftsubnets="10.123.123.0/24,10.100.0.0/16"
|
|
||||||
```
|
|
||||||
1. **（重要）** 重启 IPsec 服务：
|
|
||||||
```
|
|
||||||
service ipsec restart
|
|
||||||
```
|
|
||||||
</details>
|
|
||||||
|
|
||||||
<details>
|
|
||||||
<summary>
|
|
||||||
IKEv2 模式：启用 VPN 分流 (split tunneling)
|
|
||||||
</summary>
|
|
||||||
|
|
||||||
下面的示例 **仅适用于** IKEv2 模式。这些命令必须用 `root` 账户运行。
|
|
||||||
|
|
||||||
1. 编辑 VPN 服务器上的 `/etc/ipsec.d/ikev2.conf`。在 `conn ikev2-cp` 小节中，将 `leftsubnet=0.0.0.0/0` 替换为你想要 VPN 客户端通过 VPN 隧道发送流量的子网。例如：
|
|
||||||
对于单个子网：
|
|
||||||
```
|
|
||||||
leftsubnet=10.123.123.0/24
|
|
||||||
```
|
|
||||||
对于多个子网（使用 `leftsubnets`）：
|
|
||||||
```
|
|
||||||
leftsubnets="10.123.123.0/24,10.100.0.0/16"
|
|
||||||
```
|
|
||||||
1. **（重要）** 重启 IPsec 服务：
|
|
||||||
```
|
|
||||||
service ipsec restart
|
|
||||||
```
|
|
||||||
</details>
|
|
||||||
|
|
||||||
### 访问 VPN 服务器的网段
|
|
||||||
|
|
||||||
连接到 VPN 后，VPN 客户端通常可以访问与 VPN 服务器位于同一本地子网内的其他设备上运行的服务，而无需进行其他配置。例如，如果 VPN 服务器的本地子网为 `192.168.0.0/24`，并且一个 Nginx 服务器在 IP `192.168.0.2` 上运行，则 VPN 客户端可以使用 IP `192.168.0.2`来访问 Nginx 服务器。
|
|
||||||
|
|
||||||
请注意，如果 VPN 服务器具有多个网络接口（例如 `eth0` 和 `eth1`），并且你想要 VPN 客户端访问服务器上 **不用于** Internet 访问的网络接口后面的本地子网，则需要进行额外的配置。在此情形下，你必须运行以下命令来添加 IPTables 规则。为了在重启后仍然有效，你可以将这些命令添加到 `/etc/rc.local`。
|
|
||||||
|
|
||||||
```bash
|
|
||||||
# 将 eth1 替换为 VPN 服务器上你想要客户端访问的网络接口名称
|
|
||||||
netif=eth1
|
|
||||||
iptables -I FORWARD 2 -i "$netif" -o ppp+ -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
|
|
||||||
iptables -I FORWARD 2 -i ppp+ -o "$netif" -j ACCEPT
|
|
||||||
iptables -I FORWARD 2 -i "$netif" -d 192.168.43.0/24 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
|
|
||||||
iptables -I FORWARD 2 -s 192.168.43.0/24 -o "$netif" -j ACCEPT
|
|
||||||
iptables -t nat -I POSTROUTING -s 192.168.43.0/24 -o "$netif" -m policy --dir out --pol none -j MASQUERADE
|
|
||||||
iptables -t nat -I POSTROUTING -s 192.168.42.0/24 -o "$netif" -j MASQUERADE
|
|
||||||
```
|
|
||||||
|
|
||||||
### 仅限 IKEv2 的 VPN
|
|
||||||
|
|
||||||
Libreswan 4.2 和更新版本支持 `ikev1-policy` 配置选项。使用此选项，高级用户可以设置仅限 IKEv2 的 VPN，即 VPN 服务器仅接受 IKEv2 连接，而 IKEv1 连接（包括 IPsec/L2TP 和 IPsec/XAuth ("Cisco IPsec") 模式）将被丢弃。
|
|
||||||
|
|
||||||
要设置仅限 IKEv2 的 VPN，首先按照本自述文件中的说明安装 VPN 服务器并且配置 IKEv2。然后使用 `ipsec --version` 命令检查 Libreswan 版本并 [更新 Libreswan](#升级libreswan)（如果需要）。下一步，编辑 VPN 服务器上的 `/etc/ipsec.conf`。在 `config setup` 小节的末尾添加 `ikev1-policy=drop`，开头必须空两格。保存文件并运行 `service ipsec restart`。在完成后，你可以使用 `ipsec status` 命令来验证仅启用了 `ikev2-cp` 连接。
|
|
||||||
|
|
||||||
### 更改 IPTables 规则
|
|
||||||
|
|
||||||
如果你想要在安装后更改 IPTables 规则，请编辑 `/etc/iptables.rules` 和/或 `/etc/iptables/rules.v4` (Ubuntu/Debian)，或者 `/etc/sysconfig/iptables` (CentOS/RHEL)。然后重启服务器。
|
|
||||||
|
|
||||||
## 问题和反馈
|
## 问题和反馈
|
||||||
|
|
||||||
|
|||||||
206
README.md
206
README.md
@ -21,6 +21,7 @@ We will use [Libreswan](https://libreswan.org/) as the IPsec server, and [xl2tpd
|
|||||||
- [Next steps](#next-steps)
|
- [Next steps](#next-steps)
|
||||||
- [Important notes](#important-notes)
|
- [Important notes](#important-notes)
|
||||||
- [Upgrade Libreswan](#upgrade-libreswan)
|
- [Upgrade Libreswan](#upgrade-libreswan)
|
||||||
|
- [Manage VPN users](#manage-vpn-users)
|
||||||
- [Advanced usage](#advanced-usage)
|
- [Advanced usage](#advanced-usage)
|
||||||
- [Bugs & Questions](#bugs--questions)
|
- [Bugs & Questions](#bugs--questions)
|
||||||
- [Uninstallation](#uninstallation)
|
- [Uninstallation](#uninstallation)
|
||||||
@ -94,18 +95,18 @@ See [detailed instructions](https://blog.ls20.com/ipsec-l2tp-vpn-auto-setup-for-
|
|||||||
|
|
||||||
A dedicated server or virtual private server (VPS), freshly installed with one of the above OS. OpenVZ VPS is not supported, users could instead try [OpenVPN](https://github.com/Nyr/openvpn-install).
|
A dedicated server or virtual private server (VPS), freshly installed with one of the above OS. OpenVZ VPS is not supported, users could instead try [OpenVPN](https://github.com/Nyr/openvpn-install).
|
||||||
|
|
||||||
This also includes Linux VMs in public clouds, such as [DigitalOcean](https://blog.ls20.com/digitalocean), [Vultr](https://blog.ls20.com/vultr), [Linode](https://blog.ls20.com/linode), [Google Compute Engine](https://cloud.google.com/compute/), [Amazon Lightsail](https://aws.amazon.com/lightsail/), [Microsoft Azure](https://azure.microsoft.com), [IBM Cloud](https://www.ibm.com/cloud/virtual-servers), [OVH](https://www.ovh.com/world/vps/) and [Rackspace](https://www.rackspace.com).
|
This also includes Linux VMs in public clouds, such as [DigitalOcean](https://blog.ls20.com/digitalocean), [Vultr](https://blog.ls20.com/vultr), [Linode](https://blog.ls20.com/linode), [Google Compute Engine](https://cloud.google.com/compute/), [Amazon Lightsail](https://aws.amazon.com/lightsail/), [Microsoft Azure](https://azure.microsoft.com), [OVH](https://www.ovhcloud.com/en/vps/) and [IBM Cloud](https://www.ibm.com/cloud/virtual-servers).
|
||||||
|
|
||||||
[](aws/README.md) [](azure/README.md) [](http://dovpn.carlfriess.com/) [](https://cloud.linode.com/stackscripts/37239)
|
[](aws/README.md) [](azure/README.md) [](http://dovpn.carlfriess.com/) [](https://cloud.linode.com/stackscripts/37239)
|
||||||
|
|
||||||
[**» I want to run my own VPN but don't have a server for that**](https://blog.ls20.com/ipsec-l2tp-vpn-auto-setup-for-ubuntu-12-04-on-amazon-ec2/#gettingavps)
|
[**» I want to run my own VPN but don't have a server for that**](https://blog.ls20.com/ipsec-l2tp-vpn-auto-setup-for-ubuntu-12-04-on-amazon-ec2/#gettingavps)
|
||||||
|
|
||||||
Advanced users can set up the VPN server on a $35 [Raspberry Pi](https://www.raspberrypi.org). See [[1]](https://elasticbyte.net/posts/setting-up-a-native-cisco-ipsec-vpn-server-using-a-raspberry-pi/) [[2]](https://www.stewright.me/2018/07/create-a-raspberry-pi-vpn-server-using-l2tpipsec/).
|
Advanced users can set up the VPN server on a [Raspberry Pi](https://www.raspberrypi.org). See [[1]](https://elasticbyte.net/posts/setting-up-a-native-cisco-ipsec-vpn-server-using-a-raspberry-pi/) [[2]](https://www.stewright.me/2018/07/create-a-raspberry-pi-vpn-server-using-l2tpipsec/).
|
||||||
|
|
||||||
<a name="debian-10-note"></a>
|
<a name="debian-10-note"></a>
|
||||||
\* Debian 10 users should use the standard Linux kernel (not the "cloud" version). Read more [here](docs/clients.md#debian-10-kernel). If using Debian 10 on EC2, you must first switch to the standard Linux kernel before running the VPN setup script.
|
\* Debian 10 users should [use the standard Linux kernel](docs/clients.md#debian-10-kernel). If using Debian 10 on EC2, you must first switch to the standard Linux kernel before running the VPN setup script.
|
||||||
<a name="centos-8-note"></a>
|
<a name="centos-8-note"></a>
|
||||||
\*\* Support for CentOS Linux 8 will end on December 31, 2021. Read more [here](https://wiki.centos.org/About/Product).
|
\*\* Support for CentOS Linux 8 [will end on December 31, 2021](https://wiki.centos.org/About/Product).
|
||||||
|
|
||||||
:warning: **DO NOT** run these scripts on your PC or Mac! They should only be used on a server!
|
:warning: **DO NOT** run these scripts on your PC or Mac! They should only be used on a server!
|
||||||
|
|
||||||
@ -291,7 +292,7 @@ If you wish to view or update VPN user accounts, see [Manage VPN Users](docs/man
|
|||||||
|
|
||||||
For servers with an external firewall (e.g. [EC2](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-security-groups.html)/[GCE](https://cloud.google.com/vpc/docs/firewalls)), open UDP ports 500 and 4500 for the VPN. Aliyun users, see [#433](https://github.com/hwdsl2/setup-ipsec-vpn/issues/433).
|
For servers with an external firewall (e.g. [EC2](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-security-groups.html)/[GCE](https://cloud.google.com/vpc/docs/firewalls)), open UDP ports 500 and 4500 for the VPN. Aliyun users, see [#433](https://github.com/hwdsl2/setup-ipsec-vpn/issues/433).
|
||||||
|
|
||||||
Clients are set to use [Google Public DNS](https://developers.google.com/speed/public-dns/) when the VPN is active. If another DNS provider is preferred, [read below](#use-alternative-dns-servers).
|
Clients are set to use [Google Public DNS](https://developers.google.com/speed/public-dns/) when the VPN is active. If another DNS provider is preferred, you may [use alternative DNS servers](docs/advanced-usage.md).
|
||||||
|
|
||||||
Using kernel support could improve IPsec/L2TP performance. It is available on [all supported OS](#requirements). Ubuntu users should install the `linux-modules-extra-$(uname -r)` (or `linux-image-extra`) package and run `service xl2tpd restart`.
|
Using kernel support could improve IPsec/L2TP performance. It is available on [all supported OS](#requirements). Ubuntu users should install the `linux-modules-extra-$(uname -r)` (or `linux-image-extra`) package and run `service xl2tpd restart`.
|
||||||
|
|
||||||
@ -299,7 +300,7 @@ The scripts will backup existing config files before making changes, with `.old-
|
|||||||
|
|
||||||
## Upgrade Libreswan
|
## Upgrade Libreswan
|
||||||
|
|
||||||
The additional scripts in [extras/](extras/) can be used to upgrade [Libreswan](https://libreswan.org) ([changelog](https://github.com/libreswan/libreswan/blob/master/CHANGES) | [announce](https://lists.libreswan.org/mailman/listinfo/swan-announce)). Edit the `SWAN_VER` variable as necessary. The latest supported version is `4.4`. Check which version is installed: `ipsec --version`.
|
The additional scripts in [extras/](extras/) can be used to upgrade [Libreswan](https://libreswan.org) ([changelog](https://github.com/libreswan/libreswan/blob/master/CHANGES) | [announce](https://lists.libreswan.org/mailman/listinfo/swan-announce)). The latest supported version is `4.4`. Check which version is installed: `ipsec --version`.
|
||||||
|
|
||||||
<details open>
|
<details open>
|
||||||
<summary>
|
<summary>
|
||||||
@ -331,196 +332,13 @@ wget https://git.io/vpnupgrade-amzn -O vpnup.sh && sudo sh vpnup.sh
|
|||||||
```
|
```
|
||||||
</details>
|
</details>
|
||||||
|
|
||||||
|
## Manage VPN users
|
||||||
|
|
||||||
|
See [Manage VPN users](docs/manage-users.md).
|
||||||
|
|
||||||
## Advanced usage
|
## Advanced usage
|
||||||
|
|
||||||
*Read this in other languages: [English](README.md#advanced-usage), [简体中文](README-zh.md#高级用法).*
|
See [Advanced usage](docs/advanced-usage.md).
|
||||||
|
|
||||||
- [Use alternative DNS servers](#use-alternative-dns-servers)
|
|
||||||
- [DNS name and server IP changes](#dns-name-and-server-ip-changes)
|
|
||||||
- [Internal VPN IPs and traffic](#internal-vpn-ips-and-traffic)
|
|
||||||
- [Split tunneling](#split-tunneling)
|
|
||||||
- [Access VPN server's subnet](#access-vpn-servers-subnet)
|
|
||||||
- [IKEv2 only VPN](#ikev2-only-vpn)
|
|
||||||
- [Modify IPTables rules](#modify-iptables-rules)
|
|
||||||
|
|
||||||
### Use alternative DNS servers
|
|
||||||
|
|
||||||
Clients are set to use [Google Public DNS](https://developers.google.com/speed/public-dns/) when the VPN is active. If another DNS provider is preferred, you may replace `8.8.8.8` and `8.8.4.4` in these files: `/etc/ppp/options.xl2tpd`, `/etc/ipsec.conf` and `/etc/ipsec.d/ikev2.conf` (if exists). Then run `service ipsec restart` and `service xl2tpd restart`.
|
|
||||||
|
|
||||||
Advanced users can define `VPN_DNS_SRV1` and optionally `VPN_DNS_SRV2` when running the VPN setup script and the [IKEv2 helper script](docs/ikev2-howto.md#using-helper-scripts). For example, if you want to use [Cloudflare's DNS service](https://1.1.1.1):
|
|
||||||
|
|
||||||
```
|
|
||||||
sudo VPN_DNS_SRV1=1.1.1.1 VPN_DNS_SRV2=1.0.0.1 sh vpn.sh
|
|
||||||
sudo VPN_DNS_SRV1=1.1.1.1 VPN_DNS_SRV2=1.0.0.1 ikev2.sh --auto
|
|
||||||
```
|
|
||||||
|
|
||||||
### DNS name and server IP changes
|
|
||||||
|
|
||||||
For [IPsec/L2TP](docs/clients.md) and [IPsec/XAuth ("Cisco IPsec")](docs/clients-xauth.md) modes, you may use a DNS name (e.g. `vpn.example.com`) instead of an IP address to connect to the VPN server, without additional configuration. In addition, the VPN should generally continue to work after server IP changes, such as after restoring a snapshot to a new server with a different IP, although a reboot may be required.
|
|
||||||
|
|
||||||
For [IKEv2](docs/ikev2-howto.md) mode, if you want the VPN to continue to work after server IP changes, you must specify a DNS name to be used as the VPN server's address when [setting up IKEv2](docs/ikev2-howto.md). The DNS name must be a fully qualified domain name (FQDN). Example:
|
|
||||||
|
|
||||||
```
|
|
||||||
sudo VPN_DNS_NAME='vpn.example.com' ikev2.sh --auto
|
|
||||||
```
|
|
||||||
|
|
||||||
Alternatively, you may customize IKEv2 setup options by running the [helper script](docs/ikev2-howto.md#using-helper-scripts) without the `--auto` parameter.
|
|
||||||
|
|
||||||
### Internal VPN IPs and traffic
|
|
||||||
|
|
||||||
When connecting using [IPsec/L2TP](docs/clients.md) mode, the VPN server has internal IP `192.168.42.1` within the VPN subnet `192.168.42.0/24`. Clients are assigned internal IPs from `192.168.42.10` to `192.168.42.250`. To check which IP is assigned to a client, view the connection status on the VPN client.
|
|
||||||
|
|
||||||
When connecting using [IPsec/XAuth ("Cisco IPsec")](docs/clients-xauth.md) or [IKEv2](docs/ikev2-howto.md) mode, the VPN server does NOT have an internal IP within the VPN subnet `192.168.43.0/24`. Clients are assigned internal IPs from `192.168.43.10` to `192.168.43.250`.
|
|
||||||
|
|
||||||
You may use these internal VPN IPs for communication. However, note that the IPs assigned to VPN clients are dynamic, and firewalls on client devices may block such traffic.
|
|
||||||
|
|
||||||
For the IPsec/L2TP and IPsec/XAuth ("Cisco IPsec") modes, advanced users may optionally assign static IPs to VPN clients. Expand for details. IKEv2 mode does NOT support this feature.
|
|
||||||
|
|
||||||
<details>
|
|
||||||
<summary>
|
|
||||||
IPsec/L2TP mode: Assign static IPs to VPN clients
|
|
||||||
</summary>
|
|
||||||
|
|
||||||
The example below **ONLY** applies to IPsec/L2TP mode. Commands must be run as `root`.
|
|
||||||
|
|
||||||
1. First, create a new VPN user for each VPN client that you want to assign a static IP to. Refer to [Manage VPN Users](docs/manage-users.md). Helper scripts are included for convenience.
|
|
||||||
1. Edit `/etc/xl2tpd/xl2tpd.conf` on the VPN server. Replace `ip range = 192.168.42.10-192.168.42.250` with e.g. `ip range = 192.168.42.100-192.168.42.250`. This reduces the pool of auto-assigned IP addresses, so that more IPs are available to assign to clients as static IPs.
|
|
||||||
1. Edit `/etc/ppp/chap-secrets` on the VPN server. For example, if the file contains:
|
|
||||||
```
|
|
||||||
"username1" l2tpd "password1" *
|
|
||||||
"username2" l2tpd "password2" *
|
|
||||||
"username3" l2tpd "password3" *
|
|
||||||
```
|
|
||||||
|
|
||||||
Let's assume that you want to assign static IP `192.168.42.2` to VPN user `username2`, assign static IP `192.168.42.3` to VPN user `username3`, while keeping `username1` unchanged (auto-assign from the pool). After editing, the file should look like:
|
|
||||||
```
|
|
||||||
"username1" l2tpd "password1" *
|
|
||||||
"username2" l2tpd "password2" 192.168.42.2
|
|
||||||
"username3" l2tpd "password3" 192.168.42.3
|
|
||||||
```
|
|
||||||
|
|
||||||
**Note:** The assigned static IP(s) must be from the subnet `192.168.42.0/24`, and must NOT be from the pool of auto-assigned IPs (see `ip range` above). In addition, `192.168.42.1` is reserved for the VPN server itself. In the example above, you can only assign static IP(s) from the range `192.168.42.2-192.168.42.99`.
|
|
||||||
1. **(Important)** Restart the xl2tpd service:
|
|
||||||
```
|
|
||||||
service xl2tpd restart
|
|
||||||
```
|
|
||||||
</details>
|
|
||||||
|
|
||||||
<details>
|
|
||||||
<summary>
|
|
||||||
IPsec/XAuth ("Cisco IPsec") mode: Assign static IPs to VPN clients
|
|
||||||
</summary>
|
|
||||||
|
|
||||||
The example below **ONLY** applies to IPsec/XAuth ("Cisco IPsec") mode. Commands must be run as `root`.
|
|
||||||
|
|
||||||
1. First, create a new VPN user for each VPN client that you want to assign a static IP to. Refer to [Manage VPN Users](docs/manage-users.md). Helper scripts are included for convenience.
|
|
||||||
1. Edit `/etc/ipsec.conf` on the VPN server. Replace `rightaddresspool=192.168.43.10-192.168.43.250` with e.g. `rightaddresspool=192.168.43.100-192.168.43.250`. This reduces the pool of auto-assigned IP addresses, so that more IPs are available to assign to clients as static IPs.
|
|
||||||
1. Edit `/etc/ipsec.d/ikev2.conf` on the VPN server (if exists). Replace `rightaddresspool=192.168.43.10-192.168.43.250` with the **same value** as the previous step.
|
|
||||||
1. Edit `/etc/ipsec.d/passwd` on the VPN server. For example, if the file contains:
|
|
||||||
```
|
|
||||||
username1:password1hashed:xauth-psk
|
|
||||||
username2:password2hashed:xauth-psk
|
|
||||||
username3:password3hashed:xauth-psk
|
|
||||||
```
|
|
||||||
|
|
||||||
Let's assume that you want to assign static IP `192.168.43.2` to VPN user `username2`, assign static IP `192.168.43.3` to VPN user `username3`, while keeping `username1` unchanged (auto-assign from the pool). After editing, the file should look like:
|
|
||||||
```
|
|
||||||
username1:password1hashed:xauth-psk
|
|
||||||
username2:password2hashed:xauth-psk:192.168.42.2
|
|
||||||
username3:password3hashed:xauth-psk:192.168.42.3
|
|
||||||
```
|
|
||||||
|
|
||||||
**Note:** The assigned static IP(s) must be from the subnet `192.168.43.0/24`, and must NOT be from the pool of auto-assigned IPs (see `rightaddresspool` above). In the example above, you can only assign static IP(s) from the range `192.168.43.1-192.168.43.99`.
|
|
||||||
1. **(Important)** Restart the IPsec service:
|
|
||||||
```
|
|
||||||
service ipsec restart
|
|
||||||
```
|
|
||||||
</details>
|
|
||||||
|
|
||||||
Client-to-client traffic is allowed by default. If you want to **disallow** client-to-client traffic, run the following commands on the VPN server. Add them to `/etc/rc.local` to persist after reboot.
|
|
||||||
|
|
||||||
```
|
|
||||||
iptables -I FORWARD 2 -i ppp+ -o ppp+ -s 192.168.42.0/24 -d 192.168.42.0/24 -j DROP
|
|
||||||
iptables -I FORWARD 3 -s 192.168.43.0/24 -d 192.168.43.0/24 -j DROP
|
|
||||||
```
|
|
||||||
|
|
||||||
### Split tunneling
|
|
||||||
|
|
||||||
With [split tunneling](https://wiki.strongswan.org/projects/strongswan/wiki/ForwardingAndSplitTunneling#Split-Tunneling), VPN clients will only send traffic for specific destination subnet(s) through the VPN tunnel. Other traffic will NOT go through the VPN tunnel. Split tunneling has [some limitations](https://wiki.strongswan.org/projects/strongswan/wiki/ForwardingAndSplitTunneling#Split-Tunneling), and is not supported by all VPN clients.
|
|
||||||
|
|
||||||
Advanced users can optionally enable split tunneling for the [IPsec/XAuth ("Cisco IPsec")](docs/clients-xauth.md) and/or [IKEv2](docs/ikev2-howto.md) modes. Expand for details. IPsec/L2TP mode does NOT support this feature.
|
|
||||||
|
|
||||||
<details>
|
|
||||||
<summary>
|
|
||||||
IPsec/XAuth ("Cisco IPsec") mode: Enable split tunneling
|
|
||||||
</summary>
|
|
||||||
|
|
||||||
The example below **ONLY** applies to IPsec/XAuth ("Cisco IPsec") mode. Commands must be run as `root`.
|
|
||||||
|
|
||||||
1. Edit `/etc/ipsec.conf` on the VPN server. In the section `conn xauth-psk`, replace `leftsubnet=0.0.0.0/0` with the subnet(s) you want VPN clients to send traffic through the VPN tunnel. For example:
|
|
||||||
For a single subnet:
|
|
||||||
```
|
|
||||||
leftsubnet=10.123.123.0/24
|
|
||||||
```
|
|
||||||
For multiple subnets (use `leftsubnets` instead):
|
|
||||||
```
|
|
||||||
leftsubnets="10.123.123.0/24,10.100.0.0/16"
|
|
||||||
```
|
|
||||||
1. **(Important)** Restart the IPsec service:
|
|
||||||
```
|
|
||||||
service ipsec restart
|
|
||||||
```
|
|
||||||
</details>
|
|
||||||
|
|
||||||
<details>
|
|
||||||
<summary>
|
|
||||||
IKEv2 mode: Enable split tunneling
|
|
||||||
</summary>
|
|
||||||
|
|
||||||
The example below **ONLY** applies to IKEv2 mode. Commands must be run as `root`.
|
|
||||||
|
|
||||||
1. Edit `/etc/ipsec.d/ikev2.conf` on the VPN server. In the section `conn ikev2-cp`, replace `leftsubnet=0.0.0.0/0` with the subnet(s) you want VPN clients to send traffic through the VPN tunnel. For example:
|
|
||||||
For a single subnet:
|
|
||||||
```
|
|
||||||
leftsubnet=10.123.123.0/24
|
|
||||||
```
|
|
||||||
For multiple subnets (use `leftsubnets` instead):
|
|
||||||
```
|
|
||||||
leftsubnets="10.123.123.0/24,10.100.0.0/16"
|
|
||||||
```
|
|
||||||
1. **(Important)** Restart the IPsec service:
|
|
||||||
```
|
|
||||||
service ipsec restart
|
|
||||||
```
|
|
||||||
</details>
|
|
||||||
|
|
||||||
### Access VPN server's subnet
|
|
||||||
|
|
||||||
After connecting to the VPN, VPN clients can generally access services running on other devices that are within the same local subnet as the VPN server, without additional configuration. For example, if the VPN server's local subnet is `192.168.0.0/24`, and an Nginx server is running on IP `192.168.0.2`, VPN clients can use IP `192.168.0.2` to access the Nginx server.
|
|
||||||
|
|
||||||
Please note, additional configuration is required if the VPN server has multiple network interfaces (e.g. `eth0` and `eth1`), and you want VPN clients to access the local subnet behind the network interface that is NOT for Internet access. In this scenario, you must run the following commands to add IPTables rules. To persist after reboot, you may add these commands to `/etc/rc.local`.
|
|
||||||
|
|
||||||
```bash
|
|
||||||
# Replace eth1 with the name of the network interface
|
|
||||||
# on the VPN server that you want VPN clients to access
|
|
||||||
netif=eth1
|
|
||||||
iptables -I FORWARD 2 -i "$netif" -o ppp+ -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
|
|
||||||
iptables -I FORWARD 2 -i ppp+ -o "$netif" -j ACCEPT
|
|
||||||
iptables -I FORWARD 2 -i "$netif" -d 192.168.43.0/24 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
|
|
||||||
iptables -I FORWARD 2 -s 192.168.43.0/24 -o "$netif" -j ACCEPT
|
|
||||||
iptables -t nat -I POSTROUTING -s 192.168.43.0/24 -o "$netif" -m policy --dir out --pol none -j MASQUERADE
|
|
||||||
iptables -t nat -I POSTROUTING -s 192.168.42.0/24 -o "$netif" -j MASQUERADE
|
|
||||||
```
|
|
||||||
|
|
||||||
### IKEv2 only VPN
|
|
||||||
|
|
||||||
Libreswan 4.2 and newer versions support the `ikev1-policy` config option. Using this option, advanced users can set up an IKEv2-only VPN, i.e. only IKEv2 connections are accepted by the VPN server, while IKEv1 connections (including the IPsec/L2TP and IPsec/XAuth ("Cisco IPsec") modes) are dropped.
|
|
||||||
|
|
||||||
To set up an IKEv2-only VPN, first install the VPN server and set up IKEv2 using instructions in this README. Then check Libreswan version using `ipsec --version`, and [update Libreswan](#upgrade-libreswan) if needed. After that, edit `/etc/ipsec.conf` on the VPN server. Append `ikev1-policy=drop` to the end of the `config setup` section, indented by two spaces. Save the file and run `service ipsec restart`. When finished, you can run `ipsec status` to verify that only the `ikev2-cp` connection is enabled.
|
|
||||||
|
|
||||||
### Modify IPTables rules
|
|
||||||
|
|
||||||
If you want to modify the IPTables rules after install, edit `/etc/iptables.rules` and/or `/etc/iptables/rules.v4` (Ubuntu/Debian), or `/etc/sysconfig/iptables` (CentOS/RHEL). Then reboot your server.
|
|
||||||
|
|
||||||
## Bugs & Questions
|
## Bugs & Questions
|
||||||
|
|
||||||
|
|||||||
197
docs/advanced-usage-zh.md
Normal file
197
docs/advanced-usage-zh.md
Normal file
@ -0,0 +1,197 @@
|
|||||||
|
# 高级用法
|
||||||
|
|
||||||
|
*其他语言版本: [English](advanced-usage.md), [简体中文](advanced-usage-zh.md).*
|
||||||
|
|
||||||
|
- [使用其他的 DNS 服务器](#使用其他的-dns-服务器)
|
||||||
|
- [域名和更改服务器 IP](#域名和更改服务器-ip)
|
||||||
|
- [VPN 内网 IP 和流量](#vpn-内网-ip-和流量)
|
||||||
|
- [VPN 分流](#vpn-分流)
|
||||||
|
- [访问 VPN 服务器的网段](#访问-vpn-服务器的网段)
|
||||||
|
- [仅限 IKEv2 的 VPN](#仅限-ikev2-的-vpn)
|
||||||
|
- [更改 IPTables 规则](#更改-iptables-规则)
|
||||||
|
|
||||||
|
## 使用其他的 DNS 服务器
|
||||||
|
|
||||||
|
在 VPN 已连接时，客户端配置为使用 [Google Public DNS](https://developers.google.com/speed/public-dns/)。如果偏好其它的域名解析服务，你可以编辑以下文件：`/etc/ppp/options.xl2tpd`, `/etc/ipsec.conf` 和 `/etc/ipsec.d/ikev2.conf`（如果存在），并替换 `8.8.8.8` 和 `8.8.4.4`。然后运行 `service ipsec restart` 和 `service xl2tpd restart`。
|
||||||
|
|
||||||
|
高级用户可以在运行 VPN 安装脚本和 [IKEv2 辅助脚本](ikev2-howto-zh.md#使用辅助脚本) 时定义 `VPN_DNS_SRV1` 和 `VPN_DNS_SRV2`（可选）。比如你想使用 [Cloudflare 的 DNS 服务](https://1.1.1.1/dns/)：
|
||||||
|
|
||||||
|
```
|
||||||
|
sudo VPN_DNS_SRV1=1.1.1.1 VPN_DNS_SRV2=1.0.0.1 sh vpn.sh
|
||||||
|
sudo VPN_DNS_SRV1=1.1.1.1 VPN_DNS_SRV2=1.0.0.1 ikev2.sh --auto
|
||||||
|
```
|
||||||
|
|
||||||
|
## 域名和更改服务器 IP
|
||||||
|
|
||||||
|
对于 [IPsec/L2TP](clients-zh.md) 和 [IPsec/XAuth ("Cisco IPsec")](clients-xauth-zh.md) 模式，你可以在不需要额外配置的情况下使用一个域名（比如 `vpn.example.com`）而不是 IP 地址连接到 VPN 服务器。另外，一般来说，在服务器的 IP 更改后，比如在恢复一个映像到具有不同 IP 的新服务器后，VPN 会继续正常工作，虽然可能需要重启服务器。
|
||||||
|
|
||||||
|
对于 [IKEv2](ikev2-howto-zh.md) 模式，如果你想要 VPN 在服务器的 IP 更改后继续正常工作，则必须在 [配置 IKEv2](ikev2-howto-zh.md) 时指定一个域名作为 VPN 服务器的地址。该域名必须是一个全称域名(FQDN)。示例如下：
|
||||||
|
|
||||||
|
```
|
||||||
|
sudo VPN_DNS_NAME='vpn.example.com' ikev2.sh --auto
|
||||||
|
```
|
||||||
|
|
||||||
|
另外，你也可以自定义 IKEv2 安装选项，通过在运行 [辅助脚本](ikev2-howto-zh.md#使用辅助脚本) 时去掉 `--auto` 参数来实现。
|
||||||
|
|
||||||
|
## VPN 内网 IP 和流量
|
||||||
|
|
||||||
|
在使用 [IPsec/L2TP](clients-zh.md) 模式连接时，VPN 服务器在虚拟网络 `192.168.42.0/24` 内具有内网 IP `192.168.42.1`。为客户端分配的内网 IP 在这个范围内：`192.168.42.10` 到 `192.168.42.250`。要找到为特定的客户端分配的 IP，可以查看该 VPN 客户端上的连接状态。
|
||||||
|
|
||||||
|
在使用 [IPsec/XAuth ("Cisco IPsec")](clients-xauth-zh.md) 或 [IKEv2](ikev2-howto-zh.md) 模式连接时，VPN 服务器在虚拟网络 `192.168.43.0/24` 内 **没有** 内网 IP。为客户端分配的内网 IP 在这个范围内：`192.168.43.10` 到 `192.168.43.250`。
|
||||||
|
|
||||||
|
你可以使用这些 VPN 内网 IP 进行通信。但是请注意，为 VPN 客户端分配的 IP 是动态的，而且客户端设备上的防火墙可能会阻止这些流量。
|
||||||
|
|
||||||
|
对于 IPsec/L2TP 和 IPsec/XAuth ("Cisco IPsec") 模式，高级用户可以将静态 IP 分配给 VPN 客户端。这是可选的。展开以查看详细信息。IKEv2 模式 **不支持** 此功能。
|
||||||
|
|
||||||
|
<details>
|
||||||
|
<summary>
|
||||||
|
IPsec/L2TP 模式：为 VPN 客户端分配静态 IP
|
||||||
|
</summary>
|
||||||
|
|
||||||
|
下面的示例 **仅适用于** IPsec/L2TP 模式。这些命令必须用 `root` 账户运行。
|
||||||
|
|
||||||
|
1. 首先为要分配静态 IP 的每个 VPN 客户端创建一个新的 VPN 用户。参见 [管理 VPN 用户](manage-users-zh.md)。该文档包含辅助脚本，以方便管理 VPN 用户。
|
||||||
|
1. 编辑 VPN 服务器上的 `/etc/xl2tpd/xl2tpd.conf`。将 `ip range = 192.168.42.10-192.168.42.250` 替换为比如 `ip range = 192.168.42.100-192.168.42.250`。这样可以缩小自动分配的 IP 地址池，从而使更多的 IP 可以作为静态 IP 分配给客户端。
|
||||||
|
1. 编辑 VPN 服务器上的 `/etc/ppp/chap-secrets`。例如，如果文件内容是：
|
||||||
|
```
|
||||||
|
"username1" l2tpd "password1" *
|
||||||
|
"username2" l2tpd "password2" *
|
||||||
|
"username3" l2tpd "password3" *
|
||||||
|
```
|
||||||
|
|
||||||
|
假设你要为 VPN 用户 `username2` 分配静态 IP `192.168.42.2`，为 VPN 用户 `username3` 分配静态 IP `192.168.42.3`，同时保持 `username1` 不变（从池中自动分配）。在编辑完成后，文件内容应该如下所示：
|
||||||
|
```
|
||||||
|
"username1" l2tpd "password1" *
|
||||||
|
"username2" l2tpd "password2" 192.168.42.2
|
||||||
|
"username3" l2tpd "password3" 192.168.42.3
|
||||||
|
```
|
||||||
|
|
||||||
|
**注：** 分配的静态 IP 必须来自子网 `192.168.42.0/24`，并且必须 **不是** 来自自动分配的 IP 地址池（参见上面的 `ip range`）。另外，`192.168.42.1` 保留给 VPN 服务器本身使用。在上面的示例中，你只能分配 `192.168.42.2-192.168.42.99` 范围内的静态 IP。
|
||||||
|
1. **（重要）** 重启 xl2tpd 服务：
|
||||||
|
```
|
||||||
|
service xl2tpd restart
|
||||||
|
```
|
||||||
|
</details>
|
||||||
|
|
||||||
|
<details>
|
||||||
|
<summary>
|
||||||
|
IPsec/XAuth ("Cisco IPsec") 模式：为 VPN 客户端分配静态 IP
|
||||||
|
</summary>
|
||||||
|
|
||||||
|
下面的示例 **仅适用于** IPsec/XAuth ("Cisco IPsec") 模式。这些命令必须用 `root` 账户运行。
|
||||||
|
|
||||||
|
1. 首先为要分配静态 IP 的每个 VPN 客户端创建一个新的 VPN 用户。参见 [管理 VPN 用户](manage-users-zh.md)。该文档包含辅助脚本，以方便管理 VPN 用户。
|
||||||
|
1. 编辑 VPN 服务器上的 `/etc/ipsec.conf`。将 `rightaddresspool=192.168.43.10-192.168.43.250` 替换为比如 `rightaddresspool=192.168.43.100-192.168.43.250`。这样可以缩小自动分配的 IP 地址池，从而使更多的 IP 可以作为静态 IP 分配给客户端。
|
||||||
|
1. 编辑 VPN 服务器上的 `/etc/ipsec.d/ikev2.conf`（如果存在）。将 `rightaddresspool=192.168.43.10-192.168.43.250` 替换为与上一步 **相同的值**。
|
||||||
|
1. 编辑 VPN 服务器上的 `/etc/ipsec.d/passwd`。例如，如果文件内容是：
|
||||||
|
```
|
||||||
|
username1:password1hashed:xauth-psk
|
||||||
|
username2:password2hashed:xauth-psk
|
||||||
|
username3:password3hashed:xauth-psk
|
||||||
|
```
|
||||||
|
|
||||||
|
假设你要为 VPN 用户 `username2` 分配静态 IP `192.168.43.2`，为 VPN 用户 `username3` 分配静态 IP `192.168.43.3`，同时保持 `username1` 不变（从池中自动分配）。在编辑完成后，文件内容应该如下所示：
|
||||||
|
```
|
||||||
|
username1:password1hashed:xauth-psk
|
||||||
|
username2:password2hashed:xauth-psk:192.168.42.2
|
||||||
|
username3:password3hashed:xauth-psk:192.168.42.3
|
||||||
|
```
|
||||||
|
|
||||||
|
**注：** 分配的静态 IP 必须来自子网 `192.168.43.0/24`，并且必须 **不是** 来自自动分配的 IP 地址池（参见上面的 `rightaddresspool`）。在上面的示例中，你只能分配 `192.168.43.1-192.168.43.99` 范围内的静态 IP。
|
||||||
|
1. **（重要）** 重启 IPsec 服务：
|
||||||
|
```
|
||||||
|
service ipsec restart
|
||||||
|
```
|
||||||
|
</details>
|
||||||
|
|
||||||
|
在默认配置下，允许客户端之间的流量。如果你想要 **不允许** 客户端之间的流量，可以在 VPN 服务器上运行以下命令。将它们添加到 `/etc/rc.local` 以便在重启后继续有效。
|
||||||
|
|
||||||
|
```
|
||||||
|
iptables -I FORWARD 2 -i ppp+ -o ppp+ -s 192.168.42.0/24 -d 192.168.42.0/24 -j DROP
|
||||||
|
iptables -I FORWARD 3 -s 192.168.43.0/24 -d 192.168.43.0/24 -j DROP
|
||||||
|
```
|
||||||
|
|
||||||
|
## VPN 分流
|
||||||
|
|
||||||
|
在启用 [VPN 分流 (split tunneling)](https://wiki.strongswan.org/projects/strongswan/wiki/ForwardingAndSplitTunneling#Split-Tunneling) 时，VPN 客户端将仅通过 VPN 隧道发送特定目标子网的流量。其他流量 **不会** 通过 VPN 隧道。VPN 分流 [有一些局限性](https://wiki.strongswan.org/projects/strongswan/wiki/ForwardingAndSplitTunneling#Split-Tunneling)，而且并非所有的 VPN 客户端都支持。
|
||||||
|
|
||||||
|
高级用户可以为 [IPsec/XAuth ("Cisco IPsec")](clients-xauth-zh.md) 和/或 [IKEv2](ikev2-howto-zh.md) 模式启用 VPN 分流。这是可选的。IPsec/L2TP 模式 **不支持** 此功能。
|
||||||
|
|
||||||
|
<details>
|
||||||
|
<summary>
|
||||||
|
IPsec/XAuth ("Cisco IPsec") 模式：启用 VPN 分流 (split tunneling)
|
||||||
|
</summary>
|
||||||
|
|
||||||
|
下面的示例 **仅适用于** IPsec/XAuth ("Cisco IPsec") 模式。这些命令必须用 `root` 账户运行。
|
||||||
|
|
||||||
|
1. 编辑 VPN 服务器上的 `/etc/ipsec.conf`。在 `conn xauth-psk` 小节中，将 `leftsubnet=0.0.0.0/0` 替换为你想要 VPN 客户端通过 VPN 隧道发送流量的子网。例如：
|
||||||
|
对于单个子网：
|
||||||
|
```
|
||||||
|
leftsubnet=10.123.123.0/24
|
||||||
|
```
|
||||||
|
对于多个子网（使用 `leftsubnets`）：
|
||||||
|
```
|
||||||
|
leftsubnets="10.123.123.0/24,10.100.0.0/16"
|
||||||
|
```
|
||||||
|
1. **（重要）** 重启 IPsec 服务：
|
||||||
|
```
|
||||||
|
service ipsec restart
|
||||||
|
```
|
||||||
|
</details>
|
||||||
|
|
||||||
|
<details>
|
||||||
|
<summary>
|
||||||
|
IKEv2 模式：启用 VPN 分流 (split tunneling)
|
||||||
|
</summary>
|
||||||
|
|
||||||
|
下面的示例 **仅适用于** IKEv2 模式。这些命令必须用 `root` 账户运行。
|
||||||
|
|
||||||
|
1. 编辑 VPN 服务器上的 `/etc/ipsec.d/ikev2.conf`。在 `conn ikev2-cp` 小节中，将 `leftsubnet=0.0.0.0/0` 替换为你想要 VPN 客户端通过 VPN 隧道发送流量的子网。例如：
|
||||||
|
对于单个子网：
|
||||||
|
```
|
||||||
|
leftsubnet=10.123.123.0/24
|
||||||
|
```
|
||||||
|
对于多个子网（使用 `leftsubnets`）：
|
||||||
|
```
|
||||||
|
leftsubnets="10.123.123.0/24,10.100.0.0/16"
|
||||||
|
```
|
||||||
|
1. **（重要）** 重启 IPsec 服务：
|
||||||
|
```
|
||||||
|
service ipsec restart
|
||||||
|
```
|
||||||
|
</details>
|
||||||
|
|
||||||
|
## 访问 VPN 服务器的网段
|
||||||
|
|
||||||
|
连接到 VPN 后，VPN 客户端通常可以访问与 VPN 服务器位于同一本地子网内的其他设备上运行的服务，而无需进行其他配置。例如，如果 VPN 服务器的本地子网为 `192.168.0.0/24`，并且一个 Nginx 服务器在 IP `192.168.0.2` 上运行，则 VPN 客户端可以使用 IP `192.168.0.2`来访问 Nginx 服务器。
|
||||||
|
|
||||||
|
请注意，如果 VPN 服务器具有多个网络接口（例如 `eth0` 和 `eth1`），并且你想要 VPN 客户端访问服务器上 **不用于** Internet 访问的网络接口后面的本地子网，则需要进行额外的配置。在此情形下，你必须运行以下命令来添加 IPTables 规则。为了在重启后仍然有效，你可以将这些命令添加到 `/etc/rc.local`。
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# 将 eth1 替换为 VPN 服务器上你想要客户端访问的网络接口名称
|
||||||
|
netif=eth1
|
||||||
|
iptables -I FORWARD 2 -i "$netif" -o ppp+ -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
|
||||||
|
iptables -I FORWARD 2 -i ppp+ -o "$netif" -j ACCEPT
|
||||||
|
iptables -I FORWARD 2 -i "$netif" -d 192.168.43.0/24 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
|
||||||
|
iptables -I FORWARD 2 -s 192.168.43.0/24 -o "$netif" -j ACCEPT
|
||||||
|
iptables -t nat -I POSTROUTING -s 192.168.43.0/24 -o "$netif" -m policy --dir out --pol none -j MASQUERADE
|
||||||
|
iptables -t nat -I POSTROUTING -s 192.168.42.0/24 -o "$netif" -j MASQUERADE
|
||||||
|
```
|
||||||
|
|
||||||
|
## 仅限 IKEv2 的 VPN
|
||||||
|
|
||||||
|
Libreswan 4.2 和更新版本支持 `ikev1-policy` 配置选项。使用此选项，高级用户可以设置仅限 IKEv2 的 VPN，即 VPN 服务器仅接受 IKEv2 连接，而 IKEv1 连接（包括 IPsec/L2TP 和 IPsec/XAuth ("Cisco IPsec") 模式）将被丢弃。
|
||||||
|
|
||||||
|
要设置仅限 IKEv2 的 VPN，首先按照 [自述文件](../README-zh.md) 中的说明安装 VPN 服务器并且配置 IKEv2。然后使用 `ipsec --version` 命令检查 Libreswan 版本并 [更新 Libreswan](../README-zh.md#升级libreswan)（如果需要）。下一步，编辑 VPN 服务器上的 `/etc/ipsec.conf`。在 `config setup` 小节的末尾添加 `ikev1-policy=drop`，开头必须空两格。保存文件并运行 `service ipsec restart`。在完成后，你可以使用 `ipsec status` 命令来验证仅启用了 `ikev2-cp` 连接。
|
||||||
|
|
||||||
|
## 更改 IPTables 规则
|
||||||
|
|
||||||
|
如果你想要在安装后更改 IPTables 规则，请编辑 `/etc/iptables.rules` 和/或 `/etc/iptables/rules.v4` (Ubuntu/Debian)，或者 `/etc/sysconfig/iptables` (CentOS/RHEL)。然后重启服务器。
|
||||||
|
|
||||||
|
## 授权协议
|
||||||
|
|
||||||
|
版权所有 (C) 2021 [Lin Song](https://github.com/hwdsl2) [](https://www.linkedin.com/in/linsongui)
|
||||||
|
|
||||||
|
[](http://creativecommons.org/licenses/by-sa/3.0/)
|
||||||
|
这个项目是以 [知识共享署名-相同方式共享3.0](http://creativecommons.org/licenses/by-sa/3.0/) 许可协议授权。
|
||||||
|
必须署名： 请包括我的名字在任何衍生产品，并且让我知道你是如何改善它的！
|
||||||
198
docs/advanced-usage.md
Normal file
198
docs/advanced-usage.md
Normal file
@ -0,0 +1,198 @@
|
|||||||
|
# Advanced usage
|
||||||
|
|
||||||
|
*Read this in other languages: [English](advanced-usage.md), [简体中文](advanced-usage-zh.md).*
|
||||||
|
|
||||||
|
- [Use alternative DNS servers](#use-alternative-dns-servers)
|
||||||
|
- [DNS name and server IP changes](#dns-name-and-server-ip-changes)
|
||||||
|
- [Internal VPN IPs and traffic](#internal-vpn-ips-and-traffic)
|
||||||
|
- [Split tunneling](#split-tunneling)
|
||||||
|
- [Access VPN server's subnet](#access-vpn-servers-subnet)
|
||||||
|
- [IKEv2 only VPN](#ikev2-only-vpn)
|
||||||
|
- [Modify IPTables rules](#modify-iptables-rules)
|
||||||
|
|
||||||
|
## Use alternative DNS servers
|
||||||
|
|
||||||
|
Clients are set to use [Google Public DNS](https://developers.google.com/speed/public-dns/) when the VPN is active. If another DNS provider is preferred, you may replace `8.8.8.8` and `8.8.4.4` in these files: `/etc/ppp/options.xl2tpd`, `/etc/ipsec.conf` and `/etc/ipsec.d/ikev2.conf` (if exists). Then run `service ipsec restart` and `service xl2tpd restart`.
|
||||||
|
|
||||||
|
Advanced users can define `VPN_DNS_SRV1` and optionally `VPN_DNS_SRV2` when running the VPN setup script and the [IKEv2 helper script](ikev2-howto.md#using-helper-scripts). For example, if you want to use [Cloudflare's DNS service](https://1.1.1.1/dns/):
|
||||||
|
|
||||||
|
```
|
||||||
|
sudo VPN_DNS_SRV1=1.1.1.1 VPN_DNS_SRV2=1.0.0.1 sh vpn.sh
|
||||||
|
sudo VPN_DNS_SRV1=1.1.1.1 VPN_DNS_SRV2=1.0.0.1 ikev2.sh --auto
|
||||||
|
```
|
||||||
|
|
||||||
|
## DNS name and server IP changes
|
||||||
|
|
||||||
|
For [IPsec/L2TP](clients.md) and [IPsec/XAuth ("Cisco IPsec")](clients-xauth.md) modes, you may use a DNS name (e.g. `vpn.example.com`) instead of an IP address to connect to the VPN server, without additional configuration. In addition, the VPN should generally continue to work after server IP changes, such as after restoring a snapshot to a new server with a different IP, although a reboot may be required.
|
||||||
|
|
||||||
|
For [IKEv2](ikev2-howto.md) mode, if you want the VPN to continue to work after server IP changes, you must specify a DNS name to be used as the VPN server's address when [setting up IKEv2](ikev2-howto.md). The DNS name must be a fully qualified domain name (FQDN). Example:
|
||||||
|
|
||||||
|
```
|
||||||
|
sudo VPN_DNS_NAME='vpn.example.com' ikev2.sh --auto
|
||||||
|
```
|
||||||
|
|
||||||
|
Alternatively, you may customize IKEv2 setup options by running the [helper script](ikev2-howto.md#using-helper-scripts) without the `--auto` parameter.
|
||||||
|
|
||||||
|
## Internal VPN IPs and traffic
|
||||||
|
|
||||||
|
When connecting using [IPsec/L2TP](clients.md) mode, the VPN server has internal IP `192.168.42.1` within the VPN subnet `192.168.42.0/24`. Clients are assigned internal IPs from `192.168.42.10` to `192.168.42.250`. To check which IP is assigned to a client, view the connection status on the VPN client.
|
||||||
|
|
||||||
|
When connecting using [IPsec/XAuth ("Cisco IPsec")](clients-xauth.md) or [IKEv2](ikev2-howto.md) mode, the VPN server does NOT have an internal IP within the VPN subnet `192.168.43.0/24`. Clients are assigned internal IPs from `192.168.43.10` to `192.168.43.250`.
|
||||||
|
|
||||||
|
You may use these internal VPN IPs for communication. However, note that the IPs assigned to VPN clients are dynamic, and firewalls on client devices may block such traffic.
|
||||||
|
|
||||||
|
For the IPsec/L2TP and IPsec/XAuth ("Cisco IPsec") modes, advanced users may optionally assign static IPs to VPN clients. Expand for details. IKEv2 mode does NOT support this feature.
|
||||||
|
|
||||||
|
<details>
|
||||||
|
<summary>
|
||||||
|
IPsec/L2TP mode: Assign static IPs to VPN clients
|
||||||
|
</summary>
|
||||||
|
|
||||||
|
The example below **ONLY** applies to IPsec/L2TP mode. Commands must be run as `root`.
|
||||||
|
|
||||||
|
1. First, create a new VPN user for each VPN client that you want to assign a static IP to. Refer to [Manage VPN Users](manage-users.md). Helper scripts are included for convenience.
|
||||||
|
1. Edit `/etc/xl2tpd/xl2tpd.conf` on the VPN server. Replace `ip range = 192.168.42.10-192.168.42.250` with e.g. `ip range = 192.168.42.100-192.168.42.250`. This reduces the pool of auto-assigned IP addresses, so that more IPs are available to assign to clients as static IPs.
|
||||||
|
1. Edit `/etc/ppp/chap-secrets` on the VPN server. For example, if the file contains:
|
||||||
|
```
|
||||||
|
"username1" l2tpd "password1" *
|
||||||
|
"username2" l2tpd "password2" *
|
||||||
|
"username3" l2tpd "password3" *
|
||||||
|
```
|
||||||
|
|
||||||
|
Let's assume that you want to assign static IP `192.168.42.2` to VPN user `username2`, assign static IP `192.168.42.3` to VPN user `username3`, while keeping `username1` unchanged (auto-assign from the pool). After editing, the file should look like:
|
||||||
|
```
|
||||||
|
"username1" l2tpd "password1" *
|
||||||
|
"username2" l2tpd "password2" 192.168.42.2
|
||||||
|
"username3" l2tpd "password3" 192.168.42.3
|
||||||
|
```
|
||||||
|
|
||||||
|
**Note:** The assigned static IP(s) must be from the subnet `192.168.42.0/24`, and must NOT be from the pool of auto-assigned IPs (see `ip range` above). In addition, `192.168.42.1` is reserved for the VPN server itself. In the example above, you can only assign static IP(s) from the range `192.168.42.2-192.168.42.99`.
|
||||||
|
1. **(Important)** Restart the xl2tpd service:
|
||||||
|
```
|
||||||
|
service xl2tpd restart
|
||||||
|
```
|
||||||
|
</details>
|
||||||
|
|
||||||
|
<details>
|
||||||
|
<summary>
|
||||||
|
IPsec/XAuth ("Cisco IPsec") mode: Assign static IPs to VPN clients
|
||||||
|
</summary>
|
||||||
|
|
||||||
|
The example below **ONLY** applies to IPsec/XAuth ("Cisco IPsec") mode. Commands must be run as `root`.
|
||||||
|
|
||||||
|
1. First, create a new VPN user for each VPN client that you want to assign a static IP to. Refer to [Manage VPN Users](manage-users.md). Helper scripts are included for convenience.
|
||||||
|
1. Edit `/etc/ipsec.conf` on the VPN server. Replace `rightaddresspool=192.168.43.10-192.168.43.250` with e.g. `rightaddresspool=192.168.43.100-192.168.43.250`. This reduces the pool of auto-assigned IP addresses, so that more IPs are available to assign to clients as static IPs.
|
||||||
|
1. Edit `/etc/ipsec.d/ikev2.conf` on the VPN server (if exists). Replace `rightaddresspool=192.168.43.10-192.168.43.250` with the **same value** as the previous step.
|
||||||
|
1. Edit `/etc/ipsec.d/passwd` on the VPN server. For example, if the file contains:
|
||||||
|
```
|
||||||
|
username1:password1hashed:xauth-psk
|
||||||
|
username2:password2hashed:xauth-psk
|
||||||
|
username3:password3hashed:xauth-psk
|
||||||
|
```
|
||||||
|
|
||||||
|
Let's assume that you want to assign static IP `192.168.43.2` to VPN user `username2`, assign static IP `192.168.43.3` to VPN user `username3`, while keeping `username1` unchanged (auto-assign from the pool). After editing, the file should look like:
|
||||||
|
```
|
||||||
|
username1:password1hashed:xauth-psk
|
||||||
|
username2:password2hashed:xauth-psk:192.168.42.2
|
||||||
|
username3:password3hashed:xauth-psk:192.168.42.3
|
||||||
|
```
|
||||||
|
|
||||||
|
**Note:** The assigned static IP(s) must be from the subnet `192.168.43.0/24`, and must NOT be from the pool of auto-assigned IPs (see `rightaddresspool` above). In the example above, you can only assign static IP(s) from the range `192.168.43.1-192.168.43.99`.
|
||||||
|
1. **(Important)** Restart the IPsec service:
|
||||||
|
```
|
||||||
|
service ipsec restart
|
||||||
|
```
|
||||||
|
</details>
|
||||||
|
|
||||||
|
Client-to-client traffic is allowed by default. If you want to **disallow** client-to-client traffic, run the following commands on the VPN server. Add them to `/etc/rc.local` to persist after reboot.
|
||||||
|
|
||||||
|
```
|
||||||
|
iptables -I FORWARD 2 -i ppp+ -o ppp+ -s 192.168.42.0/24 -d 192.168.42.0/24 -j DROP
|
||||||
|
iptables -I FORWARD 3 -s 192.168.43.0/24 -d 192.168.43.0/24 -j DROP
|
||||||
|
```
|
||||||
|
|
||||||
|
## Split tunneling
|
||||||
|
|
||||||
|
With [split tunneling](https://wiki.strongswan.org/projects/strongswan/wiki/ForwardingAndSplitTunneling#Split-Tunneling), VPN clients will only send traffic for specific destination subnet(s) through the VPN tunnel. Other traffic will NOT go through the VPN tunnel. Split tunneling has [some limitations](https://wiki.strongswan.org/projects/strongswan/wiki/ForwardingAndSplitTunneling#Split-Tunneling), and is not supported by all VPN clients.
|
||||||
|
|
||||||
|
Advanced users can optionally enable split tunneling for the [IPsec/XAuth ("Cisco IPsec")](clients-xauth.md) and/or [IKEv2](ikev2-howto.md) modes. Expand for details. IPsec/L2TP mode does NOT support this feature.
|
||||||
|
|
||||||
|
<details>
|
||||||
|
<summary>
|
||||||
|
IPsec/XAuth ("Cisco IPsec") mode: Enable split tunneling
|
||||||
|
</summary>
|
||||||
|
|
||||||
|
The example below **ONLY** applies to IPsec/XAuth ("Cisco IPsec") mode. Commands must be run as `root`.
|
||||||
|
|
||||||
|
1. Edit `/etc/ipsec.conf` on the VPN server. In the section `conn xauth-psk`, replace `leftsubnet=0.0.0.0/0` with the subnet(s) you want VPN clients to send traffic through the VPN tunnel. For example:
|
||||||
|
For a single subnet:
|
||||||
|
```
|
||||||
|
leftsubnet=10.123.123.0/24
|
||||||
|
```
|
||||||
|
For multiple subnets (use `leftsubnets` instead):
|
||||||
|
```
|
||||||
|
leftsubnets="10.123.123.0/24,10.100.0.0/16"
|
||||||
|
```
|
||||||
|
1. **(Important)** Restart the IPsec service:
|
||||||
|
```
|
||||||
|
service ipsec restart
|
||||||
|
```
|
||||||
|
</details>
|
||||||
|
|
||||||
|
<details>
|
||||||
|
<summary>
|
||||||
|
IKEv2 mode: Enable split tunneling
|
||||||
|
</summary>
|
||||||
|
|
||||||
|
The example below **ONLY** applies to IKEv2 mode. Commands must be run as `root`.
|
||||||
|
|
||||||
|
1. Edit `/etc/ipsec.d/ikev2.conf` on the VPN server. In the section `conn ikev2-cp`, replace `leftsubnet=0.0.0.0/0` with the subnet(s) you want VPN clients to send traffic through the VPN tunnel. For example:
|
||||||
|
For a single subnet:
|
||||||
|
```
|
||||||
|
leftsubnet=10.123.123.0/24
|
||||||
|
```
|
||||||
|
For multiple subnets (use `leftsubnets` instead):
|
||||||
|
```
|
||||||
|
leftsubnets="10.123.123.0/24,10.100.0.0/16"
|
||||||
|
```
|
||||||
|
1. **(Important)** Restart the IPsec service:
|
||||||
|
```
|
||||||
|
service ipsec restart
|
||||||
|
```
|
||||||
|
</details>
|
||||||
|
|
||||||
|
## Access VPN server's subnet
|
||||||
|
|
||||||
|
After connecting to the VPN, VPN clients can generally access services running on other devices that are within the same local subnet as the VPN server, without additional configuration. For example, if the VPN server's local subnet is `192.168.0.0/24`, and an Nginx server is running on IP `192.168.0.2`, VPN clients can use IP `192.168.0.2` to access the Nginx server.
|
||||||
|
|
||||||
|
Please note, additional configuration is required if the VPN server has multiple network interfaces (e.g. `eth0` and `eth1`), and you want VPN clients to access the local subnet behind the network interface that is NOT for Internet access. In this scenario, you must run the following commands to add IPTables rules. To persist after reboot, you may add these commands to `/etc/rc.local`.
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# Replace eth1 with the name of the network interface
|
||||||
|
# on the VPN server that you want VPN clients to access
|
||||||
|
netif=eth1
|
||||||
|
iptables -I FORWARD 2 -i "$netif" -o ppp+ -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
|
||||||
|
iptables -I FORWARD 2 -i ppp+ -o "$netif" -j ACCEPT
|
||||||
|
iptables -I FORWARD 2 -i "$netif" -d 192.168.43.0/24 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
|
||||||
|
iptables -I FORWARD 2 -s 192.168.43.0/24 -o "$netif" -j ACCEPT
|
||||||
|
iptables -t nat -I POSTROUTING -s 192.168.43.0/24 -o "$netif" -m policy --dir out --pol none -j MASQUERADE
|
||||||
|
iptables -t nat -I POSTROUTING -s 192.168.42.0/24 -o "$netif" -j MASQUERADE
|
||||||
|
```
|
||||||
|
|
||||||
|
## IKEv2 only VPN
|
||||||
|
|
||||||
|
Libreswan 4.2 and newer versions support the `ikev1-policy` config option. Using this option, advanced users can set up an IKEv2-only VPN, i.e. only IKEv2 connections are accepted by the VPN server, while IKEv1 connections (including the IPsec/L2TP and IPsec/XAuth ("Cisco IPsec") modes) are dropped.
|
||||||
|
|
||||||
|
To set up an IKEv2-only VPN, first install the VPN server and set up IKEv2 using instructions in the [README](../README.md). Then check Libreswan version using `ipsec --version`, and [update Libreswan](../README.md#upgrade-libreswan) if needed. After that, edit `/etc/ipsec.conf` on the VPN server. Append `ikev1-policy=drop` to the end of the `config setup` section, indented by two spaces. Save the file and run `service ipsec restart`. When finished, you can run `ipsec status` to verify that only the `ikev2-cp` connection is enabled.
|
||||||
|
|
||||||
|
## Modify IPTables rules
|
||||||
|
|
||||||
|
If you want to modify the IPTables rules after install, edit `/etc/iptables.rules` and/or `/etc/iptables/rules.v4` (Ubuntu/Debian), or `/etc/sysconfig/iptables` (CentOS/RHEL). Then reboot your server.
|
||||||
|
|
||||||
|
## License
|
||||||
|
|
||||||
|
Copyright (C) 2021 [Lin Song](https://github.com/hwdsl2) [](https://www.linkedin.com/in/linsongui)
|
||||||
|
|
||||||
|
[](http://creativecommons.org/licenses/by-sa/3.0/)
|
||||||
|
This work is licensed under the [Creative Commons Attribution-ShareAlike 3.0 Unported License](http://creativecommons.org/licenses/by-sa/3.0/)
|
||||||
|
Attribution required: please include my name in any derivative and let me know how you have improved it!
|
||||||
@ -218,7 +218,7 @@ Fedora 28（和更新版本）和 CentOS 8/7 用户可以使用 [IPsec/XAuth](cl
|
|||||||
|
|
||||||
*其他语言版本: [English](clients.md#troubleshooting), [简体中文](clients-zh.md#故障排除).*
|
*其他语言版本: [English](clients.md#troubleshooting), [简体中文](clients-zh.md#故障排除).*
|
||||||
|
|
||||||
**另见：** [IKEv2 故障排除](ikev2-howto-zh.md#故障排除)，[检查日志及 VPN 状态](#检查日志及-vpn-状态) 和 [高级用法](../README-zh.md#高级用法)。
|
**另见：** [检查日志及 VPN 状态](#检查日志及-vpn-状态)，[IKEv2 故障排除](ikev2-howto-zh.md#故障排除) 和 [高级用法](advanced-usage-zh.md)。
|
||||||
|
|
||||||
* [Windows 错误 809](#windows-错误-809)
|
* [Windows 错误 809](#windows-错误-809)
|
||||||
* [Windows 错误 789 或 691](#windows-错误-789-或-691)
|
* [Windows 错误 789 或 691](#windows-错误-789-或-691)
|
||||||
|
|||||||
@ -217,7 +217,7 @@ First check [here](https://github.com/nm-l2tp/NetworkManager-l2tp/wiki/Prebuilt-
|
|||||||
|
|
||||||
*Read this in other languages: [English](clients.md#troubleshooting), [简体中文](clients-zh.md#故障排除).*
|
*Read this in other languages: [English](clients.md#troubleshooting), [简体中文](clients-zh.md#故障排除).*
|
||||||
|
|
||||||
**See also:** [IKEv2 troubleshooting](ikev2-howto.md#troubleshooting), [check logs and VPN status](#check-logs-and-vpn-status) and [advanced usage](../README.md#advanced-usage).
|
**See also:** [check logs and VPN status](#check-logs-and-vpn-status), [IKEv2 troubleshooting](ikev2-howto.md#troubleshooting) and [advanced usage](advanced-usage.md).
|
||||||
|
|
||||||
* [Windows error 809](#windows-error-809)
|
* [Windows error 809](#windows-error-809)
|
||||||
* [Windows error 789 or 691](#windows-error-789-or-691)
|
* [Windows error 789 or 691](#windows-error-789-or-691)
|
||||||
|
|||||||
Loading…
Reference in New Issue
Block a user