您现在的位置是：首页 > 博客日记 > Liunx Liunx

Liunx搭建VPN

2017-06-17 15:22:23 【Liunx】 人已围观

//www.xiukee.com/show_530564.html

接下来怎么办？不懂Linux会不会死？不会滴。
命令都在这里了。
先安装pptpd服务，就是VPN连接的软件模块。
输入：yum install ppp iptables pptpd

安装完成之后，你就得开始好好干活了：
A：编辑pptpd.conf：

  1. 输入：vi /etc/pptpd.conf

找到localip，去掉下面字段前面的#，然后保存退出。

  1. localip 192.168.0.1
  2. remoteip 192.168.0.234-238,192.168.0.245

Tips：
不会用vi编辑器怎么办？用上下键移动光标到需要修的那一行，按“i”键进入插入编辑状态，修改完成之后，按“esc”键退出编辑，直接在键盘上输入“:wq”即可保存退出。
编辑options.pptpd

  1. vi /etc/ppp/options.pptpd

搜索ms-dns，去掉搜索到的两行ms-dns前面的#，并修改为下面的字段

  1. ms-dns 8.8.8.8
  2. ms-dns 8.8.4.4

然后是加入VPN的帐号密码，需要编辑/etc/ppp/chap-secrets设置：

  1. vi /etc/ppp/chap-secrets

添加一行，按照下面格式输入：

  1. 用户名 pptpd 密码 *

保存退出，配置内核。

  1. vi /etc/sysctl.conf

在这个文件里面加入一行：net.ipv4.ip_forward=1，然后保存退出。

输入：sysctl -p 让刚才的设置生效。

输入：

  1. iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -j SNAT --to-source 47.93.56.87

请注意最后的参数并不是那一段中文哦，而是你的服务器的IP地址。去阿里云的管理平台看。

  1. 然后输入：chmod +x /etc/rc.d/rc.local
  2. 编辑系统配置：vi /etc/rc.d/rc.local
  3. 把刚才那个iptables的命令加入进去。保存退出。
  4. 启动vpn链接的服务：systemctl start pptpd

让它开机自启动：

  1. chkconfig pptpd on

万事大吉，整个过程大概30分钟就能搞定。
之后的VPN设置也很容易，你有了IP地址和用户名密码，直接设置好了就行。

我总结了一个shell脚本

  1. #!/bin/bash
  2. #############################################################
  3. #                                                           #
  4. # This is a PPTP and L2TP VPN installation for CentOS 7     #
  5. # Version: 1.1.1 20160507                                   #
  6. # Author: Bon Hoo                                           #
  7. # Website: //www.ccwebsite.com                         #
  8. #                                                           #
  9. #############################################################
  11. #检测是否是root用户
  12. if [[ $(id -u) != "0" ]]; then
  13.     printf "\e[42m\e[31mError: You must be root to run this install script.\e[0m\n"
  14.     exit 1
  15. fi
  17. #检测是否是CentOS 7或者RHEL 7
  18. if [[ $(grep "release 7." /etc/redhat-release 2>/dev/null | wc -l) -eq 0 ]]; then
  19.     printf "\e[42m\e[31mError: Your OS is NOT CentOS 7 or RHEL 7.\e[0m\n"
  20.     printf "\e[42m\e[31mThis install script is ONLY for CentOS 7 and RHEL 7.\e[0m\n"
  21.     exit 1
  22. fi
  23. clear
  25. printf "
  26. #############################################################
  27. #                                                           #
  28. # This is a PPTP and L2TP VPN installation for CentOS 7     #
  29. # Version: 1.1.1 20160507                                   #
  30. # Author: Bon Hoo                                           #
  31. # Website: //www.ccwebsite.com                         #
  32. #                                                           #
  33. #############################################################
  34. "
  36. #获取服务器IP
  37. serverip=$(ifconfig -a |grep -w "inet"| grep -v "127.0.0.1" |awk '{print $2;}')
  38. printf "\e[33m$serverip\e[0m is the server IP?"
  39. printf "If \e[33m$serverip\e[0m is \e[33mcorrect\e[0m, press enter directly."
  40. printf "If \e[33m$serverip\e[0m is \e[33mincorrect\e[0m, please input your server IP."
  41. printf "(Default server IP: \e[33m$serverip\e[0m):"
  42. read serveriptmp
  43. if [[ -n "$serveriptmp" ]]; then
  44.     serverip=$serveriptmp
  45. fi
  47. #获取网卡接口名称
  48. ethlist=$(ifconfig | grep ": flags" | cut -d ":" -f1)
  49. eth=$(printf "$ethlist\n" | head -n 1)
  50. if [[ $(printf "$ethlist\n" | wc -l) -gt 2 ]]; then
  51.     echo ======================================
  52.     echo "Network Interface list:"
  53.     printf "\e[33m$ethlist\e[0m\n"
  54.     echo ======================================
  55.     echo "Which network interface you want to listen for ocserv?"
  56.     printf "Default network interface is \e[33m$eth\e[0m, let it blank to use default network interface: "
  57.     read ethtmp
  58.     if [ -n "$ethtmp" ]; then
  59.         eth=$ethtmp
  60.     fi
  61. fi
  63. #设置VPN拨号后分配的IP段
  64. iprange="10.0.1"
  65. echo "Please input IP-Range:"
  66. printf "(Default IP-Range: \e[33m$iprange\e[0m): "
  67. read iprangetmp
  68. if [[ -n "$iprangetmp" ]]; then
  69.     iprange=$iprangetmp
  70. fi
  72. #设置预共享密钥
  73. mypsk="ueibo.cn"
  74. echo "Please input PSK:"
  75. printf "(Default PSK: \e[33mueibo.cn\e[0m): "
  76. read mypsktmp
  77. if [[ -n "$mypsktmp" ]]; then
  78.     mypsk=$mypsktmp
  79. fi
  81. #设置VPN用户名
  82. username="ueibo.com"
  83. echo "Please input VPN username:"
  84. printf "(Default VPN username: \e[33mueibo.com\e[0m): "
  85. read usernametmp
  86. if [[ -n "$usernametmp" ]]; then
  87.     username=$usernametmp
  88. fi
  90. #随机密码
  91. randstr() {
  92.     index=0
  93.     str=""
  94.     for i in {a..z}; do arr[index]=$i; index=$(expr ${index} + 1); done
  95.     for i in {A..Z}; do arr[index]=$i; index=$(expr ${index} + 1); done
  96.     for i in {0..9}; do arr[index]=$i; index=$(expr ${index} + 1); done
  97.     for i in {1..10}; do str="$str${arr[$RANDOM%$index]}"; done
  98.     echo $str
  99. }
  101. #设置VPN用户密码
  102. password=$(randstr)
  103. printf "Please input \e[33m$username\e[0m's password:\n"
  104. printf "Default password is \e[33m$password\e[0m, let it blank to use default password: "
  105. read passwordtmp
  106. if [[ -n "$passwordtmp" ]]; then
  107.     password=$passwordtmp
  108. fi
  110. clear
  112. #打印配置参数
  113. clear
  114. echo "Server IP:"
  115. echo "$serverip"
  116. echo
  117. echo "Server Local IP:"
  118. echo "$iprange.1"
  119. echo
  120. echo "Client Remote IP Range:"
  121. echo "$iprange.10-$iprange.254"
  122. echo
  123. echo "PSK:"
  124. echo "$mypsk"
  125. echo
  126. echo "Press any key to start..."
  128. get_char() {
  129.     SAVEDSTTY=`stty -g`
  130.     stty -echo
  131.     stty cbreak
  132.     dd if=/dev/tty bs=1 count=1 2> /dev/null
  133.     stty -raw
  134.     stty echo
  135.     stty $SAVEDSTTY
  136. }
  137. char=$(get_char)
  138. clear
  139. mknod /dev/random c 1 9
  141. #更新组件
  142. yum update -y
  144. #安装epel源
  145. yum install epel-release -y
  147. #安装依赖的组件
  148. yum install -y openswan ppp pptpd xl2tpd wget
  150. #创建ipsec.conf配置文件
  151. rm -f /etc/ipsec.conf
  152. cat >>/etc/ipsec.conf<<EOF
  153. # /etc/ipsec.conf - Libreswan IPsec configuration file
  154. # This file:  /etc/ipsec.conf
  155. #
  156. # Enable when using this configuration file with openswan instead of libreswan
  157. #version 2
  158. #
  159. # Manual:     ipsec.conf.5
  160. # basic configuration
  161. config setup
  162.     # NAT-TRAVERSAL support, see README.NAT-Traversal
  163.     nat_traversal=yes
  164.     # exclude networks used on server side by adding %v4:!a.b.c.0/24
  165.     virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12
  166.     # OE is now off by default. Uncomment and change to on, to enable.
  167.     oe=off
  168.     # which IPsec stack to use. auto will try netkey, then klips then mast
  169.     protostack=netkey
  170.     force_keepalive=yes
  171.     keep_alive=1800
  172. conn L2TP-PSK-NAT
  173.     rightsubnet=vhost:%priv
  174.     also=L2TP-PSK-noNAT
  175. conn L2TP-PSK-noNAT
  176.     authby=secret
  177.     pfs=no
  178.     auto=add
  179.     keyingtries=3
  180.     rekey=no
  181.     ikelifetime=8h
  182.     keylife=1h
  183.     type=transport
  184.     left=$serverip
  185.     leftid=$serverip
  186.     leftprotoport=17/1701
  187.     right=%any
  188.     rightprotoport=17/%any
  189.     dpddelay=40
  190.     dpdtimeout=130
  191.     dpdaction=clear
  192.     leftnexthop=%defaultroute
  193.     rightnexthop=%defaultroute
  194.     ike=3des-sha1,aes-sha1,aes256-sha1,aes256-sha2_256
  195.     phase2alg=3des-sha1,aes-sha1,aes256-sha1,aes256-sha2_256
  196.     sha2-truncbug=yes
  197. # For example connections, see your distribution's documentation directory,
  198. # or the documentation which could be located at
  199. #  /usr/share/docs/libreswan-3.*/ or look at //www.libreswan.org/
  200. #
  201. # There is also a lot of information in the manual page, "man ipsec.conf"
  202. # You may put your configuration (.conf) file in the "/etc/ipsec.d/" directory
  203. # by uncommenting this line
  204. #include /etc/ipsec.d/*.conf
  205. EOF
  207. #设置预共享密钥配置文件
  208. rm -f /etc/ipsec.secrets
  209. cat >>/etc/ipsec.secrets<<EOF
  210. #include /etc/ipsec.d/*.secrets
  211. $serverip %any: PSK "$mypsk"
  212. EOF
  214. #创建pptpd.conf配置文件
  215. rm -f /etc/pptpd.conf
  216. cat >>/etc/pptpd.conf<<EOF
  217. #ppp /usr/sbin/pppd
  218. option /etc/ppp/options.pptpd
  219. #debug
  220. # stimeout 10
  221. #noipparam
  222. logwtmp
  223. #vrf test
  224. #bcrelay eth1
  225. #delegate
  226. #connections 100
  227. localip $iprange.2
  228. remoteip $iprange.200-254
  229. EOF
  231. #创建xl2tpd.conf配置文件
  232. mkdir -p /etc/xl2tpd
  233. rm -f /etc/xl2tpd/xl2tpd.conf
  234. cat >>/etc/xl2tpd/xl2tpd.conf<<EOF
  235. ;
  236. ; This is a minimal sample xl2tpd configuration file for use
  237. ; with L2TP over IPsec.
  238. ;
  239. ; The idea is to provide an L2TP daemon to which remote Windows L2TP/IPsec
  240. ; clients connect. In this example, the internal (protected) network
  241. ; is 192.168.1.0/24.  A special IP range within this network is reserved
  242. ; for the remote clients: 192.168.1.128/25
  243. ; (i.e. 192.168.1.128 ... 192.168.1.254)
  244. ;
  245. ; The listen-addr parameter can be used if you want to bind the L2TP daemon
  246. ; to a specific IP address instead of to all interfaces. For instance,
  247. ; you could bind it to the interface of the internal LAN (e.g. 192.168.1.98
  248. ; in the example below). Yet another IP address (local ip, e.g. 192.168.1.99)
  249. ; will be used by xl2tpd as its address on pppX interfaces.
  250. [global]
  251. ; ipsec saref = yes
  252. listen-addr = $serverip
  253. auth file = /etc/ppp/chap-secrets
  254. port = 1701
  255. [lns default]
  256. ip range = $iprange.10-$iprange.199
  257. local ip = $iprange.1
  258. refuse chap = yes
  259. refuse pap = yes
  260. require authentication = yes
  261. name = L2TPVPN
  262. ppp debug = yes
  263. pppoptfile = /etc/ppp/options.xl2tpd
  264. length bit = yes
  265. EOF
  267. #创建options.pptpd配置文件
  268. mkdir -p /etc/ppp
  269. rm -f /etc/ppp/options.pptpd
  270. cat >>/etc/ppp/options.pptpd<<EOF
  271. # Authentication
  272. name pptpd
  273. #chapms-strip-domain
  274. # Encryption
  275. # BSD licensed ppp-2.4.2 upstream with MPPE only, kernel module ppp_mppe.o
  276. # {{{
  277. refuse-pap
  278. refuse-chap
  279. refuse-mschap
  280. # Require the peer to authenticate itself using MS-CHAPv2 [Microsoft
  281. # Challenge Handshake Authentication Protocol, Version 2] authentication.
  282. require-mschap-v2
  283. # Require MPPE 128-bit encryption
  284. # (note that MPPE requires the use of MSCHAP-V2 during authentication)
  285. require-mppe-128
  286. # }}}
  287. # OpenSSL licensed ppp-2.4.1 fork with MPPE only, kernel module mppe.o
  288. # {{{
  289. #-chap
  290. #-chapms
  291. # Require the peer to authenticate itself using MS-CHAPv2 [Microsoft
  292. # Challenge Handshake Authentication Protocol, Version 2] authentication.
  293. #+chapms-v2
  294. # Require MPPE encryption
  295. # (note that MPPE requires the use of MSCHAP-V2 during authentication)
  296. #mppe-40    # enable either 40-bit or 128-bit, not both
  297. #mppe-128
  298. #mppe-stateless
  299. # }}}
  300. ms-dns 8.8.4.4
  301. ms-dns 8.8.8.8
  302. #ms-wins 10.0.0.3
  303. #ms-wins 10.0.0.4
  304. proxyarp
  305. #10.8.0.100
  306. # Logging
  307. #debug
  308. #dump
  309. lock
  310. nobsdcomp
  311. novj
  312. novjccomp
  313. nologfd
  314. EOF
  316. #创建options.xl2tpd配置文件
  317. rm -f /etc/ppp/options.xl2tpd
  318. cat >>/etc/ppp/options.xl2tpd<<EOF
  319. #require-pap
  320. #require-chap
  321. #require-mschap
  322. ipcp-accept-local
  323. ipcp-accept-remote
  324. require-mschap-v2
  325. ms-dns 8.8.8.8
  326. ms-dns 8.8.4.4
  327. asyncmap 0
  328. auth
  329. crtscts
  330. lock
  331. hide-password
  332. modem
  333. debug
  334. name l2tpd
  335. proxyarp
  336. lcp-echo-interval 30
  337. lcp-echo-failure 4
  338. mtu 1400
  339. noccp
  340. connect-delay 5000
  341. # To allow authentication against a Windows domain EXAMPLE, and require the
  342. # user to be in a group "VPN Users". Requires the samba-winbind package
  343. # require-mschap-v2
  344. # plugin winbind.so
  345. # ntlm_auth-helper '/usr/bin/ntlm_auth --helper-protocol=ntlm-server-1 --require-membership-of="EXAMPLE\VPN Users"'
  346. # You need to join the domain on the server, for example using samba:
  347. # //rootmanager.com/ubuntu-ipsec-l2tp-windows-domain-auth/setting-up-openswan-xl2tpd-with-native-windows-clients-lucid.html
  348. EOF
  350. #创建chap-secrets配置文件，即用户列表及密码
  351. rm -f /etc/ppp/chap-secrets
  352. cat >>/etc/ppp/chap-secrets<<EOF
  353. # Secrets for authentication using CHAP
  354. # client     server     secret               IP addresses
  355. $username          pptpd     $password               *
  356. $username          l2tpd     $password               *
  357. EOF
  359. ServerIP: 47.93.56.87
  360. username: ueibo.com
  361. password: K872ozFAY5
  362. PSK: ueibo.cn
  365. #修改系统配置，允许IP转发
  366. sysctl -w net.ipv4.ip_forward=1
  367. sysctl -w net.ipv4.conf.all.rp_filter=0
  368. sysctl -w net.ipv4.conf.default.rp_filter=0
  369. sysctl -w net.ipv4.conf.$eth.rp_filter=0
  370. sysctl -w net.ipv4.conf.all.send_redirects=0
  371. sysctl -w net.ipv4.conf.default.send_redirects=0
  372. sysctl -w net.ipv4.conf.all.accept_redirects=0
  373. sysctl -w net.ipv4.conf.default.accept_redirects=0
  375. cat >>/etc/sysctl.conf<<EOF
  376. net.ipv4.ip_forward = 1
  377. net.ipv4.conf.all.rp_filter = 0
  378. net.ipv4.conf.default.rp_filter = 0
  379. net.ipv4.conf.$eth.rp_filter = 0
  380. net.ipv4.conf.all.send_redirects = 0
  381. net.ipv4.conf.default.send_redirects = 0
  382. net.ipv4.conf.all.accept_redirects = 0
  383. net.ipv4.conf.default.accept_redirects = 0
  384. EOF
  386. #允许防火墙端口
  387. cat >>/usr/lib/firewalld/services/pptpd.xml<<EOF
  388. <?xml version="1.0" encoding="utf-8"?>
  389. <service>
  390.   <short>pptpd</short>
  391.   <description>PPTP and Fuck the GFW</description>
  392.   <port protocol="tcp" port="1723"/>
  393. </service>
  394. EOF
  396. cat >>/usr/lib/firewalld/services/l2tpd.xml<<EOF
  397. <?xml version="1.0" encoding="utf-8"?>
  398. <service>
  399.   <short>l2tpd</short>
  400.   <description>L2TP IPSec</description>
  401.   <port protocol="udp" port="500"/>
  402.   <port protocol="udp" port="4500"/>
  403.   <port protocol="udp" port="1701"/>
  404. </service>
  405. EOF
  407. #centos7.0版本的防火墙
  408. #systemctl start firewalld
  409. #firewall-cmd --reload
  410. #firewall-cmd --permanent --add-service=pptpd
  411. #firewall-cmd --permanent --add-service=l2tpd
  412. #firewall-cmd --permanent --add-service=ipsec
  413. #firewall-cmd --permanent --add-masquerade
  414. #firewall-cmd --permanent --direct --add-rule ipv4 filter FORWARD 0 -p tcp -i ppp+ -j TCPMSS --syn --set-mss 1356
  415. #firewall-cmd --reload
  417. #centos7.0以下版本的防火墙
  418. iptables --table nat --append POSTROUTING --jump MASQUERADE
  419. iptables -t nat -A POSTROUTING -s $iprange.0/24 -o $eth -j MASQUERADE
  420. iptables -t nat -A POSTROUTING -s $iprange.0/24 -j SNAT --to-source $serverip
  421. iptables -I FORWARD -p tcp –syn -i ppp+ -j TCPMSS –set-mss 1356
  422. service iptables save
  424. #允许开机启动
  425. systemctl enable pptpd ipsec xl2tpd
  426. systemctl restart pptpd ipsec xl2tpd
  427. clear
  429. #测试ipsec
  430. ipsec verify
  432. printf "
  433. #############################################################
  434. #                                                           #
  435. # This is a PPTP and L2TP VPN installation for CentOS 7     #
  436. # Version: 1.1.1 20160507                                   #
  437. # Author: Bon Hoo                                           #
  438. # Website: //www.ccwebsite.com                         #
  439. #                                                           #
  440. #############################################################
  441. if there are no [FAILED] above, then you can
  442. connect to your L2TP VPN Server with the default
  443. user/password below:
  444. ServerIP: $serverip
  445. username: $username
  446. password: $password
  447. PSK: $mypsk
  448. "

把以上代码放在shell文件中,执行!



关注TinyMeng博客，更多精彩分享，敬请期待！
 

很赞哦！ ()

上一篇：Docker这个新软件究竟是用来干嘛的？？？

下一篇：在Liunx上安装Java环境JDK

相关文章

友情链接