☰

18.04 L2TP VPN 구성 - 무엇이 빠졌나요?

tag-icon • tag-icon networking 18.04 network-manager vpn ipsec
18.04 L2TP VPN 구성 - 무엇이 빠졌나요?

저는 L2TP VPN 서버에 연결하기 위해 Ubuntu 노트북을 얻으려고 노력해 왔으며 기본적으로 설치 network-manager-l2tp및 설치에 관한 몇 가지 튜토리얼에 따라 18.04와 19.04를 모두 사용해 보았습니다.network-manager-l2tp-gnome . 나는 이 지점에 도달했습니다:

May 17 12:34:14 lap-linux-001 NetworkManager[583]: <info>  [1558110854.8704] audit: op="connection-activate" uuid="2dba1ee5-c86e-46e9-b0e4-5ce89738d380" name="ADS" pid=1509 uid=1000 result="success"
May 17 12:34:14 lap-linux-001 NetworkManager[583]: <info>  [1558110854.8758] vpn-connection[0x5603ef4be7a0,2dba1ee5-c86e-46e9-b0e4-5ce89738d380,"ADS",0]: Started the VPN service, PID 8635
May 17 12:34:14 lap-linux-001 NetworkManager[583]: <info>  [1558110854.8878] vpn-connection[0x5603ef4be7a0,2dba1ee5-c86e-46e9-b0e4-5ce89738d380,"ADS",0]: Saw the service appear; activating connection
May 17 12:34:18 lap-linux-001 systemd[1]: NetworkManager-dispatcher.service: Succeeded.
May 17 12:34:19 lap-linux-001 NetworkManager[583]: <info>  [1558110859.3039] settings-connection[0x5603ef3ae480,2dba1ee5-c86e-46e9-b0e4-5ce89738d380]: write: successfully updated (keyfile: update /etc/NetworkManager/system-connections/ADS.nmconnection (2dba1ee5-c86e-46e9-b0e4-5ce89738d380,"ADS")), connection was modified in the process
May 17 12:34:19 lap-linux-001 NetworkManager[583]: <info>  [1558110859.3085] vpn-connection[0x5603ef4be7a0,2dba1ee5-c86e-46e9-b0e4-5ce89738d380,"ADS",0]: VPN connection: (ConnectInteractive) reply received
May 17 12:34:19 lap-linux-001 nm-l2tp-service[8635]: Check port 1701
May 17 12:34:19 lap-linux-001 nm-l2tp-service[8635]: Can't bind to port 1701
May 17 12:34:19 lap-linux-001 NetworkManager[583]: Stopping strongSwan IPsec failed: starter is not running
May 17 12:34:21 lap-linux-001 NetworkManager[583]: Starting strongSwan 5.7.1 IPsec [starter]...
May 17 12:34:21 lap-linux-001 NetworkManager[583]: Loading config setup
May 17 12:34:21 lap-linux-001 NetworkManager[583]: Loading conn '2dba1ee5-c86e-46e9-b0e4-5ce89738d380'
May 17 12:34:21 lap-linux-001 NetworkManager[583]: found netkey IPsec stack
May 17 12:34:21 lap-linux-001 charon: 00[DMN] Starting IKE charon daemon (strongSwan 5.7.1, Linux 5.0.0-13-generic, x86_64)
May 17 12:34:21 lap-linux-001 charon: 00[CFG] loading ca certificates from '/etc/ipsec.d/cacerts'
May 17 12:34:21 lap-linux-001 charon: 00[CFG] loading aa certificates from '/etc/ipsec.d/aacerts'
May 17 12:34:21 lap-linux-001 charon: 00[CFG] loading ocsp signer certificates from '/etc/ipsec.d/ocspcerts'
May 17 12:34:21 lap-linux-001 charon: 00[CFG] loading attribute certificates from '/etc/ipsec.d/acerts'
May 17 12:34:21 lap-linux-001 charon: 00[CFG] loading crls from '/etc/ipsec.d/crls'
May 17 12:34:21 lap-linux-001 charon: 00[CFG] loading secrets from '/etc/ipsec.secrets'
May 17 12:34:21 lap-linux-001 charon: 00[CFG] loading secrets from '/etc/ipsec.d/nm-l2tp-ipsec-2dba1ee5-c86e-46e9-b0e4-5ce89738d380.secrets'
May 17 12:34:21 lap-linux-001 charon: 00[CFG]   loaded IKE secret for %any
May 17 12:34:21 lap-linux-001 charon: 00[LIB] loaded plugins: charon aesni aes rc2 sha2 sha1 md4 md5 mgf1 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem openssl fips-prf gmp agent xcbc hmac gcm attr kernel-netlink resolve socket-default connmark stroke updown eap-mschapv2 xauth-generic counters
May 17 12:34:21 lap-linux-001 charon: 00[LIB] dropped capabilities, running as uid 0, gid 0
May 17 12:34:21 lap-linux-001 charon: 00[JOB] spawning 16 worker threads
May 17 12:34:21 lap-linux-001 charon: 06[CFG] received stroke: add connection '2dba1ee5-c86e-46e9-b0e4-5ce89738d380'
May 17 12:34:21 lap-linux-001 charon: 06[CFG] algorithm 'ecp_384' not recognized
May 17 12:34:21 lap-linux-001 charon: 06[CFG] skipped invalid proposal string: aes256-sha1-ecp_384
May 17 12:34:22 lap-linux-001 charon: 08[CFG] rereading secrets
May 17 12:34:22 lap-linux-001 charon: 08[CFG] loading secrets from '/etc/ipsec.secrets'
May 17 12:34:22 lap-linux-001 charon: 08[CFG] loading secrets from '/etc/ipsec.d/nm-l2tp-ipsec-2dba1ee5-c86e-46e9-b0e4-5ce89738d380.secrets'
May 17 12:34:22 lap-linux-001 charon: 08[CFG]   loaded IKE secret for %any
May 17 12:34:22 lap-linux-001 charon: 09[CFG] received stroke: initiate '2dba1ee5-c86e-46e9-b0e4-5ce89738d380'
May 17 12:34:22 lap-linux-001 charon: 09[CFG] no config named '2dba1ee5-c86e-46e9-b0e4-5ce89738d380'
May 17 12:34:22 lap-linux-001 NetworkManager[583]: no config named '2dba1ee5-c86e-46e9-b0e4-5ce89738d380'
May 17 12:34:22 lap-linux-001 NetworkManager[583]: Stopping strongSwan IPsec...
May 17 12:34:22 lap-linux-001 charon: 00[DMN] signal of type SIGINT received. Shutting down
May 17 12:34:22 lap-linux-001 nm-l2tp-service[8635]: g_dbus_method_invocation_take_error: assertion 'error != NULL' failed
May 17 12:34:22 lap-linux-001 NetworkManager[583]: <info>  [1558110862.8278] vpn-connection[0x5603ef4be7a0,2dba1ee5-c86e-46e9-b0e4-5ce89738d380,"ADS",0]: VPN plugin: state changed: stopped (6)
May 17 12:34:22 lap-linux-001 NetworkManager[583]: <info>  [1558110862.8313] vpn-connection[0x5603ef4be7a0,2dba1ee5-c86e-46e9-b0e4-5ce89738d380,"ADS",0]: VPN service disappeared
May 17 12:34:22 lap-linux-001 NetworkManager[583]: <warn>  [1558110862.8326] vpn-connection[0x5603ef4be7a0,2dba1ee5-c86e-46e9-b0e4-5ce89738d380,"ADS",0]: VPN connection: failed to connect: 'Message recipient disconnected from message bus without replying'

또한 Fedora에서 연결이 작동하도록 할 수 있었기 때문에 올바른 구성 옵션을 사용하고 있다고 확신하지만 Ubuntu 측에서는 PFS를 비활성화하는 옵션조차 표시되지 않습니다.

내가 읽은 내용에 따르면 존재하지 않는 구성을 찾고 있는 것 같나요? 하지만 어디에 넣기/생성/추가하기를 원하는지 잘 모르겠습니다. 어쩌면 ipsec.conf일까요? 하지만 문자열은 내가 본 다른 어떤 예와도 닮지 않았습니다.

저는 Linux에 대한 경험이 많지 않지만 VPN에 개입한 것은 이번이 처음입니다. 읽어주셔서 감사합니다. 어떤 도움이라도 주시면 감사하겠습니다.

답변1

IPsec VPN을 작동시키는 데 필요한 단계를 알려드릴 수 있습니다(18.04).

sudo apt install strongswan

그런 다음 libcharon-extra-plugins 및 libstrongswan-extra-plugins를 설치하십시오. 저는 시냅틱 패키지 관리자를 사용하여 이 작업을 수행했습니다. 모듈 eap-identity에는 이것이 필요했습니다. VPN 설정에 따라 올바른 /etc/ipsec.conf를 생성합니다. ipsec.secrets 생성 또는 수정

몇 가지 추가 단계가 필요했지만 이는 VPN에 따라 다를 수 있습니다.

  • /etc/strongswan.d/charon/constraints.conf에서 'load = yes'를 'load = no'로 변경합니다.

  • 인증서 변경

      sudo rmdir /etc/ipsec.d/cacerts  (maybe make a backup first)
  sudo ln -s /etc/ssl/certs /etc/ipsec.d/cacerts

  • 개인적으로 VPN 중 DNS 작업을 위해 다음이 필요합니다.

      sudo apt install resolvconf
  sudo dpkg-reconfigure resolvconf
  reboot

마지막으로 :

    sudo ipsec restart
    sudo ipsec up <vpn-name>

이것이 당신에게 조금 더 도움이 되기를 바랍니다.

관련 정보