Setup a L2TP over IPSec VPN Server on Linux

Test Environment:

L2TP Client ---------- L2TP Server

L2TP Client: Windows XP SP2
L2TP Server: CentOS 5.0

IP address of L2TP Client: 10.5.30.200
IP address of L2TP Server: 10.5.30.3

必要套件:
xl2tpd-1.1.09-1.fc5.src.rpm
openswan-2.4.9-31.el5.i386.rpm
ipsec-tools* (預設已安裝)
ppp* (預設已安裝)

Setup Procedure:

1.Install RPM:
# rpm –ivh openswan*
# rpm –ivh xl2tpd* (That’s source rpm you must rebuild it)

2.Configure L2TP Server:
2.1 設定帳號與密碼:
＃ vi /etc/ppp/chap-secrets
lawrence * “redhat” *

2.2 設定xl2tpd設定檔:
[global]
; listen-addr = 192.168.1.98
;
;requires openswan-3.1
;ipsec saref = yes
;
;debug tunnel = yes
auth file = /etc/ppp/chap-secrets
[lns default]
ip range = 192.168.1.128-192.168.1.254
local ip = 192.168.1.99
require chap = yes
refuse pap = yes
require authentication = yes
name = LinuxVPNserver
ppp debug = yes
pppoptfile = /etc/ppp/options.xl2tpd
length bit = yes

2.3 設定/etc/ppp/options.xl2tpd
ipcp-accept-local
ipcp-accept-remote
ms-dns 192.168.1.1
ms-dns 192.168.1.3
ms-wins 192.168.1.2
ms-wins 192.168.1.4
noccp
auth
crtscts
idle 1800
#mtu 1410
#mru 1410
nodefaultroute
debug
lock
proxyarp
connect-delay 5000
logfile /var/log/xl2tpd.log

2.4 啟動L2TP Server
# service xl2tpd start; chkconfig xl2tpd on

3. 設定IPSec
3.1 PSK setting:
# vi /etc/ipsec.secrets
include /etc/ipsec.d/*.secrets
10.5.30.3 %any : PSK "1234567890"

10.5.30.3 -> Server IP address
%any -> allow all machines
格式要一模一樣，不然會出錯

3.2 設定l2tp-psk.conf
套用範例即可:
# cp /etc/ipsec.d/examples/l2tp-psk.conf /etc/ipsec.d/
# chmod 755 l2tp-psk.conf

3.3 啟動IPSec
# service ipsec start; chkconfig ipsec on

3.4 Check IPSec status
# ipsec verify
Checking your system to see if IPsec got installed and started correctly:
Version check and ipsec on-path [OK]
Linux Openswan Uopenswan-2.4.9-31.el5/K2.6.18-8.1.8.el5 (netkey)
Checking for IPsec support in kernel [OK]
NETKEY detected, testing for disabled ICMP send_redirects [OK]
NETKEY detected, testing for disabled ICMP accept_redirects [OK]
Checking for RSA private key (/etc/ipsec.d/hostkey.secrets) [OK]
Checking that pluto is running [OK]
Two or more interfaces found, checking IP forwarding [OK]
Checking NAT and MASQUERADEing [N/A]
Checking for 'ip' command [OK]
Checking for 'iptables' command [OK]
Opportunistic Encryption Support [DISABLED]

這麼一來L2TP over IPSec就成功架設起來了，如果有問題的話可查看以下的log file
/var/log/message
/var/log/secure
/var/log/xl2tpd.log

4. L2TP Client setting:
4.1新增連線
1. 開始->設定->網路連線->新增連線精靈
2. 選擇連線到公司網路(使用指定撥號或是vpn)
3. 選擇虛擬私人網路連線
4. 輸入名稱(可以隨意選)
5. 輸入VPN server IP (10.5.30.3)

4.2 修改設定

1.在安全性的分頁中->選擇進階->只勾選CHAP->可省加密

2. 點選"ipsec 設定"選項,輸入PSK(pre-shared key)