叨嗒嗵 - l2l
type: channel
link: https://www.dotatong.com/index.php/tag/l2l/
items: Centos7 openswan Site-to-Site(L2L) VPN

Centos7 openswan Site-to-Site(L2L) VPN
type: item
date: 2017-02-23T09:53:00+00:00
description: 首先安装openswanyum install openswan修改内核参数启用转发和禁止重定向修改sysctl.conf文件vi /etc/sysctl.conf 添加以下内容net.ipv4.conf.default.send_redirects=0 net.ipv4.icmp_ignore_bogus_error_responses=1 net.ipv4.conf.default.log_martians=0 net.ipv4.conf.all.log_martians=0 net.ipv4.conf.default.accept_source_route=0 net.ipv4.conf.all.accept_redirects=0 net.ipv4.conf.default.accept_redirects=0 net.core.xfrm_larval_drop=1 net.ipv4.ip_forward = 1 net.ipv4.conf.all.accept_redirects = 0 net.ipv4.conf.all.send_redirects = 0保存退出，执行以下命令sysctl -p关闭selinuxvi /etc/selinux/config修改SELINUX项为disabledSELINUX=disabled修改配置文件配置文件ipsec.confvi /etc/ipsec.conf#隧道名称(随便起个名字) conn site_to_site type=tunnel authby=secret #statr:表示启动服务自动连接,add:表示还需使用命令 auto=start #本端外网IP left=本端外网IP #本端ID，须与对端的[对端ID]一致 leftid=本端外网IP leftsubnet=本端内网IP/32 #对端ID，须与对端的[本端ID]一致 rightid=对端外网IP right=对端外网IP rightsubnet=对端内网IP/32 keyexchange=ike #IKE加密算法(3des),IKE验证算法(sha1),IKE DH算法(Group2 modp1024) ike=3des-sha1;modp1024 phase2=esp #ESP加密算法(3des),ESP验证算法(md5) phase2alg=3des-md5 pfs=no compress=no #IKE DH算法对应表 Group 1 => modp768 Group 2 => modp1024 Group 5 => modp1536 Group 14 => modp2048 Group 15 => modp3072 Group 16 => modp4096 Group 17 => modp6144 Group 18 => modp8192 Group 19 => ecp256 Group 20 => ecp384 Group 21 => ecp521 Group 22 => modp1024s160 Group 23 => modp2048s224 Group 24 => modp2048s256 Group 25 => ecp192 Group 26 => ecp224 Group 27 => ecp224bp Group 28 => ecp256bp Group 29 => ecp384bp Group 30 => ecp512bp修改ipsec.secretsvi /etc/ipsec.secrets按如下格式填写本端外网IP 对端外网IP : PSK "此处输入共享密钥"重启下ipsec服务systemctl restart ipsec测试vpn状态命令ipsec auto --status参考http://glennxie.blog.51cto.com/1267825/1081807http://www.simlinux.com/archives/342.htmlhttp://mos1989.blog.51cto.com/4226977/1109450