zp blog-树莓派系列(十二)：树莓派VPN代理之搭建IKEv2服务器

树莓派系列(十二)：树莓派VPN代理之搭建IKEv2服务器

2016-11-29 浏览:7999

最近需要用到手机连接到家里的网络，由于IOS升级到10后不再对PPTP支持，所以只能重建VPN服务端了，之前搭建了L2TP但不知道是什么缘由在家能成功连接，端口也转发了，在外死活连不上，搁置了一段时间。前两天想着会不会是运营商那边的问题，索性先换个在试试吧。

服务端：

1、安装strongSwan及相关插件

$ apt-get install strongswan libcharon-extra-plugins

2、生成相关证书（根据需要更改国家（C），组织（O）和公用名（CN）。）

a) CA证书

$ cd /etc/ipsec.d/
$ ipsec pki --gen --type rsa --size 4096 --outform pem \
    > private/strongswan-key.pem
$ chmod 600 private/strongswan-key.pem
$ ipsec pki --self --ca \
    --lifetime 3650 \
    --in private/strongswan-key.pem \
    --type rsa \
    --dn "C=NZ, O=Example, CN=Example Root CA" \
    --outform pem \
    > cacerts/strongswan-certificate.pem

b) VPN 主机证书

$ cd /etc/ipsec.d/
$ ipsec pki --gen --type rsa --size 2048 --outform pem \
    > private/vpn-host-key.pem
$ chmod 600 private/vpn-host-key.pem
$ ipsec pki --pub --in private/vpn-host-key.pem --type rsa | \
    ipsec pki --issue --lifetime 730 \
    --cacert cacerts/strongswan-certificate.pem \
    --cakey private/strongswan-key.pem \
    --dn "C=NZ, O=Example, CN=vpn.example.com" \
    --san "vpn.example.com" \
    --flag serverAuth --flag ikeIntermediate \
    --outform pem > certs/vpn-host-certificate.pem

c) 客户端证书

$ cd /etc/ipsec.d/
$ ipsec pki --gen --type rsa --size 2048 --outform pem \
    > private/jason-key.pem
$ chmod 600 private/jason-key.pem
$ ipsec pki --pub --in private/jason-key.pem --type rsa | \
    ipsec pki --issue --lifetime 730 \
    --cacert cacerts/strongswan-certificate.pem \
    --cakey private/strongswan-key.pem \
    --dn "C=NZ, O=Example, [email protected]" \
    --san "[email protected]" \
    --outform pem > certs/jason-certificate.pem

d) 导出客户端证书（导出时需要设置个密码，记住这个密码，客户端安装证书时用的）

$ cd /etc/ipsec.d/
$ openssl pkcs12 -export -inkey private/jason-key.pem \
    -in certs/jason-certificate.pem \
    -name "Jason's VPN Certificate" \
    -certfile cacerts/strongswan-certificate.pem \
    -caname "Example Root CA" \
    -out certs/jason.p12

e)为了方便拷贝到客户端，先把用到的两个证书拷贝到主目录

$ cp /etc/ipsec.d/cacerts/strongswan-certificate.pem /home/pi
$ cp /etc/ipsec.d/certs/jason.p12 /home/pi

f)现在应该有以下六个证书文件：

/etc/ipsec.d/private/strongswan-key.pem         # CA private key
/etc/ipsec.d/cacerts/strongswan-certificate.pem # CA certificate
/etc/ipsec.d/private/vpn-host-key.pem           # VPN host private key
/etc/ipsec.d/certs/vpn-host-certificate.pem     # VPN host certificate
/etc/ipsec.d/private/jason-key.pem              # Client "Jason" private key
/etc/ipsec.d/certs/jason-certificate.pem        # Client "Jason" certificate

3、配置strongSwan

$ nano /etc/ipsec.conf

清空里面已有配置内容，替换成以下配置内容：

# ipsec.conf - strongSwan IPsec configuration file
config setup
charondebug="cfg 2, dmn 2, ike 2, net 2"
conn %default
	keyexchange=ikev2
	leftauth=pubkey
	left=%any
	leftid=vpn.example.com
	leftcert=vpn-host-certificate.pem
	leftsendcert=always
	leftsubnet=0.0.0.0/0
	right=%any
	rightsourceip=10.0.0.0/24
	rightdns=8.8.8.8,8.8.4.4
	dpdaction=clear
conn iOS
	[email protected]
	rightcert=jason-certificate.pem
	auto=add
conn windows7
	keyexchange=ikev2
	ike=aes256-sha1-modp1024!  # windows7的ikev2指定了DH group必须是modp1024
	leftid=vpn.example.com     # 服务器证书中指定的域名或者IP地址
	rekey=no
	left=%defaultroute         # 通告默认路由，作为网关
	leftauth=pubkey
	leftsubnet=0.0.0.0/0
	leftcert=vpn-host-certificate.pem
	right=%any
	rightauth=eap-mschapv2
	rightsourceip=10.8.0.0/24  # 分配给客户端ip的子网范围
	rightsendcert=never
	eap_identity=%any
	auto=add
include /var/lib/strongswan/ipsec.conf.inc

配置证书及账号密码

$ nano /etc/ipsec.secrets

# This file holds shared secrets or RSA private keys for authentication.
# RSA private key for this host, authenticating it to any other host
# which knows the public part.
# this file is managed with debconf and will contain the automatically created $
include /var/lib/strongswan/ipsec.secrets.inc
: RSA vpn-host-key.pem
ThisIsYourUserName : EAP "ThisIsYourPasswd"

$ ipsec rereadsecrets

4、配置转发

$ nano /etc/sysctl.conf

修改或添加以下内容

net.ipv4.ip_forward=1
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0

立即生效

$ sysctl -p

5、配置防火墙（在此之前最好重启一下系统）

$ iptables -t nat -A POSTROUTING -o eth0 ! -p esp -j SNAT --to-source 192.168.1.3
$ iptables -A INPUT -p udp --dport 500 -j ACCEPT
$ iptables -A INPUT -p udp --dport 4500 -j ACCEPT
$ iptables -A INPUT -p esp -j ACCEPT
$ iptables-save > /etc/iptables.conf
$ echo "post-up iptables-restore < /etc/iptables.conf" >> /etc/network/interfaces

记得在路由器上转发UDP端口500和4500。

重启strongSwan