☰

먼저 머신을 업데이트하고 정리하세요.

tag-icon • tag-icon 18.04 vpn ipsec
먼저 머신을 업데이트하고 정리하세요.

인터넷에서 찾은 튜토리얼에 따라 시스템을 설정했습니다.

기본적으로 필요한 종속성을 설치했습니다.

sudo apt install network-manager 
sudo apt install network-manager-l2tp
sudo apt install network-manager-strongswan

그리고 다음 파일에 변경 사항을 적용하여 구성했습니다. (VPN_SERVER_IP, VPN_IPSEC_PSK, VPN_USERNAME, VPN_PASSWORD는 실제 값으로 대체됩니다. 아래 로그의 XXX.XXX.XXX.XXX는 VPN 서버의 IP 주소입니다.)

/etc/ipsec.conf:

conn %default
  ikelifetime=60m
  keylife=20m
  rekeymargin=3m
  keyingtries=1
  keyexchange=ikev1
  authby=secret
  ike=aes128-sha1-modp1024,3des-sha1-modp1024!
  esp=aes128-sha1-modp1024,3des-sha1-modp1024!

conn myvpn
  keyexchange=ikev1
  left=%defaultroute
  auto=add
  authby=secret
  type=transport
  leftprotoport=17/1701
  rightprotoport=17/1701
  right=$VPN_SERVER_IP

/etc/ipsec.secrets:

: PSK "$VPN_IPSEC_PSK"

/etc/xl2tpd/xl2tpd.conf:

[lac myvpn]
lns = $VPN_SERVER_IP
ppp debug = yes
pppoptfile = /etc/ppp/options.l2tpd.client
length bit = yes

/etc/ppp/options.l2tpd.client:

ipcp-accept-local
ipcp-accept-remote
refuse-eap
require-chap
noccp
noauth
mtu 1280
mru 1280
noipdefault
defaultroute
usepeerdns
debug
lock
connect-delay 5000
name $VPN_USERNAME
password $VPN_PASSWORD

/etc/NetworkManager/NetworkManager.conf(기본값, 변경된 사항 없음):

[main]
plugins=ifupdown,keyfile

[ifupdown]
managed=false

[device]
wifi.scan-rand-mac-address=no

VPN에 연결하려고 하면 /etc/init.d/network-manager start로그에 특별한 내용이 표시되지 않습니다.

ifupdown configuration found.
<info>  [1559053123.4216] devices added (path: /sys/devices/virtual/net/lo, iface: lo)
<info>  [1559053123.4216] device added (path: /sys/devices/virtual/net/lo, iface: lo): no ifupdown configuration found.
<info>  [1559053123.4216] end _init.
<info>  [1559053123.4216] settings: loaded plugin ifupdown: (C) 2008 Canonical Ltd.  To report bugs please use the NetworkManager mailing list. (/usr/lib/x86_64-linux-gnu/NetworkManager/libnm-settings-plugin-ifupdown.so)
<info>  [1559053123.4217] settings: loaded plugin keyfile: (c) 2007 - 2016 Red Hat, Inc.  To report bugs please use the NetworkManager mailing list.
May 28 16:18:43 phenom nm-dispatcher: req:1 'hostname': new request (1 scripts)
<info>  [1559053123.4217] (735157440) ... get_connections.
May 28 16:18:43 phenom nm-dispatcher: req:1 'hostname': start running ordered scripts...
<info>  [1559053123.4217] (735157440) ... get_connections (managed=false): return empty list.
<info>  [1559053123.4218] get unmanaged devices count: 0
<info>  [1559053123.4218] manager: rfkill: WiFi enabled by radio killswitch; enabled by state file
<info>  [1559053123.4218] manager: rfkill: WWAN enabled by radio killswitch; enabled by state file
<info>  [1559053123.4218] manager: Networking is enabled by state file
<info>  [1559053123.4219] dhcp-init: Using DHCP client 'dhclient'
<info>  [1559053123.4220] Loaded device plugin: NMBondDeviceFactory (internal)
<info>  [1559053123.4220] Loaded device plugin: NMBridgeDeviceFactory (internal)
<info>  [1559053123.4220] Loaded device plugin: NMDummyDeviceFactory (internal)
<info>  [1559053123.4220] Loaded device plugin: NMEthernetDeviceFactory (internal)
<info>  [1559053123.4220] Loaded device plugin: NMInfinibandDeviceFactory (internal)
<info>  [1559053123.4221] Loaded device plugin: NMIPTunnelDeviceFactory (internal)
<info>  [1559053123.4221] Loaded device plugin: NMMacsecDeviceFactory (internal)
<info>  [1559053123.4221] Loaded device plugin: NMMacvlanDeviceFactory (internal)
<info>  [1559053123.4221] Loaded device plugin: NMPppDeviceFactory (internal)
<info>  [1559053123.4221] Loaded device plugin: NMTunDeviceFactory (internal)
<info>  [1559053123.4221] Loaded device plugin: NMVethDeviceFactory (internal)
<info>  [1559053123.4221] Loaded device plugin: NMVlanDeviceFactory (internal)
<info>  [1559053123.4222] Loaded device plugin: NMVxlanDeviceFactory (internal)
<info>  [1559053123.4229] Loaded device plugin: NMWwanFactory (/usr/lib/x86_64-linux-gnu/NetworkManager/libnm-device-plugin-wwan.so)
<info>  [1559053123.4234] Loaded device plugin: NMBluezManager (/usr/lib/x86_64-linux-gnu/NetworkManager/libnm-device-plugin-bluetooth.so)
<info>  [1559053123.4236] Loaded device plugin: NMWifiFactory (/usr/lib/x86_64-linux-gnu/NetworkManager/libnm-device-plugin-wifi.so)
<info>  [1559053123.4242] Loaded device plugin: NMTeamFactory (/usr/lib/x86_64-linux-gnu/NetworkManager/libnm-device-plugin-team.so)
<info>  [1559053123.4244] Loaded device plugin: NMAtmManager (/usr/lib/x86_64-linux-gnu/NetworkManager/libnm-device-plugin-adsl.so)
<info>  [1559053123.4252] device (lo): carrier: link connected
<info>  [1559053123.4258] manager: (lo): new Generic device (/org/freedesktop/NetworkManager/Devices/1)
<info>  [1559053123.4262] device (enp5s0): carrier: link connected
<info>  [1559053123.4285] manager: (enp5s0): new Ethernet device (/org/freedesktop/NetworkManager/Devices/2)
<info>  [1559053123.4335] modem-manager: ModemManager available
<info>  [1559053123.4336] manager: startup complete

ipsec up myvpn또한 성공한 것 같습니다.

initiating Main Mode IKE_SA myvpn[1] to 82.161.237.247
generating ID_PROT request 0 [ SA V V V V V ]
sending packet: from 192.168.10.56[500] to 82.161.237.247[500] (212 bytes)
received packet: from 82.161.237.247[500] to 192.168.10.56[500] (136 bytes)
parsed ID_PROT response 0 [ SA V V V ]
received XAuth vendor ID
received DPD vendor ID
received NAT-T (RFC 3947) vendor ID
generating ID_PROT request 0 [ KE No NAT-D NAT-D ]
sending packet: from 192.168.10.56[500] to 82.161.237.247[500] (244 bytes)
received packet: from 82.161.237.247[500] to 192.168.10.56[500] (244 bytes)
parsed ID_PROT response 0 [ KE No NAT-D NAT-D ]
local host is behind NAT, sending keep alives
generating ID_PROT request 0 [ ID HASH N(INITIAL_CONTACT) ]
sending packet: from 192.168.10.56[4500] to 82.161.237.247[4500] (108 bytes)
received packet: from 82.161.237.247[4500] to 192.168.10.56[4500] (76 bytes)
parsed ID_PROT response 0 [ ID HASH ]
IKE_SA myvpn[1] established between 192.168.10.56[192.168.10.56]...82.161.237.247[82.161.237.247]
scheduling reauthentication in 3420s
maximum IKE_SA lifetime 3600s
generating QUICK_MODE request 1511457566 [ HASH SA No KE ID ID NAT-OA NAT-OA ]
sending packet: from 192.168.10.56[4500] to 82.161.237.247[4500] (364 bytes)
received packet: from 82.161.237.247[4500] to 192.168.10.56[4500] (332 bytes)
parsed QUICK_MODE response 1511457566 [ HASH SA No KE ID ID NAT-OA NAT-OA ]
CHILD_SA myvpn{1} established with SPIs c970ab39_i cf32f312_o and TS 192.168.10.56/32[udp/l2f] === 82.161.237.247/32[udp/l2f]
generating QUICK_MODE request 1511457566 [ HASH ]
sending packet: from 192.168.10.56[4500] to 82.161.237.247[4500] (60 bytes)
connection 'myvpn' established successfully

그래서 일반적으로 오류가 없는 것처럼 보이지만 실제로 연결했는지 여부는 확인할 수 없습니다. 가장 큰 문제는 다음을 실행할 때 ppp0 장치가 표시되지 않는다는 것입니다 ip link.

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: enp5s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP mode DEFAULT group default qlen 1000
    link/ether 6c:f0:49:70:55:16 brd ff:ff:ff:ff:ff:ff

따라서 어떤 트래픽이 VPN 서버를 통과해야 하는지 정의할 수 없습니다. ppp0 장치가 표시되고 IP 주소가 DHCP/VPN 서버에 의해 할당되었는지 어떻게 확인할 수 있나요?

답변1

echo "c myvpn" > /var/run/xl2tpd/l2tp-control루트로 실행하면 ppp0 인터페이스가 생성되어야 합니다. 구성 파일을 일부 변경했으며 이 명령을 실행했을 때 lock옵션을 /etc/ppp/options.l2tpd.client알 수 없다는 로그를 발견했습니다( 에서 /var/log/syslog). lock구성 파일에서 제거했는데 이제 작동합니다.

내 현재 구성이 아래에 붙여져 있습니다.

/etc/ipsec.conf:

config setup

conn %default
  ikelifetime=60m
  keylife=20m
  rekeymargin=3m
  keyingtries=1
  keyexchange=ikev1
  authby=secret
  ike=aes128-sha1-modp1024,3des-sha1-modp1024!
  esp=aes128-sha1-modp1024,3des-sha1-modp1024!

conn myvpn
  keyexchange=ikev1
  left=%defaultroute
  auto=add
  authby=secret
  rekey=no
  type=transport
  left=%any
  leftprotoport=17/1701
  rightprotoport=17/1701
  right=VPN_SERVER
  rightid=%any
  dpdaction=clear

/etc/xl2tpd/xl2tpd.conf:

[lac myvpn]
lns = VPN_SERVER
require chap = yes
refuse pap = yes
require authentication = yes
name = VPN_USER
ppp debug = yes
pppoptfile = /etc/ppp/options.l2tpd.client
length bit = yes

/etc/ppp/options.l2tpd.client:

ipcp-accept-local
ipcp-accept-remote
require-chap
#refuse-chap
refuse-eap
refuse-pap
require-mschap
require-mschap-v2
noccp
noauth
idle 1800
mtu 1410
mru 1410
nodefaultroute
usepeerdns
debug
connect-delay 5000
name VPN_USER
password VPN_USER_PASSWORD
remotename myvpn
ipparam myvpn

/etc/네트워크/인터페이스:

iface tunnel inet ppp
provider myvpn

결과:

~# ifconfig
enp5s0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.10.56  netmask 255.255.255.0  broadcast 192.168.10.255
        inet6 fe80::6ef0:49ff:fe70:5516  prefixlen 64  scopeid 0x20<link>
        ether 6c:f0:49:70:55:16  txqueuelen 1000  (Ethernet)
        RX packets 822593  bytes 135972174 (135.9 MB)
        RX errors 0  dropped 31185  overruns 0  frame 0
        TX packets 854688  bytes 150862324 (150.8 MB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1000  (Local Loopback)
        RX packets 70050  bytes 5703649 (5.7 MB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 70050  bytes 5703649 (5.7 MB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

ppp0: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST>  mtu 1410
        inet 192.168.60.1  netmask 255.255.255.255  destination 10.255.255.0
        ppp  txqueuelen 3  (Point-to-Point Protocol)
        RX packets 3  bytes 54 (54.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 3  bytes 54 (54.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

답변2

Meraki 라우터용 Ubuntu 18.04 LTS의 경우 기본적으로 따랐습니다.https://help.vpntunnel.com/support/solutions/articles/5000782608-vpntunnel-l2tp-installation-guide-for-ubuntu-18-04-

먼저 머신을 업데이트하고 정리하세요.

sudo apt-get update
sudo apt-get dist-upgrade
sudo reboot
# Wait for reboot, log back in
sudo apt autoremove

VPN 소프트웨어 설치

sudo apt-get install strongswan xl2tpd net-tools
sudo apt-get install network-manager-l2tp network-manager-l2tp-gnome
sudo apt-get install network-manager-strongswan
sudo reboot

재부팅 후 L2TP 서버를 끄십시오. 클라이언트만 필요합니다.

sudo service xl2tpd stop
sudo systemctl disable xl2tpd

VPN 지침을 설정합니다.

Settings -> Network -> VPN - > "+"
Details:
Make available to other users, check (if desired)
Identity:
Name: Make a description
Gateway: the IP address (or dyn dns name from the meraki page)
User Name:  [email protected]
Password: Leave blank, will prompt
NT Domain: <blank>
IPSec Settings:
Enable IpSec tunnel to L2TP host: check
Pre-Shared Key:  Get from the meraki setup page
Phase1 Algorithms: 3des-sha1-modp1024
Phase2 Algorithms: aes128-sha1
Enforce UDP encap: <un checked>
PPP Settings:  Default

그런 다음 GUI에서 연결하십시오.

관련 정보