书接上文
4.配置iptables
1）apt-get install iptables-persistent -y
2）
iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT
iptables -F
iptables -t nat -F
iptables -t mangle -F
iptables -A INPUT -p udp --dport 500 -j ACCEPT
iptables -A INPUT -p udp --dport 4500 -j ACCEPT
iptables -A FORWARD --match policy --pol ipsec --dir in --proto esp -s 10.10.10.0/24 -j ACCEPT
iptables -A FORWARD --match policy --pol ipsec --dir out --proto esp -d 10.10.10.0/24 -j ACCEPT
iptables -P FORWARD ACCEPT
iptables -t mangle -A FORWARD --match policy --pol ipsec --dir in -s 10.10.10.0/24 -o eth0 -p tcp -m tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1361:1536 -j TCPMSS --set-mss 1360
iptables -t nat -A POSTROUTING -s 10.10.10.0/24 -o eth0 -m policy --pol ipsec --dir out -j ACCEPT # exempt IPsec traffic from masquerading
iptables -t nat -A POSTROUTING -s 10.10.10.0/24 -o eth0 -j MASQUERADE
3）iptables-save > /etc/iptables/rules.v4
5、配置认证，先使用本地文件进行认证测试
1）
echo '
net.ipv4.ip_forward = 1
net.ipv4.ip_no_pmtu_disc = 1
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv6.conf.all.disable_ipv6 = 1
' >> /etc/sysctl.conf
2）
sysctl -p
3）
echo "YOUR.DOMAIN.COM : RSA "privkey.pem"
VPNUSERNAME : EAP ""VPNPASSWORD""
" > /etc/ipsec.secrets
这里的VPNUSERNAME替换为@YOUR.DOMAIN.COM
4）
echo "config setup
strictcrlpolicy=yes
uniqueids=never
conn roadwarrior
auto=add
compress=no
type=tunnel
keyexchange=ikev2
fragmentation=yes
forceencaps=yes
ike=aes256-sha1-modp1024,aes256gcm16-sha256-ecp521,aes256-sha256-ecp384
esp=aes256-sha1,aes128-sha256-modp3072,aes256gcm16-sha256,aes256gcm16-ecp384
dpdaction=clear
dpddelay=180s
rekey=no
left=%any
leftid=@YOUR.DOMAIN.COM
leftcert=cert.pem
leftsendcert=always
leftsubnet=0.0.0.0/0
right=%any
rightid=%any
rightauth=eap-mschapv2 # users are stored in /etc/ipsec.secrets
eap_identity=%any
rightdns=8.8.8.8,8.8.4.4
rightsourceip=10.10.10.0/24
rightsendcert=never
" > /etc/ipsec.conf
5）
vim /etc/strongswan.conf
charon {
load_modular = yes
plugins {
include strongswan.d/charon/.conf
}
include strongswan.d/.conf
}
6）
ipsec restart
最后使用EAP PASSWORD测试下vpn的连接是否正常。如果正常我们再继续配置认证。
