1
2
3
4
5

yum remove -y openswan
wget http://www.openswan.org/download/openswan-2.6.24.tar.gz
tar zxvf openswan-2.6.24.tar.gz
cd openswan-2.6.24
make programs install

1

yum install ppp iptables libpcap-devel

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27

rm -rf /etc/ipsec.conf
touch /etc/ipsec.conf
cat >>/etc/ipsec.conf< <EOF
config setup
    nat_traversal=yes
    virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12
    oe=off
    protostack=netkey

conn L2TP-PSK-NAT
    rightsubnet=vhost:%priv
    also=L2TP-PSK-noNAT

conn L2TP-PSK-noNAT
    authby=secret
    pfs=no
    auto=add
    keyingtries=3
    rekey=no
    ikelifetime=8h
    keylife=1h
    type=transport
    left=$ip  #替换成vps的ip
    leftprotoport=17/1701
    right=%any
    rightprotoport=17/%any
EOF

1

echo "$your_vps_ip %any: PSK \"$your_key\"" >/etc/ipsec.d/l2tp.secrets

1
2
3
4
5
6
7
8

sed -i 's/net.ipv4.ip_forward = 0/net.ipv4.ip_forward = 1/g' /etc/sysctl.conf
sysctl -p
for each in /proc/sys/net/ipv4/conf/*                                                                                                      
do                                                                                                                                         
echo 0 > $each/accept_redirects                                                                                                            
echo 0 > $each/send_redirects                                                                                                              
done 
iptables -t nat -A POSTROUTING -j MASQUERADE

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17

/etc/init.d/ipsec restart                                                                                                                  
ipsec verify 
Checking your system to see if IPsec got installed and started correctly:
Version check and ipsec on-path                                 [OK]
Linux Openswan U2.6.24/K2.6.32-71.29.1.el6.i686 (netkey)
Checking for IPsec support in kernel                            [OK]
NETKEY detected, testing for disabled ICMP send_redirects       [OK]
NETKEY detected, testing for disabled ICMP accept_redirects     [OK]
Checking for RSA private key (/etc/ipsec.secrets)               [OK]
Checking that pluto is running                                  [OK]
Pluto listening for IKE on udp 500                              [OK]
Pluto listening for NAT-T on udp 4500                           [OK]
Two or more interfaces found, checking IP forwarding            [OK]
Checking NAT and MASQUERADEing                                  [N/A]
Checking for 'ip' command                                       [OK]
Checking for 'iptables' command                                 [OK]
Opportunistic Encryption Support                                [DISABLED]

1
2
3
4
5
6

wget http://www.xelerance.com/wp-content/uploads/software/xl2tpd/xl2tpd-1.3.0.tar.gz
tar xvf xl2tpd-1.3.0.tar.gz
make install
mkdir /var/run/xl2tpd
ln -s /usr/local/sbin/l2tp-control /var/run/xl2tpd/l2tp-control
mkdir /etc/xl2tpd

1
2
3
4
5
6
7
8
9
10
11
12

[global]
listen-addr = $your_vps_ip #替换成你的vpsip
ipsec saref = yes
[lns default]
ip range = 192.168.30.10-192.168.30.20
local ip = 192.168.30.1
require chap = yes
refuse pap = yes
require authentication = yes
ppp debug = yes
pppoptfile = /etc/ppp/options.xl2tpd
length bit = yes

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17

require-mschap-v2
ipcp-accept-local
ipcp-accept-remote
ms-dns  8.8.8.8
ms-dns  8.8.4.4
asyncmap 0
noccp
auth
crtscts
hide-password
debug
modem
lock
proxyarp
name l2tpd
lcp-echo-interval 30
lcp-echo-failure 4

1
2
3

# Secrets for authentication using CHAP
# client        server  secret                  IP addresses
name         l2tpd   password                *

1
2

iptables -t nat -A POSTROUTING -s 192.168.30.0/24 -o eth0 -j MASQUERADE 
iptables -t nat -A POSTROUTING -s 192.168.30.0/24 -j SNAT --to-source $your_vps_ip

1

xl2tpd -D &

1
2
3
4
5

iptables-save > /etc/iptables
echo "iptables-restore /etc/iptables" >> /etc/rc.local
echo "/usr/local/sbin/xl2tpd -D &" >> /etc/rc.local
chkconfig --add ipsec
chkconfig --level 2345 ipsec on