1 安裝
安裝l2tp和strongswan。
sudo apt install xl2tpd
sudo apt install strongswan
2 ipsec配置
1）編輯**/etc/ipsec.conf**
conn L2TP-IPSEC
authby=secret
auto=add
keyingtries=3
ikelifetime=8h
keylife=1h
keyexchange=ikev2
ike=chacha20poly1305-sha512-curve25519-prfsha512
esp=chacha20poly1305-sha512,aes256gcm16-ecp384,aes256-sha256,aes256-sha1,3des-sha1
# 連接類型 傳輸模式transport/隧道模式tunnel
type=transport
# 服務(wù)器公網(wǎng)地址
left=10.25.X.X
# 服務(wù)器子網(wǎng)網(wǎng)段
leftsubnet=10.25.17.0/24[17/1701]
# 客戶端訪問地址
right=%any # right=10.25.16.0/24
# rightsubnet=10.25.16.0/24[17/%any]
dpddelay=30s
dpdtimeout=150s
dpdaction=clear
2）編輯**/etc/ipsec.secrets** , 設(shè)置ipsec的預(yù)共享秘鑰
# This file holds shared secrets or RSA private keys for authentication.
# RSA private key for this host, authenticating it to any other host
# which knows the public part.
: PSK "123456"
3 l2tp配置
編輯**/etc/xl2tpd/xl2tpd.conf**
[global]
ipsec saref = no
debug tunnel = no
debug avp = no
debug network = no
debug state = no
access control = no
rand source = dev
port = 1701
auth file = /etc/ppp/chap-secrets
[lns default]
# 分配給客戶端的私有網(wǎng)絡(luò)地址
ip range = 192.168.100.100 - 192.168.100.254
# 服務(wù)器私有網(wǎng)絡(luò)地址 綁定網(wǎng)卡的實(shí)際網(wǎng)絡(luò)地址
local ip = 192.168.100.210
name = l2tp
pass peer = yes
refuse pap = yes
refuse chap = yes
require authentication = yes
ppp debug = no
# 指定PPP配置文件路徑
pppoptfile = /etc/ppp/options.xl2tpd
length bit = yes
4 ppp配置
1） 編輯PPP配置文件(例如上文中的**/etc/ppp/options.xl2tpd**)。
require-mschap-v2
refuse-mschap
# DNS服務(wù)器地址
ms-dns 127.0.0.53
asyncmap 0
auth
crtscts
idle 1800
mtu 1410
mru 1410
hide-password
local
modem
lock
name l2tpd
connect-delay 5000
lcp-echo-interval 30
lcp-echo-failure 4
2）編輯**/etc/ppp/chap-secrets**，添加VPN訪問用戶密碼
# Secrets for authentication using CHAP
# client server secret IP addresses
root * root *
5 重啟服務(wù)
#重啟服務(wù)
$sudo service xl2tpd restart
$sudo service ipsec restart#確認(rèn)服務(wù)狀態(tài)
$sudo service xl2tpd status
$sudo service ipsec status文章來源：http://www.zghlxwxcb.cn/news/detail-760186.html
6 添加子網(wǎng)路由
當(dāng)客戶端可以連接到VPN服務(wù)器時(shí)，需要添加路由才可以訪問私有網(wǎng)絡(luò)中的其它機(jī)器。文章來源地址http://www.zghlxwxcb.cn/news/detail-760186.html
# 添加訪問192.168.100網(wǎng)段的路由
route add -net 192.168.100.0/24 netmask 255.255.255.0 gw 192.168.100.1
到了這里，關(guān)于Ubuntu20.04 搭建L2TP+IPsec環(huán)境的文章就介紹完了。如果您還想了解更多內(nèi)容，請(qǐng)?jiān)谟疑辖撬阉鱐OY模板網(wǎng)以前的文章或繼續(xù)瀏覽下面的相關(guān)文章，希望大家以后多多支持TOY模板網(wǎng)！
