L2TP on ipsec (with xl2tpd, libreswan) centos7

L2TP on ipsec (with xl2tpd, libreswan) centos7

설치

yum install epel-release yum install ppp xl2tpd libreswan

포트

500 udp 4500 udp 1701 udp

vim /etc/ipsec.conf

config setup protostack=netkey logfile=/var/log/pluto.log dumpdir=/var/run/pluto/ virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:25.0.0.0/8,%v4:100.64.0.0/10,%v6:fd00::/8,%v6:fe80::/10   include /etc/ipsec.d/*.conf conn L2TP-PSK-NAT        rightsubnet=vhost:%priv        also=L2TP-PSK-noNAT conn L2TP-PSK        authby=secret        pfs=no        auto=add        keyingtries=3        keylife=1h        type=transport        left="%defaultroute"        leftid="%defaultroute"        leftprotoport=17/1701        right=%any        rightprotoport=17/%any        dpddelay=40        dpdtimeout=130        dpdaction=clear

vim /etc/xl2tpd/xl2tpd.conf

[global] listen-addr = VPN 서버 아이피 ; listen-addr = VPN 서버 아이피 (생략 가능) [lns default] ip range = 10.0.0.70-10.0.0.99 local ip = 10.0.0.1 refuse pap = yes require authentication = yes name = LinuxVPNserver ppp debug = yes pppoptfile = /etc/ppp/options.xl2tpd length bit = yes

vim /etc/ppp/chap-secrets

# Secrets for authentication using CHAP # client        server  secret                  IP addresses 아이디 * 패스워드 *

vim /etc/ipsec.secret

include /etc/ipsec.d/*.secrets VPN서버아이피 %any: PSK "PSK입력"

vim /etc/ppp/options.xl2tpd

ipcp-accept-local ipcp-accept-remote ms-dns  8.8.8.8 noccp auth idle 1800 mtu 1410 mru 1410 nodefaultroute debug proxyarp connect-delay 5000