Skip to content

Instantly share code, notes, and snippets.

@xulq

xulq/linux上用strongswan搭建ikev2协议vpn.md

Forked from losisli/linux上用strongswan搭建ikev2协议vpn.md
Last active August 29, 2015 14:07
Show Gist options
  • Save xulq/d52b95091fb519f85d1c to your computer and use it in GitHub Desktop.
Save xulq/d52b95091fb519f85d1c to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. @losisli losisli revised this gist Oct 11, 2014. 1 changed file with 2 additions and 2 deletions.
    4 changes: 2 additions & 2 deletions linux上用strongswan搭建ikev2协议vpn.md
    View file
    Original file line number Diff line number Diff line change
    @@ -1,4 +1,4 @@
    **平台**：DigitalOcean VPS原生ubuntu14.04 x86, strongswan5.1.3
    **平台**：DigitalOcean VPS原生ubuntu14.04 x86, strongswan5.2.0

    ## 一：安装strongswan

    @@ -87,7 +87,7 @@
    echo 1 > /proc/sys/net/ipv4/ip_forward
    iptables -t nat -A POSTROUTING -s 10.11.1.0/24 -o eth0 -j MASQUERADE #地址与上面地址池对应
    iptables -A FORWARD -s 10.11.1.0/24 -j ACCEPT #同上
    #为避免VPS重启后NAT功能失效，可以把如上8行命令添加到 /etc/rc.local 文件中，添加在exit那一行之前即可。
    #为避免VPS重启后NAT功能失效，可以把如上5行命令添加到 /etc/rc.local 文件中，添加在exit那一行之前即可。

    ## 最后，启动strongswan:

  2. @losisli losisli revised this gist Aug 26, 2014. 1 changed file with 4 additions and 4 deletions.
    8 changes: 4 additions & 4 deletions linux上用strongswan搭建ikev2协议vpn.md
    View file
    Original file line number Diff line number Diff line change
    @@ -5,11 +5,11 @@
    apt-get install build-essential #编译环境
    aptitude install libgmp10 libgmp3-dev libssl-dev pkg-config libpcsclite-dev libpam0g-dev #编译所需要的软件

    **strongswan官网** http://www.strongswan.org/ ， **5.1.3版本地址** http://download.strongswan.org/strongswan-5.1.3.tar.bz2
    **strongswan官网** http://www.strongswan.org/ ， **5.2.0版本地址** http://download.strongswan.org/strongswan-5.2.0.tar.bz2

    wget http://download.strongswan.org/strongswan-5.1.3.tar.bz2
    tar -jxvf strongswan-5.1.3.tar.bz2
    cd strongswan-5.1.3
    wget http://download.strongswan.org/strongswan-5.2.0.tar.bz2
    tar -jxvf strongswan-5.2.0.tar.bz2
    cd strongswan-5.2.0
    ./configure --prefix=/usr --sysconfdir=/etc --enable-openssl --enable-nat-transport --disable-mysql --disable-ldap --disable-static --enable-shared --enable-md4 --enable-eap-mschapv2 --enable-eap-aka --enable-eap-aka-3gpp2 --enable-eap-gtc --enable-eap-identity --enable-eap-md5 --enable-eap-peap --enable-eap-radius --enable-eap-sim --enable-eap-sim-file --enable-eap-simaka-pseudonym --enable-eap-simaka-reauth --enable-eap-simaka-sql --enable-eap-tls --enable-eap-tnc --enable-eap-ttls
    make && make install

  3. losisli revised this gist May 27, 2014. 1 changed file with 2 additions and 1 deletion.
    3 changes: 2 additions & 1 deletion linux上用strongswan搭建ikev2协议vpn.md
    View file
    Original file line number Diff line number Diff line change
    @@ -5,7 +5,7 @@
    apt-get install build-essential #编译环境
    aptitude install libgmp10 libgmp3-dev libssl-dev pkg-config libpcsclite-dev libpam0g-dev #编译所需要的软件

    **strongswan官网** http://www.strongswan.org/， **5.1.3版本地址** http://download.strongswan.org/strongswan-5.1.3.tar.bz2
    **strongswan官网** http://www.strongswan.org/ ， **5.1.3版本地址** http://download.strongswan.org/strongswan-5.1.3.tar.bz2

    wget http://download.strongswan.org/strongswan-5.1.3.tar.bz2
    tar -jxvf strongswan-5.1.3.tar.bz2
    @@ -34,6 +34,7 @@
    cp caCert.pem /etc/ipsec.d/cacerts/
    cp serverCert.pem /etc/ipsec.d/certs/
    cp serverKey.pem /etc/ipsec.d/private/
    客户端安装caCert.pem与clientCert.pem（clientCert.p12）

    ## 三：配置strongswan
    1: /etc/ipsec.conf
  4. losisli revised this gist Apr 23, 2014. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion linux上用strongswan搭建ikev2协议vpn.md
    View file
    Original file line number Diff line number Diff line change
    @@ -9,7 +9,7 @@

    wget http://download.strongswan.org/strongswan-5.1.3.tar.bz2
    tar -jxvf strongswan-5.1.3.tar.bz2
    cd strongswan-5.1.3.tar.bz2
    cd strongswan-5.1.3
    ./configure --prefix=/usr --sysconfdir=/etc --enable-openssl --enable-nat-transport --disable-mysql --disable-ldap --disable-static --enable-shared --enable-md4 --enable-eap-mschapv2 --enable-eap-aka --enable-eap-aka-3gpp2 --enable-eap-gtc --enable-eap-identity --enable-eap-md5 --enable-eap-peap --enable-eap-radius --enable-eap-sim --enable-eap-sim-file --enable-eap-simaka-pseudonym --enable-eap-simaka-reauth --enable-eap-simaka-sql --enable-eap-tls --enable-eap-tnc --enable-eap-ttls
    make && make install

  5. losisli revised this gist Apr 19, 2014. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion linux上用strongswan搭建ikev2协议vpn.md
    View file
    Original file line number Diff line number Diff line change
    @@ -1,4 +1,4 @@
    **平台**：原生ubuntu14.04 x86 strongswan5.1.3
    **平台**：DigitalOcean VPS原生ubuntu14.04 x86, strongswan5.1.3

    ## 一：安装strongswan

  6. losisli revised this gist Apr 19, 2014. 1 changed file with 3 additions and 3 deletions.
    6 changes: 3 additions & 3 deletions linux上用strongswan搭建ikev2协议vpn.md
    View file
    Original file line number Diff line number Diff line change
    @@ -84,9 +84,9 @@
    iptables -A INPUT -p udp --dport 500 -j ACCEPT
    iptables -A INPUT -p udp --dport 4500 -j ACCEPT
    echo 1 > /proc/sys/net/ipv4/ip_forward
    iptables -t nat -A POSTROUTING -s 10.11.1.0/24 -o eth0 -j MASQUERADE //地址与上面地址池对应
    iptables -A FORWARD -s 10.11.1.0/24 -j ACCEPT //同上
    //为避免VPS重启后NAT功能失效，可以把如上8行命令添加到 /etc/rc.local 文件中，添加在exit那一行之前即可。
    iptables -t nat -A POSTROUTING -s 10.11.1.0/24 -o eth0 -j MASQUERADE #地址与上面地址池对应
    iptables -A FORWARD -s 10.11.1.0/24 -j ACCEPT #同上
    #为避免VPS重启后NAT功能失效，可以把如上8行命令添加到 /etc/rc.local 文件中，添加在exit那一行之前即可。

    ## 最后，启动strongswan:

  7. losisli revised this gist Apr 19, 2014. 1 changed file with 3 additions and 6 deletions.
    9 changes: 3 additions & 6 deletions linux上用strongswan搭建ikev2协议vpn.md
    View file
    Original file line number Diff line number Diff line change
    @@ -2,13 +2,10 @@

    ## 一：安装strongswan

    apt-get install gcc make strongswan //strongswan版本可能较低
    到https://gmplib.org/ 下载编译最新的The GNU Multiple Precision Arithmetic Library（编译strongswan过程依赖）
    如编译出现错误“OpenSSL crypto library not found”，用一下命令解决（ubuntu14.04本身已安装openssl）
    apt-get install openssl-dev
    apt-get install build-essential #编译环境
    aptitude install libgmp10 libgmp3-dev libssl-dev pkg-config libpcsclite-dev libpam0g-dev #编译所需要的软件

    ubuntu仓库中的strongswan经实验多次没有成功，遂重新自己下载编译
    **官网** http://www.strongswan.org/， **5.1.3版本地址** http://download.strongswan.org/strongswan-5.1.3.tar.bz2
    **strongswan官网** http://www.strongswan.org/， **5.1.3版本地址** http://download.strongswan.org/strongswan-5.1.3.tar.bz2

    wget http://download.strongswan.org/strongswan-5.1.3.tar.bz2
    tar -jxvf strongswan-5.1.3.tar.bz2
  8. losisli revised this gist Apr 19, 2014. 1 changed file with 3 additions and 2 deletions.
    5 changes: 3 additions & 2 deletions linux上用strongswan搭建ikev2协议vpn.md
    View file
    Original file line number Diff line number Diff line change
    @@ -1,9 +1,10 @@
    **平台**：原生ubuntu14.04 x86 strongswan5.1.3

    ## 一：安装strongswan

    apt-get install gcc make strongswan //strongswan版本可能较低
    //到**https://gmplib.org/** 下载编译最新的The GNU Multiple Precision Arithmetic Library（编译strongswan过程依赖）
    //如编译出现错误“OpenSSL crypto library not found”，用一下命令解决（ubuntu14.04本身已安装openssl）
    到https://gmplib.org/ 下载编译最新的The GNU Multiple Precision Arithmetic Library（编译strongswan过程依赖）
    如编译出现错误“OpenSSL crypto library not found”，用一下命令解决（ubuntu14.04本身已安装openssl）
    apt-get install openssl-dev

    ubuntu仓库中的strongswan经实验多次没有成功，遂重新自己下载编译
  9. losisli revised this gist Apr 19, 2014. 1 changed file with 5 additions and 6 deletions.
    11 changes: 5 additions & 6 deletions linux上用strongswan搭建ikev2协议vpn.md
    View file
    Original file line number Diff line number Diff line change
    @@ -44,7 +44,6 @@ ubuntu仓库中的strongswan经实验多次没有成功，遂重新自己下载
    strictcrlpolicy=no
    uniqueids=no #允许多设备同时在线


    conn windowsphone
    keyexchange=ikev2
    ike=aes256-sha1-modp1024!
    @@ -74,7 +73,7 @@ ubuntu仓库中的strongswan经实验多次没有成功，遂重新自己下载

    3: /etc/strongswan.conf

    //加入分配的dns
    #加入分配的dns
    charon {

    dns1 = 8.8.8.8
    @@ -91,14 +90,14 @@ ubuntu仓库中的strongswan经实验多次没有成功，遂重新自己下载
    iptables -A FORWARD -s 10.11.1.0/24 -j ACCEPT //同上
    //为避免VPS重启后NAT功能失效，可以把如上8行命令添加到 /etc/rc.local 文件中，添加在exit那一行之前即可。

    最后，启动strongswan:
    ## 最后，启动strongswan:

    ipsec start
    滚动日志:

    ipsec start --nofork

    ## 参考链接：
    http://zh.opensuse.org/index.php?title=SDB:Setup_Ipsec_VPN_with_Strongswan&variant=zh
    http://si-you.com/?p=1167
    http://blog.ltns.info/linux/pure_ipsec_multi-platform_vpn_client_debian_vps/
    * http://zh.opensuse.org/index.php?title=SDB:Setup_Ipsec_VPN_with_Strongswan&variant=zh
    * http://si-you.com/?p=1167
    * http://blog.ltns.info/linux/pure_ipsec_multi-platform_vpn_client_debian_vps/
  10. losisli revised this gist Apr 19, 2014. 1 changed file with 17 additions and 6 deletions.
    23 changes: 17 additions & 6 deletions linux上用strongswan搭建ikev2协议vpn.md
    View file
    Original file line number Diff line number Diff line change
    @@ -7,7 +7,8 @@
    apt-get install openssl-dev

    ubuntu仓库中的strongswan经实验多次没有成功，遂重新自己下载编译
    **官网**http://www.strongswan.org/， 5.1.3版本地址 http://download.strongswan.org/strongswan-5.1.3.tar.bz2
    **官网** http://www.strongswan.org/， **5.1.3版本地址** http://download.strongswan.org/strongswan-5.1.3.tar.bz2

    wget http://download.strongswan.org/strongswan-5.1.3.tar.bz2
    tar -jxvf strongswan-5.1.3.tar.bz2
    cd strongswan-5.1.3.tar.bz2
    @@ -16,27 +17,34 @@ ubuntu仓库中的strongswan经实验多次没有成功，遂重新自己下载

    ## 二：生成、安装证书
    1：win7和Android、wp8.1等平台的VPN客户端走ikev2协议，需要制作相应的证书，先生成ca证书

    ipsec pki --gen --outform pem > caKey.pem
    ipsec pki --self --in caKey.pem --dn "C=CN, O=strongSwan, CN=strongSwan CA" --ca --outform pem > caCert.pem
    2：然后是服务器端的证书

    ipsec pki --gen --outform pem > serverKey.pem
    ipsec pki --pub --in serverKey.pem | ipsec pki --issue --cacert caCert.pem --cakey caKey.pem --dn "C=CN, O=strongSwan, CN=VPS的公网ip或域名" --san="VPS的公网ip或域名" --flag serverAuth --flag ikeIntermediate --outform pem > serverCert.pem
    3：客户端的证书

    ipsec pki --gen --outform pem > clientKey.pem
    ipsec pki --pub --in clientKey.pem | ipsec pki --issue --cacert caCert.pem --cakey caKey.pem --dn "C=CN, O=strongSwan, CN=client" --outform pem > clientCert.pem
    生成的客户端证书 clientCert.pem 不能直接导入到win7或Anroid设备中，需先转换为.p12格式。执行后会提示要设置证书使用密码，可以设置一下密码也可以直接回车（密码为空）。

    openssl pkcs12 -export -inkey clientKey.pem -in clientCert.pem -name "client" -certfile caCert.pem -caname "strongSwan CA" -out clientCert.p12
    4：安装证书

    cp caCert.pem /etc/ipsec.d/cacerts/
    cp serverCert.pem /etc/ipsec.d/certs/
    cp serverKey.pem /etc/ipsec.d/private/

    ## 三：配置strongswan
    1: /etc/ipsec.conf

    config setup
    strictcrlpolicy=no
    uniqueids=no #允许多设备同时在线


    conn windowsphone
    keyexchange=ikev2
    ike=aes256-sha1-modp1024!
    @@ -57,14 +65,16 @@ ubuntu仓库中的strongswan经实验多次没有成功，遂重新自己下载
    auto=add

    2: /etc/ipsec.secrets

    : RSA serverKey.pem
    用户名1 : EAP "密码1"
    wp设备名称\用户名2 : EAP "密码2" #仅对windowsphone8.1设备
    #windowsphone8.1，在客户端输入的用户名发送到服务器显示为“设备名称\用户名”的形式，故认证需加上设备名称,设备名限制15字符
    #貌似只能全英文不能有标点、符号（这一点有待确认）
    #windowsphone8.1，在客户端输入的用户名发送到服务器显示为“设备名称\用户名”的形式，故认证需加上设备名称,设备名限制15字符
    #貌似只能全英文不能有标点、符号（这一点有待确认）

    3: /etc/strongswan.conf
    //加入分配的dns

    //加入分配的dns
    charon {

    dns1 = 8.8.8.8
    @@ -73,18 +83,19 @@ ubuntu仓库中的strongswan经实验多次没有成功，遂重新自己下载
    }

    ## 四：配置 Iptables 转发

    iptables -A INPUT -p udp --dport 500 -j ACCEPT
    iptables -A INPUT -p udp --dport 4500 -j ACCEPT

    echo 1 > /proc/sys/net/ipv4/ip_forward

    iptables -t nat -A POSTROUTING -s 10.11.1.0/24 -o eth0 -j MASQUERADE //地址与上面地址池对应
    iptables -A FORWARD -s 10.11.1.0/24 -j ACCEPT //同上
    //为避免VPS重启后NAT功能失效，可以把如上8行命令添加到 /etc/rc.local 文件中，添加在exit那一行之前即可。

    最后，启动strongswan:

    ipsec start
    滚动日志:

    ipsec start --nofork

    ## 参考链接：
  11. losisli revised this gist Apr 19, 2014. 1 changed file with 67 additions and 66 deletions.
    133 changes: 67 additions & 66 deletions linux上用strongswan搭建ikev2协议vpn.md
    View file
    Original file line number Diff line number Diff line change
    @@ -1,92 +1,93 @@
    平台：原生ubuntu14.04 x86 strongswan5.1.3
    **平台**：原生ubuntu14.04 x86 strongswan5.1.3

    一：安装strongswan
    apt-get install gcc make strongswan （strongswan版本可能较低）
    到https://gmplib.org/ 下载编译最新的The GNU Multiple Precision Arithmetic Library（编译strongswan过程依赖）
    如编译出现错误“OpenSSL crypto library not found”，用 apt-get install openssl-dev 命令解决（ubuntu14.04本身已安装openssl）
    ## 一：安装strongswan
    apt-get install gcc make strongswan //strongswan版本可能较低
    //到**https://gmplib.org/** 下载编译最新的The GNU Multiple Precision Arithmetic Library（编译strongswan过程依赖）
    //如编译出现错误“OpenSSL crypto library not found”，用一下命令解决（ubuntu14.04本身已安装openssl）
    apt-get install openssl-dev

    ubuntu仓库中的strongswan经实验多次没有成功，遂重新自己下载编译
    官网http://www.strongswan.org/， 5.1.3地址 http://download.strongswan.org/strongswan-5.1.3.tar.bz2
    wget http://download.strongswan.org/strongswan-5.1.3.tar.bz2
    tar -jxvf strongswan-5.1.3.tar.bz2
    cd strongswan-5.1.3.tar.bz2
    ./configure --prefix=/usr --sysconfdir=/etc --enable-openssl --enable-nat-transport --disable-mysql --disable-ldap --disable-static --enable-shared --enable-md4 --enable-eap-mschapv2 --enable-eap-aka --enable-eap-aka-3gpp2 --enable-eap-gtc --enable-eap-identity --enable-eap-md5 --enable-eap-peap --enable-eap-radius --enable-eap-sim --enable-eap-sim-file --enable-eap-simaka-pseudonym --enable-eap-simaka-reauth --enable-eap-simaka-sql --enable-eap-tls --enable-eap-tnc --enable-eap-ttls
    make && make install
    **官网**http://www.strongswan.org/， 5.1.3版本地址 http://download.strongswan.org/strongswan-5.1.3.tar.bz2
    wget http://download.strongswan.org/strongswan-5.1.3.tar.bz2
    tar -jxvf strongswan-5.1.3.tar.bz2
    cd strongswan-5.1.3.tar.bz2
    ./configure --prefix=/usr --sysconfdir=/etc --enable-openssl --enable-nat-transport --disable-mysql --disable-ldap --disable-static --enable-shared --enable-md4 --enable-eap-mschapv2 --enable-eap-aka --enable-eap-aka-3gpp2 --enable-eap-gtc --enable-eap-identity --enable-eap-md5 --enable-eap-peap --enable-eap-radius --enable-eap-sim --enable-eap-sim-file --enable-eap-simaka-pseudonym --enable-eap-simaka-reauth --enable-eap-simaka-sql --enable-eap-tls --enable-eap-tnc --enable-eap-ttls
    make && make install

    二：生成、安装证书
    ## 二：生成、安装证书
    1：win7和Android、wp8.1等平台的VPN客户端走ikev2协议，需要制作相应的证书，先生成ca证书
    ipsec pki --gen --outform pem > caKey.pem
    ipsec pki --self --in caKey.pem --dn "C=CN, O=strongSwan, CN=strongSwan CA" --ca --outform pem > caCert.pem
    ipsec pki --gen --outform pem > caKey.pem
    ipsec pki --self --in caKey.pem --dn "C=CN, O=strongSwan, CN=strongSwan CA" --ca --outform pem > caCert.pem
    2：然后是服务器端的证书
    ipsec pki --gen --outform pem > serverKey.pem
    ipsec pki --pub --in serverKey.pem | ipsec pki --issue --cacert caCert.pem --cakey caKey.pem --dn "C=CN, O=strongSwan, CN=VPS的公网ip或域名" --san="VPS的公网ip或域名" --flag serverAuth --flag ikeIntermediate --outform pem > serverCert.pem
    ipsec pki --gen --outform pem > serverKey.pem
    ipsec pki --pub --in serverKey.pem | ipsec pki --issue --cacert caCert.pem --cakey caKey.pem --dn "C=CN, O=strongSwan, CN=VPS的公网ip或域名" --san="VPS的公网ip或域名" --flag serverAuth --flag ikeIntermediate --outform pem > serverCert.pem
    3：客户端的证书
    ipsec pki --gen --outform pem > clientKey.pem
    ipsec pki --pub --in clientKey.pem | ipsec pki --issue --cacert caCert.pem --cakey caKey.pem --dn "C=CN, O=strongSwan, CN=client" --outform pem > clientCert.pem
    ipsec pki --gen --outform pem > clientKey.pem
    ipsec pki --pub --in clientKey.pem | ipsec pki --issue --cacert caCert.pem --cakey caKey.pem --dn "C=CN, O=strongSwan, CN=client" --outform pem > clientCert.pem
    生成的客户端证书 clientCert.pem 不能直接导入到win7或Anroid设备中，需先转换为.p12格式。执行后会提示要设置证书使用密码，可以设置一下密码也可以直接回车（密码为空）。
    openssl pkcs12 -export -inkey clientKey.pem -in clientCert.pem -name "client" -certfile caCert.pem -caname "strongSwan CA" -out clientCert.p12
    4安装证书
    cp caCert.pem /etc/ipsec.d/cacerts/
    cp serverCert.pem /etc/ipsec.d/certs/
    cp serverKey.pem /etc/ipsec.d/private/
    openssl pkcs12 -export -inkey clientKey.pem -in clientCert.pem -name "client" -certfile caCert.pem -caname "strongSwan CA" -out clientCert.p12
    4：安装证书
    cp caCert.pem /etc/ipsec.d/cacerts/
    cp serverCert.pem /etc/ipsec.d/certs/
    cp serverKey.pem /etc/ipsec.d/private/

    三：配置strongswan
    1: #/etc/ipsec.conf
    config setup
    strictcrlpolicy=no
    uniqueids=no #允许多设备同时在线
    ## 三：配置strongswan
    1: /etc/ipsec.conf
    config setup
    strictcrlpolicy=no
    uniqueids=no #允许多设备同时在线

    conn windowsphone
    keyexchange=ikev2
    ike=aes256-sha1-modp1024!
    esp=aes256-sha1!
    dpdaction=clear
    dpddelay=300s
    rekey=no
    left=%defaultroute
    leftsubnet=0.0.0.0/0
    leftauth=pubkey
    leftcert=serverCert.pem
    leftid="C=CN, O=strongSwan, CN=X.X.X.X" #C=国家，CN=自己vps的公网ip
    right=%any
    rightsourceip=10.11.1.0/24 #为客户端分配的虚拟地址池
    rightauth=eap-mschapv2
    rightsendcert=never
    eap_identity=%any
    auto=add
    conn windowsphone
    keyexchange=ikev2
    ike=aes256-sha1-modp1024!
    esp=aes256-sha1!
    dpdaction=clear
    dpddelay=300s
    rekey=no
    left=%defaultroute
    leftsubnet=0.0.0.0/0
    leftauth=pubkey
    leftcert=serverCert.pem
    leftid="C=CN, O=strongSwan, CN=X.X.X.X" #C=国家，CN=自己vps的公网ip
    right=%any
    rightsourceip=10.11.1.0/24 #为客户端分配的虚拟地址池
    rightauth=eap-mschapv2
    rightsendcert=never
    eap_identity=%any
    auto=add

    2: #/etc/ipsec.secrets
    : RSA serverKey.pem
    用户名1 : EAP "密码1"
    wp设备名称\用户名2 : EAP "密码2" #仅对windowsphone8.1设备
    2: /etc/ipsec.secrets
    : RSA serverKey.pem
    用户名1 : EAP "密码1"
    wp设备名称\用户名2 : EAP "密码2" #仅对windowsphone8.1设备
    #windowsphone8.1，在客户端输入的用户名发送到服务器显示为“设备名称\用户名”的形式，故认证需加上设备名称,设备名限制15字符
    #貌似只能全英文不能有标点、符号（这一点有待确认）

    3: #/etc/strongswan.conf
    #加入分配的dns
    charon {
    3: /etc/strongswan.conf
    //加入分配的dns
    charon {

    dns1 = 8.8.8.8
    dns2 = 208.67.222.222
    dns1 = 8.8.8.8
    dns2 = 208.67.222.222

    }
    }

    四：配置 Iptables 转发
    iptables -A INPUT -p udp --dport 500 -j ACCEPT
    iptables -A INPUT -p udp --dport 4500 -j ACCEPT
    ## 四：配置 Iptables 转发
    iptables -A INPUT -p udp --dport 500 -j ACCEPT
    iptables -A INPUT -p udp --dport 4500 -j ACCEPT

    echo 1 > /proc/sys/net/ipv4/ip_forward
    echo 1 > /proc/sys/net/ipv4/ip_forward

    iptables -t nat -A POSTROUTING -s 10.11.1.0/24 -o eth0 -j MASQUERADE #地址与上面地址池对应
    iptables -A FORWARD -s 10.11.1.0/24 -j ACCEPT #同上
    #为避免VPS重启后NAT功能失效，可以把如上8行命令添加到 /etc/rc.local 文件中，添加在exit那一行之前即可。
    iptables -t nat -A POSTROUTING -s 10.11.1.0/24 -o eth0 -j MASQUERADE //地址与上面地址池对应
    iptables -A FORWARD -s 10.11.1.0/24 -j ACCEPT //同上
    //为避免VPS重启后NAT功能失效，可以把如上8行命令添加到 /etc/rc.local 文件中，添加在exit那一行之前即可。

    最后，启动strongswan:
    ipsec start
    ipsec start
    滚动日志:
    ipsec start --nofork
    ipsec start --nofork

    参考链接：
    ## 参考链接：
    http://zh.opensuse.org/index.php?title=SDB:Setup_Ipsec_VPN_with_Strongswan&variant=zh
    http://si-you.com/?p=1167
    http://blog.ltns.info/linux/pure_ipsec_multi-platform_vpn_client_debian_vps/
  12. losisli revised this gist Apr 19, 2014. No changes.
  13. losisli revised this gist Apr 19, 2014. 1 changed file with 2 additions and 0 deletions.
    2 changes: 2 additions & 0 deletions linux上用strongswan搭建ikev2协议vpn.md
    View file
    Original file line number Diff line number Diff line change
    @@ -1,4 +1,5 @@
    平台：原生ubuntu14.04 x86 strongswan5.1.3

    一：安装strongswan
    apt-get install gcc make strongswan （strongswan版本可能较低）
    到https://gmplib.org/ 下载编译最新的The GNU Multiple Precision Arithmetic Library（编译strongswan过程依赖）
    @@ -78,6 +79,7 @@ echo 1 > /proc/sys/net/ipv4/ip_forward

    iptables -t nat -A POSTROUTING -s 10.11.1.0/24 -o eth0 -j MASQUERADE #地址与上面地址池对应
    iptables -A FORWARD -s 10.11.1.0/24 -j ACCEPT #同上
    #为避免VPS重启后NAT功能失效，可以把如上8行命令添加到 /etc/rc.local 文件中，添加在exit那一行之前即可。

    最后，启动strongswan:
    ipsec start
  14. losisli revised this gist Apr 19, 2014. 1 changed file with 90 additions and 1 deletion.
    91 changes: 90 additions & 1 deletion linux上用strongswan搭建ikev2协议vpn.md
    View file
    Original file line number Diff line number Diff line change
    @@ -1 +1,90 @@
    平台：ubuntu14.04 x86
    平台：原生ubuntu14.04 x86 strongswan5.1.3
    一：安装strongswan
    apt-get install gcc make strongswan （strongswan版本可能较低）
    到https://gmplib.org/ 下载编译最新的The GNU Multiple Precision Arithmetic Library（编译strongswan过程依赖）
    如编译出现错误“OpenSSL crypto library not found”，用 apt-get install openssl-dev 命令解决（ubuntu14.04本身已安装openssl）

    ubuntu仓库中的strongswan经实验多次没有成功，遂重新自己下载编译
    官网http://www.strongswan.org/， 5.1.3地址 http://download.strongswan.org/strongswan-5.1.3.tar.bz2
    wget http://download.strongswan.org/strongswan-5.1.3.tar.bz2
    tar -jxvf strongswan-5.1.3.tar.bz2
    cd strongswan-5.1.3.tar.bz2
    ./configure --prefix=/usr --sysconfdir=/etc --enable-openssl --enable-nat-transport --disable-mysql --disable-ldap --disable-static --enable-shared --enable-md4 --enable-eap-mschapv2 --enable-eap-aka --enable-eap-aka-3gpp2 --enable-eap-gtc --enable-eap-identity --enable-eap-md5 --enable-eap-peap --enable-eap-radius --enable-eap-sim --enable-eap-sim-file --enable-eap-simaka-pseudonym --enable-eap-simaka-reauth --enable-eap-simaka-sql --enable-eap-tls --enable-eap-tnc --enable-eap-ttls
    make && make install

    二：生成、安装证书
    1：win7和Android、wp8.1等平台的VPN客户端走ikev2协议，需要制作相应的证书，先生成ca证书
    ipsec pki --gen --outform pem > caKey.pem
    ipsec pki --self --in caKey.pem --dn "C=CN, O=strongSwan, CN=strongSwan CA" --ca --outform pem > caCert.pem
    2：然后是服务器端的证书
    ipsec pki --gen --outform pem > serverKey.pem
    ipsec pki --pub --in serverKey.pem | ipsec pki --issue --cacert caCert.pem --cakey caKey.pem --dn "C=CN, O=strongSwan, CN=VPS的公网ip或域名" --san="VPS的公网ip或域名" --flag serverAuth --flag ikeIntermediate --outform pem > serverCert.pem
    3：客户端的证书
    ipsec pki --gen --outform pem > clientKey.pem
    ipsec pki --pub --in clientKey.pem | ipsec pki --issue --cacert caCert.pem --cakey caKey.pem --dn "C=CN, O=strongSwan, CN=client" --outform pem > clientCert.pem
    生成的客户端证书 clientCert.pem 不能直接导入到win7或Anroid设备中，需先转换为.p12格式。执行后会提示要设置证书使用密码，可以设置一下密码也可以直接回车（密码为空）。
    openssl pkcs12 -export -inkey clientKey.pem -in clientCert.pem -name "client" -certfile caCert.pem -caname "strongSwan CA" -out clientCert.p12
    4安装证书
    cp caCert.pem /etc/ipsec.d/cacerts/
    cp serverCert.pem /etc/ipsec.d/certs/
    cp serverKey.pem /etc/ipsec.d/private/

    三：配置strongswan
    1: #/etc/ipsec.conf
    config setup
    strictcrlpolicy=no
    uniqueids=no #允许多设备同时在线

    conn windowsphone
    keyexchange=ikev2
    ike=aes256-sha1-modp1024!
    esp=aes256-sha1!
    dpdaction=clear
    dpddelay=300s
    rekey=no
    left=%defaultroute
    leftsubnet=0.0.0.0/0
    leftauth=pubkey
    leftcert=serverCert.pem
    leftid="C=CN, O=strongSwan, CN=X.X.X.X" #C=国家，CN=自己vps的公网ip
    right=%any
    rightsourceip=10.11.1.0/24 #为客户端分配的虚拟地址池
    rightauth=eap-mschapv2
    rightsendcert=never
    eap_identity=%any
    auto=add

    2: #/etc/ipsec.secrets
    : RSA serverKey.pem
    用户名1 : EAP "密码1"
    wp设备名称\用户名2 : EAP "密码2" #仅对windowsphone8.1设备
    #windowsphone8.1，在客户端输入的用户名发送到服务器显示为“设备名称\用户名”的形式，故认证需加上设备名称,设备名限制15字符
    #貌似只能全英文不能有标点、符号（这一点有待确认）

    3: #/etc/strongswan.conf
    #加入分配的dns
    charon {

    dns1 = 8.8.8.8
    dns2 = 208.67.222.222

    }

    四：配置 Iptables 转发
    iptables -A INPUT -p udp --dport 500 -j ACCEPT
    iptables -A INPUT -p udp --dport 4500 -j ACCEPT

    echo 1 > /proc/sys/net/ipv4/ip_forward

    iptables -t nat -A POSTROUTING -s 10.11.1.0/24 -o eth0 -j MASQUERADE #地址与上面地址池对应
    iptables -A FORWARD -s 10.11.1.0/24 -j ACCEPT #同上

    最后，启动strongswan:
    ipsec start
    滚动日志:
    ipsec start --nofork

    参考链接：
    http://zh.opensuse.org/index.php?title=SDB:Setup_Ipsec_VPN_with_Strongswan&variant=zh
    http://si-you.com/?p=1167
    http://blog.ltns.info/linux/pure_ipsec_multi-platform_vpn_client_debian_vps/
  15. losisli created this gist Apr 19, 2014.
    1 change: 1 addition & 0 deletions linux上用strongswan搭建ikev2协议vpn.md
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1 @@
    平台：ubuntu14.04 x86