strongSwan
下载
主页：https://www.strongswan.org
下载： https://www.strongswan.org/download.html
最新版本：5.7.2
更新时间：2018/12/27
测试版本：5.8.0rc1
更新时间：2019/05/10
安装
文档：https://www.strongswan.org/documentation.html
编译安装
wget http://download.strongswan.org/strongswan-x.x.x.tar.bz2
yum install bzip2 gcc gmp-devel -y
tar jxvf strongswan-x.x.x.tar.bz2
cd strongswan-x.x.x
./configure --prefix=/usr --sysconfdir=/etc/strongswan --<your-options>
#./configure --sysconfdir=/etc --enable-openssl --enable-nat-transport --disable-mysql --disable-ldap --disable-static --enable-shared --enable-md4 --enable-eap-mschapv2 --enable-eap-aka --enable-eap-aka-3gpp2 --enable-eap-gtc --enable-eap-identity --enable-eap-md5 --enable-eap-peap --enable-eap-radius --enable-eap-sim --enable-eap-sim-file --enable-eap-simaka-pseudonym --enable-eap-simaka-reauth --enable-eap-simaka-sql --enable-eap-tls --enable-eap-tnc --enable-eap-ttls
make
sudo make install
RPM安装
下载：https://pkgs.org/download/strongswan
wget http://download-ib01.fedoraproject.org/pub/epel/7/x86_64/Packages/s/strongswan-5.7.2-1.el7.x86_64.rpm
yum install trousers -y
rpm -ivh strongswan-*.rpm
YUM安装
yum install strongswan -y
查看版本
ipsec version
strongswan version
Linux strongSwan U5.7.2/K3.10.0-957.1.3.el7.x86_64
University of Applied Sciences Rapperswil, Switzerland
See 'strongswan --copyright' for copyright information.
配置
配置ipsec.conf
vi /etc/strongswan/ipsec.conf
# ipsec.conf - strongSwan IPsec configuration file
# basic configuration
config setup
uniqueids=never
conn %default
authby=psk
type=tunnel
conn S2S_to_idc2
keyexchange=ikev1
#/本端内网地址以及转发的网关/
left=10.254.0.1
#/本端发起协商的公网IP，同时也时协商中的local-id/
leftsubnet=10.254.0.0/24
#/本端内网子机地址段/
leftid=119.254.155.157
right=192.168.1.17
rightsubnet=192.168.1.0/24
rightid=119.254.155.53
auto=route
ike=aes-sha1-modp1024
ikelifetime=86400s
esp=aes-sha1-modp1024
lifetime=86400s
type=tunnel
配置ipsec.secrets
vi /etc/strongswan/ipsec.secrets
119.254.155.157 119.254.155.53 : PSK password123456
打开转发
echo 1 > /proc/sys/net/ipv4/ip_forward
开启服务
systemctl start strongswan
systemctl enable strongswan
查看状态
strongswan statusall
Status of IKE charon daemon (strongSwan 5.7.2, Linux 3.10.0-957.1.3.el7.x86_64, x86_64):
uptime: 22 minutes, since May 17 23:52:18 2019
malloc: sbrk 2666496, mmap 0, used 627232, free 2039264
worker threads: 11 of 16 idle, 5/0/0/0 working, job queue: 0/0/0/0, scheduled: 5
loaded plugins: charon pkcs11 tpm aesni aes des rc2 sha2 sha1 md4 md5 mgf1 random nonce x509 revocation constraints acert pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem openssl gcrypt fips-prf gmp curve25519 chapoly xcbc cmac hmac ctr ccm gcm curl attr kernel-netlink resolve socket-default farp stroke vici updown eap-identity eap-sim eap-aka eap-aka-3gpp eap-aka-3gpp2 eap-md5 eap-gtc eap-mschapv2 eap-dynamic eap-radius eap-tls eap-ttls eap-peap xauth-generic xauth-eap xauth-pam xauth-noauth dhcp led duplicheck unity counters
Listening IP addresses:
10.254.0.15
Connections:
S2S_to_idc2: 10.254.0.1...119.254.155.53 IKEv1
S2S_to_idc2: local: [119.254.155.157] uses pre-shared key authentication
S2S_to_idc2: remote: [119.254.155.53] uses pre-shared key authentication
S2S_to_idc2: child: 10.254.0.0/24 === 192.168.1.0/24 TUNNEL
Routed Connections:
S2S_to_idc2{4}: ROUTED, TUNNEL, reqid 1
S2S_to_idc2{4}: 10.254.0.0/24 === 192.168.1.0/24
Security Associations (1 up, 0 connecting):
S2S_to_idc2[2]: ESTABLISHED 22 minutes ago, 10.254.0.15[119.254.155.157]...119.254.155.53[119.254.155.53]
S2S_to_idc2[2]: IKEv1 SPIs: 11c877a2b0f987a4_i* 0eaef29a4e92731c_r, pre-shared key reauthentication in 23 hours
S2S_to_idc2[2]: IKE proposal: AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024
S2S_to_idc2{3}: INSTALLED, TUNNEL, reqid 1, ESP in UDP SPIs: cf86534e_i c3234c93_o
S2S_to_idc2{3}: AES_CBC_128/HMAC_SHA1_96/MODP_1024, 12744 bytes_i (152 pkts, 79s ago), 18280 bytes_o (219 pkts, 541s ago), rekeying in 23 hours
S2S_to_idc2{3}: 10.254.0.0/24 === 192.168.1.0/24
