• AWS亚马逊服务器搭建VPN

    一、AWS EC2搭建L2TP/IPSec VPN服务器

    AWS针对新注册的用户提供一年免费EC2服务。Amazon EC2有一定限制，一个月流量限制不超过15G。
    设置提醒，防止超出限制多扣费。
    关于IPsec VPN可参考：https://github.com/hwdsl2/setup-ipsec-vpn/blob/master/README-zh.md

    二、AWS亚马逊服务器搭建VPN

    来源：AWS亚马逊服务器搭建VPN - ACE VPN

    以前在免费的亚马逊服务器上搭建过Shadowsocks程序，稳定性和速度还算不错，但也有局限性，比如 Bash终端无法翻墙搭建vpn服务器，部分不支持大理的软件无法翻墙出去，所以就打算在服务器上在搭建一个VPN。

    目前可用的开源VPN服务器端有IPSec、L2TP/IPSec和PPTP。PPTP由于安全性等因素已被IOS抛弃，所以打算安装L2TP/IPSec。L2TP/IPSec的安装和Shadowsocks相比较为简单，但要使用配置起来要比Shadowsocks繁琐了很多。

    安装

    服务器环境：

    亚马逊免费服务器 Ubuntu12.04

    安装必备的软件包搭建vpn服务器，L2TP/IPSec所需要的就三个软件，命令搞定：

    sudo apt-get install openswan ppp xl2tpd

    配置1.修改Ipsec的配置文件

    打开配置文件

    sudo vim  /etc/ipsec.conf

    修改配置文件

    1. # /etc/ipsec.conf - Openswan IPsec configuration file
    2. # This file:  /usr/share/doc/openswan/ipsec.conf-sample
    3. #
    4. # Manual:     ipsec.conf.5
    5. version 2.0     # conforms to second version of ipsec.conf specification
    6. # basic configuration
    7. config setup
    8.     # Do not set debug options to debug configuration issues!
    9.     # plutodebug / klipsdebug = "all", "none" or a combation from below:
    10.     # "raw crypt parsing emitting control klips pfkey natt x509 dpd private"
    11.     # eg:
    12.     # plutodebug="control parsing"
    13.     # Again: only enable plutodebug or klipsdebug when asked by a developer
    14.     #
    15.     # enable to get logs per-peer
    16.     # plutoopts="--perpeerlog"
    17.     #
    18.     # Enable core dumps (might require system changes, like ulimit -C)
    19.     # This is required for abrtd to work properly
    20.     # Note: incorrect SElinux policies might prevent pluto writing the core
    21.     dumpdir=/var/run/pluto/
    22.     #
    23.     # NAT-TRAVERSAL support, see README.NAT-Traversal
    24.     nat_traversal=yes
    25.     # exclude networks used on server side by adding %v4:!a.b.c.0/24
    26.     # It seems that T-Mobile in the US and Rogers/Fido in Canada are
    27.     # using 25/8 as "private" address space on their 3G network.
    28.     # This range has not been announced via BGP (at least upto 2010-12-21)
    29.     virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:25.0.0.0/8,%v6:fd00::/8,%v6:fe80::/10
    30.     # OE is now off by default. Uncomment and change to on, to enable.
    31.     oe=off
    32.     # which IPsec stack to use. auto will try netkey, then klips then mast
    33.     protostack=netkey
    34.     # Use this to log to a file, or disable logging on embedded systems (like openwrt)
    35.     #plutostderrlog=/dev/null
    36. # Add connections here
    37. # sample VPN connection
    38. # for more examples, see /etc/ipsec.d/examples/
    39. #conn sample
    40. #               # Left security gateway, subnet behind it, nexthop toward right.
    41. #               left=10.0.0.1
    42. #               leftsubnet=172.16.0.0/24
    43. #               leftnexthop=10.22.33.44
    44. #               # Right security gateway, subnet behind it, nexthop toward left.
    45. #               right=10.12.12.1
    46. #               rightsubnet=192.168.0.0/24
    47. #               rightnexthop=10.101.102.103
    48. #               # To authorize this connection, but not actually start it, 
    49. #               # at startup, uncomment this.
    50. #               #auto=add
    51. conn L2TP-PSK-NAK
    52.      rightsubnet=vhost:%priv
    53.      also=L2TP-PAK-noNAT
    54. conn L2TP-PSK-noNAT
    55.      authby=secret
    56.      pfs=no
    57.      auto=add
    58.      keyingtries=3
    59.      rekey=no
    60.      ikelifetime=8h
    61.      keylife=1h
    62.      type=transport
    63.      left=*.*.*.*(此处填服务器内网地址)
    64.      leftprotoport=17/1701
    65.      right=%any
    66.      rightprotoport=17/%any
    67.      dpddelay=40
    68.      dpdtimeout=130
    69.      dpdaction=clear

    这份文件主要修改原来配置中的protostack=netkey

    以及加入conn L2TP-PSK-NAK和conn L2TP-PSK-noNAT的配置即可，注意left=…(此处填服务器内网地址)

    2.修改Ipsec的Secrets

    打开配置文件

    sudo vim /etc/ipsec.secrets

    修改配置文件

    1. # This file holds shared secrets or RSA private keys for inter-Pluto
    2. # authentication.  See ipsec_pluto(8) manpage, and HTML documentation.
    3. # RSA private key for this host, authenticating it to any other host
    4. # which knows the public part.  Suitable public keys, for ipsec.conf, DNS,
    5. # or configuration of other implementations, can be extracted conveniently
    6. # with "ipsec showhostkey".
    7. # this file is managed with debconf and will contain the automatically created RSA keys
    8. include /var/lib/openswan/ipsec.secrets.inc
    9. x.x.x.x(此处填你的服务器内网地址)  %any:  PSK "预共享密钥"

    ⚠️这份文件x.x.x.x处改成你的服务器内网地址，PSK后修改你自己的预共享密钥(需记住)，后续连接过程中要用

    3.关闭网卡部分功能

    由于IPSec工作时可能会与网络接口的send_redirects和accept_redirects功能相冲突，因此需要在启动IPSec前将网卡的这些功能关闭。运行：

    1. echo 0 > /proc/sys/net/ipv4/conf/eth0/send_redirects
    2. echo 0 > /proc/sys/net/ipv4/conf/eth0/accept_redirects

    这一步如果提示权限不足，建议 将指令写入 sh文件，sudo运行该文件即可。

    1. touch disableeth0.sh
    2. vim disableeth0.sh

    然后写入：

    1. #!/bin/bash
    2. # Disable send redirects
    3. echo 0 > /proc/sys/net/ipv4/conf/eth0/send_redirects
    4. echo 0 > /proc/sys/net/ipv4/conf/eth0/accept_redirects

    赋予可执行权限,并执行：

    1. chmod +x  disableeth0.sh
    2. ./disableeth0.sh

    4.重启ipsec服务并检查其是否正常工作

    执行

    1. sudo service ipsec restart
    2. sudo ipsec verify

    这时候你会看到程序自检了:

    1. Checking your system to see if IPsec got installed and started correctly:
    2. Version check and ipsec on-path                                 [OK]
    3. Linux Openswan U2.6.38/K3.13.0-92-generic (netkey)
    4. Checking for IPsec support in kernel                            [OK]
    5. SAref kernel support                                           [N/A]
    6. NETKEY:  Testing XFRM related proc values                      [OK]
    7.     [OK]
    8.     [OK]
    9. Checking that pluto is running                                  [OK]
    10. Pluto listening for IKE on udp 500                             [OK]
    11. Pluto listening for NAT-T on udp 4500                          [OK]
    12. Checking for 'ip' command                                       [OK]
    13. Checking /bin/sh is not /bin/dash                               [WARNING]
    14. Checking for 'iptables' command                                 [OK]
    15. Opportunistic Encryption Support                                [DISABLED]

    第三项、倒数第一项和第二项不用去理会，如果你的结果和我一样了，恭喜Ipsec的配置算是完成了，如果没有请仔细检查上述配置哪边没有配好。

    5.修改xl2tpd的配置文件

    打开配置文件：

    sudo vim /etc/xl2tpd/xl2tpd.conf

    在文件末尾添加：

    1. [global]
    2. ipsec saref = yes
    3. [lns default]
    4. ip range = x.x.x.x-x.x.x.x
    5. local ip = x.x.x.x
    6. refuse chap = yes
    7. refuse pap = yes
    8. require authentication = yes
    9. name = OpenswanVPN
    10. ppp debug = yes
    11. pppoptfile = /etc/ppp/options.xl2tpd
    12. length bit = yes

    其中

    local ip后面x.x.x.x处改成你的服务器内网地址

    ip range后面x.x.x.x-x.x.x.x处改成可使用的服务器内网ip地址段，如果你的服务器内网ip是 10.12.13.10，那此处你可填写 10.12.13.11-10.12.13.50，修改ip的末尾数字即可(不要把自己的ip段包含在内)

    6.修改ppp配置文件

    修改（新建）配置文件 /etc/ppp/options.xl2tpd

    sudo vim /etc/ppp/options.xl2tpd

    添加下列内容：

    1. require-mschap-v2
    2. ms-dns 8.8.8.8
    3. ms-dns 8.8.4.4
    4. auth
    5. mtu 1200
    6. mru 1000
    7. crtscts
    8. hide-password
    9. modem
    10. name l2tpd
    11. proxyarp

    7.设置vpn客户端用户名密码

    由于使用ms-chap-v2认证，修改配置文件 /etc/ppp/chap-secrets

    sudo vim /etc/ppp/chap-secrets

    格式如下：

    1. # client    server    secret            IP addresses
    2. 用户名       l2tpd      密码              *

    其中server和IP addresses不变，其余字段用户自定义，这是客户端用来连接的用户名密码

    8.开启ip转发

    打开配置文件

    sudo vim /etc/sysctl.conf

    在文件末尾添加

    1. net.ipv4.ip_forward = 1
    2. net.ipv4.conf.default.rp_filter = 0
    3. net.ipv4.conf.default.accept_source_route = 0
    4. net.ipv4.conf.all.send_redirects = 0
    5. net.ipv4.conf.default.send_redirects = 0
    6. net.ipv4.icmp_ignore_bogus_error_responses = 1

    9.加载系统配置

    命令行执行

    sysctl -p

    10.设置转发规则

    命令行执行

    iptables -t nat -A POSTROUTING -j MASQUERADE

    11.（非必需）修改启动脚本

    因为上述步骤，在系统重启后会被重置，因此可选在在启动脚本加入配置

    打开配置文件

    sudo vim /etc/rc.local

    在尾端添加

    1. iptables –table nat –append POSTROUTING –jump MASQUERADE
    2. echo 1 > /proc/sys/net/ipv4/ip_forward
    3. for each in /proc/sys/net/ipv4/conf/*
    4. do
    5. echo 0 > $each/accept_redirects
    6. echo 0 > $each/send_redirects
    7. done

    12.重启相关服务

    命令行执行

    1. /etc/init.d/pppd-dns restart
    2. sudo /etc/init.d/xl2tpd restart
    3. sudo /etc/init.d/ipsec restart

    13.客户端配置iphone配置如下

  • 相关阅读:
    Android Studio main,xml 视图&&代码转换
    nodejs+vue+elementui通用在线新闻发布网
    HTTPS基础原理和配置 - 1
    如何在Python中处理日期和时间相关问题
    asp毕业设计——基于C#+asp.net+sqlserver在线论文提交系统设计与实现（毕业论文+程序源码）——在线论文提交系统
    微服务架构整理-（十一、SpringCloud实战之OpenFeign）
    自动计算零售数据分析指标？BI软件表示可行
    基于骨骼数据特征的人体行为识别方法综述
    【HMS】地图标记聚合HWMarkerCluster支持设置聚合计算时网格的像素大小、最大的聚合级别
    想自学软件测试？一般人我还是劝你算了吧。。。
  • 原文地址：https://blog.csdn.net/bobohelloworld/article/details/136513611