1，安装EPEL源
yum install -y epel-release
2，安装xl2tpd和libreswan(openswan已经停止维护)
yum install -y xl2tpd libreswan lsof
这里有可能会报错：
[Cannot retrieve metalink for repository: epel. Please verify its path and try again]
解决方法：
vi /etc/yum.repos.d/epel.repo
将
[epel]
name=Extra Packages for Enterprise Linux 6 - $basearch
#baseurl=http://download.fedoraproject.org/pub/epel/6/$basearch
mirrorlist=https://mirrors.fedoraproject.org/metalink?repo=epel-6&arch=$basearch
修改为
[epel]
name=Extra Packages for Enterprise Linux 6 - $basearch
baseurl=http://download.fedoraproject.org/pub/epel/6/$basearch
#mirrorlist=https://mirrors.fedoraproject.org/metalink?repo=epel-6&arch=$basearch
即，第3行打开，第4行注释
yum clean all
然后重新运行第二步
3，编辑xl2tpd配置文件
vi /etc/xl2tpd/xl2tpd.conf
[global]
ipsec saref = yes
[lns default]
ip range = 10.0.99.2-10.0.99.254
local ip = 10.0.99.1
refuse chap = yes
refuse pap = yes
require authentication = yes
ppp debug = yes
pppoptfile = /etc/ppp/options.xl2tpd
length bit = yes
4，编辑pppoptfile文件
vi /etc/ppp/options.xl2tpd
require-mschap-v2
ms-dns 114.114.114.114
ms-dns 8.8.8.8
asyncmap 0
auth
crtscts
lock
hide-password
modem
debug
name l2tpd
proxyarp
lcp-echo-interval 30
lcp-echo-failure 4
5，编辑ipsec配置文件
vi /etc/ipsec.conf
注意缩进
config setup
nat_traversal=yes
virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12
oe=off
protostack=netkey
conn L2TP-PSK-NAT
rightsubnet=vhost:%priv
also=L2TP-PSK-noNAT
conn L2TP-PSK-noNAT
authby=secret
pfs=no
auto=add
keyingtries=3
rekey=no
ikelifetime=8h
keylife=1h
type=transport
left=%any
leftprotoport=17/1701
right=%any
rightprotoport=17/%any
6，设置用户名密码
vi /etc/ppp/chap-secrets
# Secrets for authentication using CHAP
# client server secret IP addresses
user * 123456 *
如果需要分配固定ip，可以这样设置
user * 123456 10.0.99.2
7，设置预共享密钥PSK
vi /etc/ipsec.secrets
include /etc/ipsec.d/*.secrets
0.0.0.0 %any: PSK "myKey"
8，centos6防火墙设置
开放端口
iptables -A INPUT -p udp -m udp --dport 500 -j ACCEPT
iptables -A INPUT -p udp -m udp --dport 1701 -j ACCEPT
iptables -A INPUT -p udp -m udp --dport 4500 -j ACCEPT
NAT转发：这里适合针对性的ip转发，如果没多ip需求，可以用MASQUERADE
snat和MASQUERADE的区别和具体写法可以参考 这篇文章
iptables -t nat -I POSTROUTING -s 10.0.99.0/24 -j SNAT --to-source 公网IP
9，修改内核参数
vi /etc/sysctl.conf
net.ipv4.ip_forward = 1
net.ipv4.conf.all.rp_filter=0
net.ipv4.conf.all.accept_source_route=0
net.ipv4.conf.all.accept_redirects=0
net.ipv4.conf.all.send_redirects=0
net.ipv4.conf.default.rp_filter=0
net.ipv4.conf.default.accept_source_route=0
net.ipv4.conf.default.accept_redirects=0
net.ipv4.conf.default.send_redirects=0
net.ipv4.conf.eth0.accept_source_route=0
net.ipv4.conf.eth0.accept_redirects=0
net.ipv4.conf.eth0.send_redirects=0
net.ipv4.conf.eth0.rp_filter=0
net.ipv4.conf.lo.accept_source_route=0
net.ipv4.conf.lo.accept_redirects=0
net.ipv4.conf.lo.send_redirects=0
net.ipv4.conf.lo.rp_filter=0
加载内核参数使生效
sysctl -p
10，启动ipsec
service ipsec start
设置开机启动
chkconfig ipsec on
11，检查配置
ipsec verify
# 可能会出现类似如下情况：
Checking rp_filter [ENABLED]
/proc/sys/net/ipv4/conf/ens160/rp_filter [ENABLED]
/proc/sys/net/ipv4/conf/ens192/rp_filter [ENABLED]
# 这是内核参数没有生效，直接依次手动打开这些文件，将 1 改为 0
# 然后重新执行检查，输出如下内容则OK：
----------------------------------------------------------------------------------
Verifying installed system and configuration files
Version check and ipsec on-path [OK]
Libreswan 3.23 (netkey) on 3.10.0-327.el7.x86_64
Checking for IPsec support in kernel [OK]
NETKEY: Testing XFRM related proc values
ICMP default/send_redirects [OK]
ICMP default/accept_redirects [OK]
XFRM larval drop [OK]
Pluto ipsec.conf syntax [OK]
Two or more interfaces found, checking IP forwarding[OK]
Checking rp_filter [OK]
Checking that pluto is running [OK]
Pluto listening for IKE on udp 500 [OK]
Pluto listening for IKE/NAT-T on udp 4500 [OK]
Pluto ipsec.secret syntax [OK]
Checking 'ip' command [OK]
Checking 'iptables' command [OK]
Checking 'prelink' command does not interfere with FIPS[OK]
Checking for obsolete ipsec.conf options [OK]
12，启动xl2tp
service xl2tpd start
设置开机启动
chkconfig xl2tpd on
13，客户端配置（略）
14，错误处理
重启ipsec时报错：
Failed to initialize nss database sql:/etc/ipsec.d
解决方法：
certutil -N -d /etc/ipsec.d
ipsec newhostkey –configdir /etc/ipsec.d/ –output /etc/ipsec.d/keys.secrets –bits 2192
15，其他（未测试）
如果配置完成拨入后,访问外网速度很慢,可以运行如下指令，改变TCP最大分段值
iptables -I FORWARD -p tcp --syn -i ppp+ -j TCPMSS --set-mss 1356
