PPTPL2TP协议详解以及应用部署 - 图文(11)

echo 0 > $each/send_redirects done 2.L2TP配置

# /etc/xl2tpd/xl2tpd.conf [global] ipsec saref = yes [lns default] ip range = 10.10.20.100-10.10.20.254 local ip = 10.10.20.1 require chap = yes refuse pap = yes require authentication = yes ppp debug = yes pppoptfile = /etc/ppp/options.xl2tpd length bit = yes 3.PPP配置

# /etc/ppp/options.xl2tpd refuse-mschap-v2 refuse-mschap ms-dns 8.8.8.8 ms-dns 8.8.4.4 asyncmap 0 auth lock hide-password local #debug name l2tpd proxyarp lcp-echo-interval 30 lcp-echo-failure 4 mtu 1404 mru 1404 5.启用转发

echo 1 > /proc/sys/net/ipv4/ip_forward iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE 对于OpenVZ的主机，可能不支持MASQUERADE，此时需要使用SNAT： iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to-source $IP 其中$IP就是你主机的eth0接口的IP地址。

四、检查ipsec是否工作正常

我们通过执行ipsec verify命令进行验证ipsec服务是否工作正常：

错误1：pluto is running [FAILED]

Checking your system to see if IPsec got installed and started correctly: Version check and ipsec on-path [OK] Linux Openswan U2.6.38/K(no kernel code presently loaded) Checking for IPsec support in kernel [FAILED] SAref kernel support [N/A] Checking that pluto is running [FAILED] whack: Pluto is not running (no \Checking for 'ip' command [OK] Checking /bin/sh is not /bin/dash [WARNING] Checking for 'iptables' command [OK] Opportunistic Encryption Support [DISABLED] 这是因为你还没有启动ipsec服务！ /etc/init.d/ipsec start 错误2：NETKEY: Testing XFRM related proc values [FAILED]

Checking your system to see if IPsec got installed and started correctly: Version check and ipsec on-path [OK] Linux Openswan U2.6.38/K2.6.32-38-generic-pae (netkey) Checking for IPsec support in kernel [OK] SAref kernel support [N/A] NETKEY: Testing XFRM related proc values [FAILED] Please disable /proc/sys/net/ipv4/conf/*/send_redirects or NETKEY will cause the sending of bogus ICMP redirects! [FAILED] Please disable /proc/sys/net/ipv4/conf/*/accept_redirects or NETKEY will accept bogus ICMP redirects! [OK] Checking that pluto is running [OK] Pluto listening for IKE on udp 500 [OK] Pluto listening for NAT-T on udp 4500 [OK] Checking for 'ip' command [OK] Checking /bin/sh is not /bin/dash [WARNING] Checking for 'iptables' command [OK] Opportunistic Encryption Support [DISABLED] 你可能忘记修改网络策略： for each in /proc/sys/net/ipv4/conf/* do echo 0 > $each/accept_redirects echo 0 > $each/send_redirects done 错误3：Pluto listening for IKE on udp 500 [FAILED]

Pluto listening for IKE on udp 500 [FAILED] Cannot execute command \Pluto listening for NAT-T on udp 4500 [FAILED] Cannot execute command \那么你需要安装lsof： apt-get install lsof 五、测试与调试 1.启用测试用户

编辑/etc/ppp/chap-secrets文件，加入如下行： # Secrets for authentication using CHAP # client server secret IP addresses guest l2tpd password * 该行创建一个用户，用户名为guest，密码为password（明文）

server字段与options.xl2tpd配置文件中的name属性对应。还可以星号（*）代替，表示不限调用服务。

IP address表示来源IP，这里星号（*）表示接受所有连接。

对来源IP的过滤应该由iptables防火墙来完成。读者可以查阅本博客关于iptables的相关文章进行设置。

2.连接

现在就可以尝试连接，如果连接失败，需要通过查看日志信息排错。

3.查看日志

ipsec日志记录在/var/log/auth中，如果发现该行： STATE_MAIN_R3: sent MR3, ISAKMP SA established 则表示IPSec认证或连接没有问题，可以检查其他日志。但是有时候即使出现established，也会在稍后的行中出现错误信息，这是需要用户留意的地方。 xl2tpd和pppd的日志记录在/var/log/syslog中。