由于最近FQ软件封杀比较多，本人也比较穷买不起付费版，以前的经常用谷歌的goagent也没办法使用了，所以网上寻找资料通过国外的ECS服务器搭建一套VPN用于自己FQ使用，用于自己偶尔逛逛某溜网站。
更新组件，
整个安装过程不用经过编译，组件都是在yum中下载，首先我们更新一下所有组件
[root@Server-a58a3747-1bf6-4ee3-a6a0-1f2261ef0819 ~]# yum -y update
这里有个地方需要注意的是：有些主机的硬件并不支持最新内核，因此在不确定的情况下就不要升级内核了，用以下的命令：
[root@Server-a58a3747-1bf6-4ee3-a6a0-1f2261ef0819 ~]# yum --exclude=kernel* update -y
安装epel源
为什么要安装epel源呢？是因为必要组件xl2tpd在基础的yum源里面是没有的。
[root@Server-a58a3747-1bf6-4ee3-a6a0-1f2261ef0819 ~]# yum install epel-release -y
安装依赖组件
安装完epel源以后就可以直接安装依赖组件了。
[root@Server-a58a3747-1bf6-4ee3-a6a0-1f2261ef0819 ~]# yum install -y openswan ppp pptpd xl2tpd wget
查看服务器地址
我这里的ECS的公网IP不是直接配置在虚拟机的eth0接口，而是通过CNA内部一对一转换的。
[root@Server-a58a3747-1bf6-4ee3-a6a0-1f2261ef0819 ~]# ip addr show
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
link/ether fa:16:4e:8d:21:d3 brd ff:ff:ff:ff:ff:ff
inet 172.16.0.117/24 brd 172.16.0.255 scope global noprefixroute dynamic eth0
valid_lft 69807sec preferred_lft 69807sec
inet6 fe80::f816:4eff:fe8d:21d3/64 scope link
valid_lft forever preferred_lft forever
修改配置文件
需要等待所有依赖组件安装完成才能执行以下步骤（小标题括号内是文件路径）。
ipsec.conf配置文件（/etc/ipsec.conf）
[root@Server-a58a3747-1bf6-4ee3-a6a0-1f2261ef0819 ~]# vim /etc/ipsec.conf
# /etc/ipsec.conf - Libreswan IPsec configuration file
#
# see 'man ipsec.conf' and 'man pluto' for more information
#
# For example configurations and documentation, see https://libreswan.org/wiki/
config setup
# Normally, pluto logs via syslog.
logfile=/var/log/pluto.log
#
# Do not enable debug options to debug configuration issues!
#
# plutodebug="control parsing"
# plutodebug="all crypt"
plutodebug=none
#
# NAT-TRAVERSAL support
nat_traversal=yes
# exclude networks used on server side by adding %v4:!a.b.c.0/24
# It seems that T-Mobile in the US and Rogers/Fido in Canada are
# using 25/8 as "private" address space on their wireless networks.
# This range has never been announced via BGP (at least up to 2015)
virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:25.0.0.0/8,%v4:100.64.0.0/10,%v6:fd00::/8,%v6:fe80::/10
oe=off
protostack=netkey
force_keepalive=yes
keep_alive=1800
conn L2TP-PSK-NAT
rightsubnet=vhost:%priv
also=L2TP-PSK-noNAT
conn L2TP-PSK-noNAT
authby=secret
pfs=no
auto=add
keyingtries=3
rekey=no
ikelifetime=8h
keylife=1h
type=transport
left=172.16.0.117
leftid=172.16.0.117
leftprotoport=17/1701
right=%any
rightprotoport=17/%any
dpddelay=40
dpdtimeout=130
dpdaction=clear
# if it exists, include system wide crypto-policy defaults
# include /etc/crypto-policies/back-ends/libreswan.config
# It is best to add your IPsec connections as separate files in /etc/ipsec.d/
include /etc/ipsec.d/*.conf
设置预共享密钥配置文件（/etc/ipsec.secrets）
[root@Server-a58a3747-1bf6-4ee3-a6a0-1f2261ef0819 ~]# vim /etc/ipsec.secrets include /etc/ipsec.d/*.secrets 172.16.0.117 smoke PSK smoke520
注解：第二行中smoke为登录名，smoke520为登录密码
pptpd.conf配置文件(/etc/pptpd.conf)
[root@Server-a58a3747-1bf6-4ee3-a6a0-1f2261ef0819 ~]# vim /etc/pptpd.conf ############################################################################### # $Id: pptpd.conf,v 1.11 2011/05/19 00:02:50 quozl Exp $ # # Sample Poptop configuration file /etc/pptpd.conf # # Changes are effective when pptpd is restarted. ############################################################################### # TAG: ppp # Path to the pppd program, default '/usr/sbin/pppd' on Linux # #ppp /usr/sbin/pppd # TAG: option # Specifies the location of the PPP options file. # By default PPP looks in '/etc/ppp/options' # option /etc/ppp/options.pptpd # TAG: debug # Turns on (more) debugging to syslog # #debug # TAG: stimeout # Specifies timeout (in seconds) on starting ctrl connection # # stimeout 10 # TAG: noipparam # Suppress the passing of the client's IP address to PPP, which is # done by default otherwise. # #noipparam # TAG: logwtmp # Use wtmp(5) to record client connections and disconnections. # logwtmp # TAG: vrf <vrfname> # Switches PPTP & GRE sockets to the specified VRF, which must exist # Only available if VRF support was compiled into pptpd. # #vrf test # TAG: bcrelay <if> # Turns on broadcast relay to clients from interface <if> # #bcrelay eth1 # TAG: delegate # Delegates the allocation of client IP addresses to pppd. # # Without this option, which is the default, pptpd manages the list of # IP addresses for clients and passes the next free address to pppd. # With this option, pptpd does not pass an address, and so pppd may use # radius or chap-secrets to allocate an address. # #delegate # TAG: connections # Limits the number of client connections that may be accepted. # # If pptpd is allocating IP addresses (e.g. delegate is not # used) then the number of connections is also limited by the # remoteip option. The default is 100. #connections 100 # TAG: localip # TAG: remoteip # Specifies the local and remote IP address ranges. # # These options are ignored if delegate option is set. # # Any addresses work as long as the local machine takes care of the # routing. But if you want to use MS-Windows networking, you should # use IP addresses out of the LAN address space and use the proxyarp # option in the pppd options file, or run bcrelay. # # You can specify single IP addresses seperated by commas or you can # specify ranges, or both. For example: # # 192.168.0.234,192.168.0.245-249,192.168.0.254 # # IMPORTANT RESTRICTIONS: # # 1. No spaces are permitted between commas or within addresses. # # 2. If you give more IP addresses than the value of connections, # it will start at the beginning of the list and go until it # gets connections IPs. Others will be ignored. # # 3. No shortcuts in ranges! ie. 234-8 does not mean 234 to 238, # you must type 234-238 if you mean this. # # 4. If you give a single localIP, that's ok - all local IPs will # be set to the given one. You MUST still give at least one remote # IP for each simultaneous client. # # (Recommended) #localip 192.168.0.1 #remoteip 192.168.0.234-238,192.168.0.245 # or #localip 192.168.0.234-238,192.168.0.245 #remoteip 192.168.1.234-238,192.168.1.245 localip 10.0.1.2 remoteip 10.0.1.200-254
xl2tpd.conf配置文件(/etc/xl2tpd/xl2tpd.conf)
[root@Server-a58a3747-1bf6-4ee3-a6a0-1f2261ef0819 ~]# vim /etc/xl2tpd/xl2tpd.conf ; ; This is a minimal sample xl2tpd configuration file for use ; with L2TP over IPsec. ; ; The idea is to provide an L2TP daemon to which remote Windows L2TP/IPsec ; clients connect. In this example, the internal (protected) network ; is 192.168.1.0/24. A special IP range within this network is reserved ; for the remote clients: 192.168.1.128/25 ; (i.e. 192.168.1.128 ... 192.168.1.254) ; ; The listen-addr parameter can be used if you want to bind the L2TP daemon ; to a specific IP address instead of to all interfaces. For instance, ; you could bind it to the interface of the internal LAN (e.g. 192.168.1.98 ; in the example below). Yet another IP address (local ip, e.g. 192.168.1.99) ; will be used by xl2tpd as its address on pppX interfaces. [global] ; listen-addr = 192.168.1.98 listen-addr = 172.16.0.117 auth file = /etc/ppp/chap-secrets port = 1701 ; ; requires openswan-2.5.18 or higher - Also does not yet work in combination ; with kernel mode l2tp as present in linux 2.6.23+ ; ipsec saref = yes ; Use refinfo of 22 if using an SAref kernel patch based on openswan 2.6.35 or ; when using any of the SAref kernel patches for kernels up to 2.6.35. ; saref refinfo = 30 ; ; force userspace = yes ; ; debug tunnel = yes [lns default] ip range = 10.0.1.100-10.0.1.254 local ip = 10.0.1.1 refuse chap = yes refuse pap = yes require authentication = yes name = L2TPVPN ppp debug = yes pppoptfile = /etc/ppp/options.xl2tpd length bit = yes
options.pptpd配置文件(/etc/ppp/options.pptpd)
[root@Server-a58a3747-1bf6-4ee3-a6a0-1f2261ef0819 ~]# vim /etc/ppp/options.pptpd
###############################################################################
# $Id: options.pptpd,v 1.11 2005/12/29 01:21:09 quozl Exp $
#
# Sample Poptop PPP options file /etc/ppp/options.pptpd
# Options used by PPP when a connection arrives from a client.
# This file is pointed to by /etc/pptpd.conf option keyword.
# Changes are effective on the next connection. See "man pppd".
#
# You are expected to change this file to suit your system. As
# packaged, it requires PPP 2.4.2 and the kernel MPPE module.
###############################################################################
# Authentication
# Name of the local system for authentication purposes
# (must match the second field in /etc/ppp/chap-secrets entries)
name pptpd
# Strip the domain prefix from the username before authentication.
# (applies if you use pppd with chapms-strip-domain patch)
#chapms-strip-domain
# Encryption
# (There have been multiple versions of PPP with encryption support,
# choose with of the following sections you will use.)
# BSD licensed ppp-2.4.2 upstream with MPPE only, kernel module ppp_mppe.o
# {{{
refuse-pap
refuse-chap
refuse-mschap
# Require the peer to authenticate itself using MS-CHAPv2 [Microsoft
# Challenge Handshake Authentication Protocol, Version 2] authentication.
require-mschap-v2
# Require MPPE 128-bit encryption
# (note that MPPE requires the use of MSCHAP-V2 during authentication)
require-mppe-128
# }}}
# OpenSSL licensed ppp-2.4.1 fork with MPPE only, kernel module mppe.o
# {{{
#-chap
#-chapms
# Require the peer to authenticate itself using MS-CHAPv2 [Microsoft
# Challenge Handshake Authentication Protocol, Version 2] authentication.
#+chapms-v2
# Require MPPE encryption
# (note that MPPE requires the use of MSCHAP-V2 during authentication)
#mppe-40 # enable either 40-bit or 128-bit, not both
#mppe-128
#mppe-stateless
# }}}
# Network and Routing
# If pppd is acting as a server for Microsoft Windows clients, this
# option allows pppd to supply one or two DNS (Domain Name Server)
# addresses to the clients. The first instance of this option
# specifies the primary DNS address; the second instance (if given)
# specifies the secondary DNS address.
#ms-dns 10.0.0.1
#ms-dns 10.0.0.2
ms-dns 114.114.114.114
ms-dns 8.8.8.8
# If pppd is acting as a server for Microsoft Windows or "Samba"
# clients, this option allows pppd to supply one or two WINS (Windows
# Internet Name Services) server addresses to the clients. The first
# instance of this option specifies the primary WINS address; the
# second instance (if given) specifies the secondary WINS address.
#ms-wins 10.0.0.3
#ms-wins 10.0.0.4
# Add an entry to this system's ARP [Address Resolution Protocol]
# table with the IP address of the peer and the Ethernet address of this
# system. This will have the effect of making the peer appear to other
# systems to be on the local ethernet.
# (you do not need this if your PPTP server is responsible for routing
# packets to the clients -- James Cameron)
proxyarp
# Normally pptpd passes the IP address to pppd, but if pptpd has been
# given the delegate option in pptpd.conf or the --delegate command line
# option, then pppd will use chap-secrets or radius to allocate the
# client IP address. The default local IP address used at the server
# end is often the same as the address of the server. To override this,
# specify the local IP address here.
# (you must not use this unless you have used the delegate option)
#10.8.0.100
# Logging
# Enable connection debugging facilities.
# (see your syslog configuration for where pppd sends to)
#debug
# Print out all the option values which have been set.
# (often requested by mailing list to verify options)
#dump
# Miscellaneous
# Create a UUCP-style lock file for the pseudo-tty to ensure exclusive
# access.
lock
# Disable BSD-Compress compression
nobsdcomp
# Disable Van Jacobson compression
# (needed on some networks with Windows 9x/ME/XP clients, see posting to
# poptop-server on 14th April 2005 by Pawel Pokrywka and followups,
# http://marc.theaimsgroup.com/?t=111343175400006&r=1&w=2 )
novj
novjccomp
# turn off logging to stderr, since this may be redirected to pptpd,
# which may trigger a loopback
nologfd
# put plugins here
# (putting them higher up may cause them to sent messages to the pty)
options.xl2tpd配置文件(/etc/ppp/options.xl2tpd)
[root@Server-a58a3747-1bf6-4ee3-a6a0-1f2261ef0819 ~]# vim /etc/ppp/options.xl2tpd #require-pap #require-chap #require-mschap ipcp-accept-local ipcp-accept-remote require-mschap-v2 ms-dns 114.114.114.114 ms-dns 8.8.8.8 asyncmap 0 auth crtscts lock hide-password modem debug name l2tpd proxyarp lcp-echo-interval 30 lcp-echo-failure 4 mtu 1400 noccp connect-delay 5000 # To allow authentication against a Windows domain EXAMPLE, and require the # user to be in a group "VPN Users". Requires the samba-winbind package # require-mschap-v2 # plugin winbind.so # ntlm_auth-helper '/usr/bin/ntlm_auth --helper-protocol=ntlm-server-1 --require-membership-of="EXAMPLE\VPN Users"' # You need to join the domain on the server, for example using samba: # http://rootmanager.com/ubuntu-ipsec-l2tp-windows-domain-auth/setting-up-openswan-xl2tpd-with-native-windows-clients-lucid.html
创建chap-secrets配置文件，即用户列表及密码(/etc/ppp/chap-secrets)
[root@Server-a58a3747-1bf6-4ee3-a6a0-1f2261ef0819 ~]# vim /etc/ppp/chap-secrets # Secrets for authentication using CHAP # client server secret IP addresses smoke pptpd smoke520 * smoke l2tpd smoke520 *
注解：第三第四行中smoke为登录名，smoke520为登录密码
系统配置
允许IP转发
[root@Server-a58a3747-1bf6-4ee3-a6a0-1f2261ef0819 ~]# vim /etc/sysctl.conf # sysctl settings are defined through files in # /usr/lib/sysctl.d/, /run/sysctl.d/, and /etc/sysctl.d/. # # Vendors settings live in /usr/lib/sysctl.d/. # To override a whole file, create a new file with the same in # /etc/sysctl.d/ and put new settings there. To override # only specific settings, add a file with a lexically later # name in /etc/sysctl.d/ and put new settings there. # # For more information, see sysctl.conf(5) and sysctl.d(5). net.ipv4.ip_forward = 1 net.ipv4.conf.all.rp_filter = 0 net.ipv4.conf.default.rp_filter = 0 net.ipv4.conf.eth0.rp_filter = 0 net.ipv4.conf.all.send_redirects = 0 net.ipv4.conf.default.send_redirects = 0 net.ipv4.conf.all.accept_redirects = 0 net.ipv4.conf.default.accept_redirects = 0 [root@Server-a58a3747-1bf6-4ee3-a6a0-1f2261ef0819 ~]# sysctl -p net.ipv4.ip_forward = 1 net.ipv4.conf.all.rp_filter = 0 net.ipv4.conf.default.rp_filter = 0 net.ipv4.conf.eth0.rp_filter = 0 net.ipv4.conf.all.send_redirects = 0 net.ipv4.conf.default.send_redirects = 0 net.ipv4.conf.all.accept_redirects = 0 net.ipv4.conf.default.accept_redirects = 0
允许防火墙端口
我这里不使用firewalld来管理防火墙，受centos6.x影响，习惯用iptables；
[root@Server-a58a3747-1bf6-4ee3-a6a0-1f2261ef0819 ~]# systemctl stop firewalld [root@Server-a58a3747-1bf6-4ee3-a6a0-1f2261ef0819 ~]# systemctl mask firewalld [root@Server-a58a3747-1bf6-4ee3-a6a0-1f2261ef0819 ~]# yum -y install iptables iptables-services [root@Server-a58a3747-1bf6-4ee3-a6a0-1f2261ef0819 ~]# systemctl enable iptables.service [root@Server-a58a3747-1bf6-4ee3-a6a0-1f2261ef0819 ~]# vim /etc/sysconfig/iptables # sample configuration for iptables service # you can edit this manually or use system-config-firewall # please do not ask us to add additional ports/services to this default configuration *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [0:0] -A INPUT -j ACCEPT -A OUTPUT -j ACCEPT -A FORWARD -j ACCEPT COMMIT # Generated by iptables-save v1.4.21 on Sun Dec 22 00:15:06 2019 *nat :PREROUTING ACCEPT [3301:298282] :INPUT ACCEPT [309:16158] :OUTPUT ACCEPT [9:541] :POSTROUTING ACCEPT [9:541] -A POSTROUTING -s 10.0.1.0/24 -j MASQUERADE COMMIT # Completed on Sun Dec 22 00:15:06 2019 [root@Server-a58a3747-1bf6-4ee3-a6a0-1f2261ef0819 ~]# systemctl start iptables
启动并设置开机自启动服务
[root@Server-a58a3747-1bf6-4ee3-a6a0-1f2261ef0819 ~]# systemctl enable pptpd ipsec xl2tpd [root@Server-a58a3747-1bf6-4ee3-a6a0-1f2261ef0819 ~]# systemctl restart pptpd ipsec xl2tpd
通过Windows客户端连接
创建一个新的VPN连接
输入账号密码
连接VPN
访问某溜，哈哈哈，没想到打不开，不过youtube没问题。哎！
浙公网安备 33010602011771号