雨田博客CENTOS 下搭建L2TP VPN
因为路由器用 OPENWRT，用PPTP无法穿过路由，所以改L2TP了。
一键脚本如下
#!/bin/bash PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin:~/bin export PATH #=================================================================== # SYSTEM REQUIRED: CentOS 6 (32bit/64bit) # DESCRIPTION: Auto install L2TP for CentOS 6 # Author: Teddysun <[email protected]> #=================================================================== if [[ $EUID -ne 0 ]]; then echo "Error:This script must be run as root!" exit 1 fi if [[ ! -e /dev/net/tun ]]; then echo "TUN/TAP is not available!" exit 1 fi clear echo "" echo "#############################################################" echo "# Auto install L2TP for CentOS 6 #" echo "# System Required: CentOS 6(32bit/64bit) #" echo "# Intro: http://teddysun.com/135.html #" echo "# Author: Teddysun <[email protected]> #" echo "#############################################################" echo "" tmpip=`ip addr | egrep -o '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | egrep -v "^192\.168|^172\.1[6-9]\.|^172\.2[0-9]\.|^172\.3[0-2]\.|^10\.|^127\.|^255\." | head -n 1` if [[ "$tmpip" = "" ]]; then tmpip=`curl -s -4 icanhazip.com` fi echo "Please input IP-Range:" read -p "(Default Range: 10.1.2):" iprange if [ "$iprange" = "" ]; then iprange="10.1.2" fi echo "Please input PSK:" read -p "(Default PSK: vpn):" mypsk if [ "$mypsk" = "" ]; then mypsk="vpn" fi clear get_char(){ SAVEDSTTY=`stty -g` stty -echo stty cbreak dd if=/dev/tty bs=1 count=1 2> /dev/null stty -raw stty echo stty $SAVEDSTTY } echo "" echo "ServerIP:" echo "$tmpip" echo "" echo "Server Local IP:" echo "$iprange.1" echo "" echo "Client Remote IP Range:" echo "$iprange.2-$iprange.254" echo "" echo "PSK:" echo "$mypsk" echo "" echo "Press any key to start...or Press Ctrl+c to cancel" char=`get_char` clear mknod /dev/random c 1 9 # Install some necessary tools yum install -y ppp iptables make gcc gmp-devel xmlto bison flex libpcap-devel lsof vim-enhanced # cur_dir=`pwd` mkdir -p $cur_dir/l2tp cd $cur_dir/l2tp # Download openswan-2.6.38.tar.gz if [ -s openswan-2.6.38.tar.gz ]; then echo "openswan-2.6.38.tar.gz [found]" else echo "openswan-2.6.38.tar.gz not found!!!download now......" if ! wget http://lamp.teddysun.com/files/openswan-2.6.38.tar.gz;then echo "Failed to download openswan-2.6.38.tar.gz, please download it to $cur_dir directory manually and retry." exit 1 fi fi # Download rp-l2tp-0.4.tar.gz if [ -s rp-l2tp-0.4.tar.gz ]; then echo "rp-l2tp-0.4.tar.gz [found]" else echo "rp-l2tp-0.4.tar.gz not found!!!download now......" if ! wget http://lamp.teddysun.com/files/rp-l2tp-0.4.tar.gz;then echo "Failed to download rp-l2tp-0.4.tar.gz, please download it to $cur_dir directory manually and retry." exit 1 fi fi # Download xl2tpd-1.2.4.tar.gz if [ -s xl2tpd-1.2.4.tar.gz ]; then echo "xl2tpd-1.2.4.tar.gz [found]" else echo "xl2tpd-1.2.4.tar.gz not found!!!download now......" if ! wget http://lamp.teddysun.com/files/xl2tpd-1.2.4.tar.gz;then echo "Failed to download xl2tpd-1.2.4.tar.gz, please download it to $cur_dir directory manually and retry." exit 1 fi fi # untar all files rm -rf $cur_dir/l2tp/untar mkdir -p $cur_dir/l2tp/untar echo "======untar all files,please wait a moment=====" tar -zxf openswan-2.6.38.tar.gz -C $cur_dir/l2tp/untar tar -zxf rp-l2tp-0.4.tar.gz -C $cur_dir/l2tp/untar tar -zxf xl2tpd-1.2.4.tar.gz -C $cur_dir/l2tp/untar echo "=====untar all files completed!=====" # Install openswan-2.6.38 cd $cur_dir/l2tp/untar/openswan-2.6.38 make programs install # Configuation ipsec rm -rf /etc/ipsec.conf touch /etc/ipsec.conf cat >>/etc/ipsec.conf<<EOF config setup nat_traversal=yes virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12 oe=off protostack=netkey conn L2TP-PSK-NAT rightsubnet=vhost:%priv also=L2TP-PSK-noNAT conn L2TP-PSK-noNAT authby=secret pfs=no auto=add keyingtries=3 rekey=no ikelifetime=8h keylife=1h type=transport left=$tmpip leftid=$tmpip leftprotoport=17/1701 right=%any rightid=%any rightprotoport=17/%any EOF cat >>/etc/ipsec.secrets<<EOF $tmpip %any: PSK "$mypsk" EOF sed -i 's/net.ipv4.ip_forward = 0/net.ipv4.ip_forward = 1/g' /etc/sysctl.conf sed -i 's/net.ipv4.conf.default.rp_filter = 1/net.ipv4.conf.default.rp_filter = 0/g' /etc/sysctl.conf sysctl -p iptables --table nat --append POSTROUTING --jump MASQUERADE for each in /proc/sys/net/ipv4/conf/* do echo 0 > $each/accept_redirects echo 0 > $each/send_redirects done # Install rp-l2tp-0.4 cd $cur_dir/l2tp/untar/rp-l2tp-0.4 ./configure make cp handlers/l2tp-control /usr/local/sbin/ mkdir -p /var/run/xl2tpd/ ln -s /usr/local/sbin/l2tp-control /var/run/xl2tpd/l2tp-control # Install xl2tpd-1.2.4.tar.gz cd $cur_dir/l2tp/untar/xl2tpd-1.2.4 make install mkdir -p /etc/xl2tpd rm -rf /etc/xl2tpd/xl2tpd.conf touch /etc/xl2tpd/xl2tpd.conf cat >>/etc/xl2tpd/xl2tpd.conf<<EOF [global] ipsec saref = yes [lns default] ip range = $iprange.2-$iprange.254 local ip = $iprange.1 refuse chap = yes refuse pap = yes require authentication = yes ppp debug = yes pppoptfile = /etc/ppp/options.xl2tpd length bit = yes EOF rm -rf /etc/ppp/options.xl2tpd touch /etc/ppp/options.xl2tpd cat >>/etc/ppp/options.xl2tpd<<EOF require-mschap-v2 ms-dns 8.8.8.8 ms-dns 8.8.4.4 asyncmap 0 auth crtscts lock hide-password modem debug name l2tpd proxyarp lcp-echo-interval 30 lcp-echo-failure 4 EOF # Set default user & password pass=`openssl rand 6 -base64` if [ "$1" != "" ]; then pass=$1 fi echo "vpn l2tpd ${pass} *" >> /etc/ppp/chap-secrets touch /usr/bin/l2tpset echo "#/bin/bash" >>/usr/bin/l2tpset echo "for each in /proc/sys/net/ipv4/conf/*" >>/usr/bin/l2tpset echo "do" >>/usr/bin/l2tpset echo "echo 0 > \$each/accept_redirects" >>/usr/bin/l2tpset echo "echo 0 > \$each/send_redirects" >>/usr/bin/l2tpset echo "done" >>/usr/bin/l2tpset chmod +x /usr/bin/l2tpset iptables --table nat --append POSTROUTING --jump MASQUERADE l2tpset xl2tpd cat >>/etc/rc.local<<EOF iptables --table nat --append POSTROUTING --jump MASQUERADE /etc/init.d/ipsec restart /usr/bin/l2tpset /usr/local/sbin/xl2tpd EOF clear ipsec verify printf " ############################################################# # Auto install L2TP for CentOS 6 # # System Required: CentOS 6(32bit/64bit) # # Intro: http://teddysun.com/135.html # # Author: Teddysun <[email protected]> # ############################################################# if there are no [FAILED] above, then you can connect to your L2TP VPN Server with the default user/password below: ServerIP:$tmpip username:vpn password:${pass} PSK:$mypsk " exit 0
使用L2TP需要设置密钥，出现789错误导入注册表。
Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\RasMan\Parameters] "ProhibitIPSec"=dword:00000001
