讲真，我已经快被这个弄疯了！不是电脑连不上就是手机连不上。PPTP也没这么多问题啊！ F**K!
先把我的配置放上来做个备份，慢慢改吧...
也希望有大神路过的时候帮帮我 /鞠躬
以下所有的 X.X.X.X 为服务器的IP地址
安装依赖包
yum -y install make gcc gmp-devel bison flex lsof
安装源
rpm -ivh http://mirrors.yun-idc.com/epel/6/x86_64/epel-release-6-8.noarch.rpm
安装openswan
wget http://www.openswan.org/download/openswan-2.6.40.tar.gz --no-check-certificate
tar -zxvf openswan-2.6.40.tar.gz
cd openswan-2.6.40
make programs install
安装依赖文件
yum -y install libpcap-devel ppp policycoreutils
安装rp-l2tp
wget http://sourceforge.net/projects/rp-l2tp/files/rp-l2tp/0.4/rp-l2tp-0.4.tar.gz --no-check-certificate
tar -zxvf rp-l2tp-0.4.tar.gz
cd rp-l2tp-0.4
./configure
make
cp handlers/l2tp-control /usr/local/sbin/
mkdir /var/run/xl2tpd/
ln -s /usr/local/sbin/l2tp-control /var/run/xl2tpd/l2tp-control
安装软件
yum -y install xl2tpd
编辑 ipsec.conf
vi /etc/ipsec.conf (注意缩进)
config setup
nat_traversal=yes
protostack=netkey
oe=off
interfaces="%defaultroute"
dumpdir=/var/run/pluto/
virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,,%v4:!10.152.2.0/24
conn L2TP-PSK-NAT
rightsubnet=vhost:%priv
also=L2TP-PSK-noNAT
conn L2TP-PSK-noNAT
authby=secret
pfs=no
auto=add
keyingtries=3
rekey=no
ikelifetime=8h
dpddelay=40
dpdtimeout=130
dpdaction=clear
keylife=1h
type=transport
left=X.X.X.X
leftid=X.X.X.X
leftnexthop=%defaultroute
leftprotoport=17/%any
right=%any
rightprotoport=17/%any
rightnexthop=%defaultroute
forceencaps=yes
ike=3des-sha1,aes-sha1,aes256-sha1,aes256-sha2_256
phase2alg=3des-sha1,aes-sha1,aes256-sha1,aes256-sha2_256
编辑ipsec.secrets
vi /etc/ipsec.secrets
****** 是预共享密钥。
include /etc/ipsec.d/*.secrets
X.X.X.X %any: PSK "******"
启动 ipsec 服务
service ipsec restart
检查 ipsec 是否有错
ipsec verify
除了最后一行是 [DISABLED] 其他的都应该是 [OK]
修改 xl2tpd.conf
vi /etc/xl2tpd/xl2tpd.conf
[global]
listen-addr = X.X.X.X
[lns default]
ip range = 192.168.30.20-192.168.30.254
local ip = 192.168.30.1
require chap = yes
refuse pap = yes
require authentication = yes
name = LinuxVPNserver
ppp debug = yes
pppoptfile = /etc/ppp/options.xl2tpd
length bit = yes
修改 options.xl2tpd
vi /etc/ppp/options.xl2tpd
refuse-mschap-v2
refuse-mschap
ms-dns 8.8.8.8
ms-dns 119.29.29.29
asyncmap 0
modem
noccp
auth
crtscts
hide-password
idle 1800
mtu 1200
mru 1200
name l2tpd
debug
lock
local
proxyarp
connect-delay 100
lcp-echo-interval 30
lcp-echo-failure 4
添加用户
vi /etc/ppp/chap-secrets
UserName1 l2tpd PassWord1 *
UserName2 l2tpd PassWord2 *
配置转发 sysctl.conf 与 防火墙设置
vi /etc/sysctl.conf
net.ipv4.ip_forward= 0
修改为
net.ipv4.ip_forward= 1
iptables --table nat --append POSTROUTING --jump MASQUERADE
echo 1 > /proc/sys/net/ipv4/ip_forward
载入新配置
sysctl -p
报 unknown key 错误
解决办法：
注：此错误可以忽视，也可以使用下面命令解决。
modprobe bridge
lsmod |grep bridge
重新启动服务
service ipsec restart
service xl2tpd restart
设置规则
iptables --table nat --append POSTROUTING --jump MASQUERADE
/etc/init.d/iptables save
/etc/init.d/iptables restart
设置开机启动
vi /etc/rc.local
touch /var/lock/subsys/local
iptables-restore /etc/iptables
iptables --table nat --append POSTROUTING --jump MASQUERADE
for each in /proc/sys/net/ipv4/conf/*
do
echo 0 > $each/accept_redirects
echo 0 > $each/send_redirects
done
/etc/init.d/ipsec restart
/usr/bin/l2tpset
/usr/local/sbin/xl2tpd
现在的问题呢，就是我的安卓手机连不上啊！！ 我已经困惑好久了...
/var/log/message 里显示
xl2tpd[1369]: Maximum retries exceeded for tunnel 44122. Closing.
xl2tpd[1369]: Connection 34 closed to Y.Y.Y.Y, port 24259 (Timeout)
Y.Y.Y.Y 是我手机外网地址
