С администрированием linux-систем сталкивался мало, поэтому разбираюсь со скрипом. Google спрашивал, но ответа не добился. К сути. Схема подключения на клиенте следующая: HomePC<-->Router(NAT)<-->Inet<-->VPN_Server
Хочу настроить на Debian l2tp OpenSWAN ipsec. Действовал так:
0)
root@dtcoalex:~# ifconfig
eth0 Link encap:Ethernet HWaddr 00:50:56:81:45:c5
inet addr:91.245.35.34 Bcast:91.245.35.63 Mask:255.255.255.224
inet6 addr: fe80::250:56ff:fe81:45c5/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:8235 errors:0 dropped:0 overruns:0 frame:0
TX packets:7659 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:745378 (727.9 KiB) TX bytes:2222999 (2.1 MiB)
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
1) apt-get install openswan xl2tpd
2)
root@dtcoalex:~# nano /etc/ipsec.conf
version 2.0 # conforms to second version of ipsec.conf specification
config setup
protostack=netkey
nat_traversal=yes virtual_private=%v4:10.0.0.0/8,%v4:172.16.0.0/12,%v4:192.168.0.0/16,%v4:!10.0.7.0/26
interfaces=%defaultroute
# plutodebug="all"
plutostderrlog=/var/log/pluto.log
oe=off
conn L2TP-PSK-NAT
authby=secret
type=transport
pfs=no
rekey=no
keyingtries=3
left=%defaultroute
leftprotoport=17/1701
right=%any
rightsubnet=vhost:%no,%priv
rightprotoport=17/%any
auto=add
nano /etc/ipsec.secrets
91.245.35.34 %any: PSK "mysecret" #external IP nano /etc/xl2tpd/xl2tpd.conf
ipsec saref = yes
debug tunnel = yes
debug avp = yes
debug network = yes
debug packet = yes
debug state = yes
;force userspace =yes
[lns default]
ip range = 10.0.7.40-10.0.7.50
local ip = 10.0.7.2
assign ip = yes
require chap = yes
refuse pap = yes
require authentication = yes
name = l2tpVPN
ppp debug = yes
pppoptfile = /etc/ppp/options.xl2tpd
length bit = yes
* * * # let all , because we use auth with ppp
6)
nano /etc/ppp/options.xl2tpd
ipcp-accept-local
ipcp-accept-remote
require-mschap-v2
auth
noccp
idle 1800
mtu 1200
mru 1200
nodefaultroute
debug
lock
proxyarp
connect-delay 5000
logfile /var/log/xl2tpd.log
nano /etc/ppp/chap-secrets
user l2tpd pass *
9)
ipsec verify
Checking your system to see if IPsec got installed and started correctly:
Version check and ipsec on-path [OK]
Linux Openswan U2.6.37/K3.2.0-4-686-pae (netkey)
Checking for IPsec support in kernel [OK]
SAref kernel support [N/A]
NETKEY: Testing XFRM related proc values [FAILED]
Please disable /proc/sys/net/ipv4/conf/*/send_redirects
or NETKEY will cause the sending of bogus ICMP redirects!
[FAILED]
Please disable /proc/sys/net/ipv4/conf/*/accept_redirects
or NETKEY will accept bogus ICMP redirects!
[OK]
Checking that pluto is running [OK]
Pluto listening for IKE on udp 500 [OK]
Pluto listening for NAT-T on udp 4500 [OK]
Checking for 'ip' command [OK]
Checking /bin/sh is not /bin/dash [WARNING]
Checking for 'iptables' command [OK]
Opportunistic Encryption Support [DISABLED]
Однако получаю ошибку при попытке соединиться с клиента на Windows 7. В логе /var/log/pluto.log
packet from 87.117.185.107:641: ignoring Vendor ID payload [MS NT5 ISAKMPOAKLEY 00000008]
packet from 87.117.185.107:641: received Vendor ID payload [RFC 3947] method set to=109
packet from 87.117.185.107:641: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n] meth=106, but already using method 109
packet from 87.117.185.107:641: ignoring Vendor ID payload [FRAGMENTATION]
packet from 87.117.185.107:641: ignoring Vendor ID payload [MS-Negotiation Discovery Capable]
packet from 87.117.185.107:641: ignoring Vendor ID payload [Vid-Initial-Contact]
packet from 87.117.185.107:641: ignoring Vendor ID payload [IKE CGA version 1]
"L2TP-PSK-NAT"[2] 87.117.185.107 #9: responding to Main Mode from unknown peer 87.117.185.107
"L2TP-PSK-NAT"[2] 87.117.185.107 #9: OAKLEY_GROUP 20 not supported. Attribute OAKLEY_GROUP_DESCRIPTION
"L2TP-PSK-NAT"[2] 87.117.185.107 #9: OAKLEY_GROUP 19 not supported. Attribute OAKLEY_GROUP_DESCRIPTION
"L2TP-PSK-NAT"[2] 87.117.185.107 #9: transition from state STATE_MAIN_R0 to state STATE_MAIN_R1
"L2TP-PSK-NAT"[2] 87.117.185.107 #9: STATE_MAIN_R1: sent MR1, expecting MI2
packet from 87.117.185.107:641: ignoring Vendor ID payload [MS NT5 ISAKMPOAKLEY 00000008]
packet from 87.117.185.107:641: received Vendor ID payload [RFC 3947] method set to=109
packet from 87.117.185.107:641: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n] meth=106, but already using method 109
packet from 87.117.185.107:641: ignoring Vendor ID payload [FRAGMENTATION]
packet from 87.117.185.107:641: ignoring Vendor ID payload [MS-Negotiation Discovery Capable]
packet from 87.117.185.107:641: ignoring Vendor ID payload [Vid-Initial-Contact]
packet from 87.117.185.107:641: ignoring Vendor ID payload [IKE CGA version 1]
"L2TP-PSK-NAT"[2] 87.117.185.107 #10: responding to Main Mode from unknown peer 87.117.185.107
"L2TP-PSK-NAT"[2] 87.117.185.107 #10: OAKLEY_GROUP 20 not supported. Attribute OAKLEY_GROUP_DESCRIPTION
"L2TP-PSK-NAT"[2] 87.117.185.107 #10: OAKLEY_GROUP 19 not supported. Attribute OAKLEY_GROUP_DESCRIPTION
"L2TP-PSK-NAT"[2] 87.117.185.107 #10: transition from state STATE_MAIN_R0 to state STATE_MAIN_R1
"L2TP-PSK-NAT"[2] 87.117.185.107 #10: STATE_MAIN_R1: sent MR1, expecting MI2
"L2TP-PSK-NAT"[2] 87.117.185.107 #3: max number of retransmissions (2) reached STATE_MAIN_R1
"L2TP-PSK-NAT"[2] 87.117.185.107 #4: max number of retransmissions (2) reached STATE_MAIN_R1
"L2TP-PSK-NAT"[2] 87.117.185.107 #5: max number of retransmissions (2) reached STATE_MAIN_R1
"L2TP-PSK-NAT"[2] 87.117.185.107 #6: max number of retransmissions (2) reached STATE_MAIN_R1
"L2TP-PSK-NAT"[2] 87.117.185.107 #7: max number of retransmissions (2) reached STATE_MAIN_R1
"L2TP-PSK-NAT"[2] 87.117.185.107 #8: max number of retransmissions (2) reached STATE_MAIN_R1
"L2TP-PSK-NAT"[2] 87.117.185.107 #9: max number of retransmissions (2) reached STATE_MAIN_R1
"L2TP-PSK-NAT"[2] 87.117.185.107 #10: max number of retransmissions (2) reached STATE_MAIN_R1
"L2TP-PSK-NAT"[2] 87.117.185.107: deleting connection "L2TP-PSK-NAT" instance with peer 87.117.185.107 {isakmp=#0/ipsec=#0}
