{"id":425,"date":"2012-12-26T10:07:10","date_gmt":"2012-12-26T03:07:10","guid":{"rendered":"http:\/\/blog.trichev.com\/?p=425"},"modified":"2017-08-10T09:32:41","modified_gmt":"2017-08-10T02:32:41","slug":"vpn-server-l2tpipsec-psk-on-debian-6-0-squeeze","status":"publish","type":"post","link":"https:\/\/trichev.com\/blog\/2012\/12\/26\/vpn-server-l2tpipsec-psk-on-debian-6-0-squeeze\/","title":{"rendered":"VPN server L2TP\/IPSec (PSK) on Debian 6.0 squeeze"},"content":{"rendered":"

Network layout:<\/p>\n

Internet === Router (192.168.0.1) === Debian SRV(192.168.0.2, GW 192.168.0.1, DNS 192.168.0.1)<\/p>\n

apt-get install openswan xl2tpd ppp<\/p>\n

\/etc\/ipsec.conf:<\/p>\n

version 2.0<\/p>\n

config setup
\nplutostderrlog=\/var\/log\/ipsec.log
\nnat_traversal=yes
\nvirtual_private=%v4:!10.0.0.0\/24
\noe=off
\nprotostack=netkey<\/p>\n

conn %default
\nforceencaps=yes
\ncompress=yes<\/p>\n

conn l2tp-psk-nat
\nrightsubnet=vhost:%priv
\nalso=l2tp-psk-nonat<\/p>\n

conn l2tp-psk-nonat
\nauthby=secret
\npfs=no
\nauto=add
\nkeyingtries=3
\nrekey=no
\ndpddelay=40
\ndpdtimeout=130
\ndpdaction=clear
\nkeyexchange=ike
\nikelifetime=8h
\nkeylife=1h
\ntype=transport
\nleft=192.168.0.2
\nleftprotoport=17\/1701
\nleftnexthop=192.168.0.1
\nright=%any
\nrightprotoport=17\/%any<\/p>\n

\/etc\/ipsec.secrets:<\/p>\n

192.168.0.2 %any : PSK “very-secret-key”<\/p>\n

\/etc\/xl2tpd\/xl2tpd.conf:<\/p>\n

[global]
\n; listen-addr = 192.168.0.2
\n; port = 1701
\nipsec saref = yes
\ndebug tunnel = yes
\ndebug avp = yes
\ndebug network = yes
\ndebug packet = yes
\ndebug state = yes
\nforce userspace = yes
\n;
\n[lns default] ; Our fallthrough LNS definition
\nip range = 10.0.0.10-10.0.0.100 ; * Allocate from this IP range
\nassign ip = yes
\nlocal ip = 10.0.0.1 ; * Our local IP to use
\nlength bit = yes ; * Use length bit in payload?
\nrequire chap = yes ; * Require CHAP auth. by peer
\nrefuse pap = yes ; * Refuse PAP authentication
\nrequire authentication = yes ; * Require peer to authenticate
\n; name = l2tpVPN ; * Report this as our hostname
\nppp debug = yes ; * Turn on PPP debugging
\npppoptfile = \/etc\/ppp\/options.xl2tpd<\/p>\n

\/etc\/ppp\/options.xl2tpd:<\/p>\n

ms-dns 8.8.8.8
\nrequire-mschap-v2
\nasyncmap 0
\nlogfile \/var\/log\/xl2tpd.log
\nnoccp
\nauth
\ncrtscts
\nlock
\nhide-password
\nmodem
\nmru 1280
\nmtu 1280
\ndebug
\nnodefaultroute
\nname l2tpd
\nproxyarp
\nlcp-echo-interval 30
\nlcp-echo-failure 4
\nipcp-accept-local
\nipcp-accept-remote
\nnoipx
\nidle 1800
\nconnect-delay 5000<\/p>\n

\/etc\/ppp\/chap-secrets:<\/p>\n

test l2tpd “testpassword” *<\/p>\n

Windows XP\/7(reboot after add value):<\/p>\n

iptables(VPN):
\niptables -A INPUT -m policy –dir in –pol ipsec -p udp –dport 1701 -j ACCEPT # \u043d\u0430 1701 \u043f\u0443\u0441\u043a\u0430\u0435\u043c \u0442\u043e\u043b\u044c\u043a\u043e ipsec \u043f\u0430\u043a\u0435\u0442\u044b
\niptables -A INPUT -p 50 -j ACCEPT
\niptables -A INPUT -p udp –dport 500 -j ACCEPT
\niptables -A INPUT -p udp –dport 4500 -j ACCEPT
\niptables -A FORWARD -i ppp+ -p all -m state –state NEW,ESTABLISHED,RELATED -j ACCEPT #\u0434\u043b\u044f \u043e\u0431\u0449\u0435\u043d\u0438\u044f \u0432\u043d\u0435 \u0441\u0432\u043e\u0435\u0433\u043e ppp
\niptables -A FORWARD -i eth0 -o ppp+ -m state –state NEW,ESTABLISHED,RELATED -j ACCEPT
\niptables -t nat -A POSTROUTING -s 10.0.0.0\/24 -o eth0 -j MASQUERADE # \u043c\u0430\u0441\u043a\u0430\u0440\u0430\u0434\u0438\u043c \u043f\u043e\u0434 IP \u0441\u0435\u0440\u0432\u0435\u0440\u0430<\/p>\n

iptables (router):
\niptables -t nat -A POSTROUTING -p udp -m udp –dport 500 -j DNAT –to-destination 192.168.0.1:500
\niptables -t nat -A POSTROUTING -p udp -m udp –dport 4500 -j DNAT –to-destination 192.168.0.1:4500
\niptables -t nat -A POSTROUTING -p udp -m udp –dport 1701 -j DNAT –to-destination 192.168.0.1:1701
\niptables -t nat -A POSTROUTING -p 50 -j DNAT –to-destination 192.168.0.1<\/p>\n

\u0412 Windows \u0432 \u043a\u043b\u044e\u0447\u0435 \u0440\u0435\u0435\u0441\u0442\u0440\u0430 (\u0443\u043a\u0430\u0437\u0430\u043d \u043d\u0438\u0436\u0435) \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u0441\u043e\u0437\u0434\u0430\u0442\u044c DWORD \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440 AssumeUDPEncapsulationContextOnSendRule \u0438 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u0435\u043c\u0443 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 2.<\/p>\n

\u2022\u0434\u043b\u044f Windows XP \u2014 HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\IPsec
\n\u2022\u0434\u043b\u044f Windows Vista\/7 \u2014 HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\PolicyAgent<\/p>\n

\u041f\u043e-\u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e VPN-\u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0435 \u0432 windows xp\/7 \u0441\u0442\u0430\u0432\u0438\u0442 \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u0439 \u043c\u0430\u0440\u0448\u0440\u0443\u0442 \u0447\u0435\u0440\u0435\u0437 VPN \u0441\u0435\u0442\u044c. \u0427\u0442\u043e\u0431\u044b \u044d\u0442\u043e \u0438\u0437\u043c\u0435\u043d\u0438\u0442\u044c \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u0443\u0431\u0440\u0430\u0442\u044c \u0433\u0430\u043b\u043e\u0447\u043a\u0443:
\n\u0421\u0432\u043e\u0439\u0441\u0442\u0432\u0430 VPN-\u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f-\u0421\u0435\u0442\u044c-\u041f\u0440\u043e\u0442\u043e\u043a\u043e\u043b \u0418\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u0430 TCP\/IP-\u0421\u0432\u043e\u0439\u0441\u0442\u0432\u0430-\u0414\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u043e
\n“\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u0439 \u0448\u043b\u044e\u0437 \u0432 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0439 \u0441\u0435\u0442\u0438”. DNS \u043c\u043e\u0436\u043d\u043e \u0442\u043e\u0436\u0435 \u0432\u044b\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u0432\u0440\u0443\u0447\u043d\u0443\u044e, \u0447\u0442\u043e\u0431\u044b \u043f\u043e-\u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0431\u0440\u0430\u043b\u0441\u044f \u0438\u0437 \u0443\u0436\u0435 \u0438\u043c\u0435\u044e\u0449\u0435\u0433\u043e\u0441\u044f \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f.<\/p>\n

\u0421\u0441\u044b\u043b\u043a\u0438:
\nhttp:\/\/blog.bertelsen.co\/2012\/02\/debian-squeeze-l2tpipsec-vpn-server.html<\/a>
\nhttp:\/\/blog.riobard.com\/2010\/04\/30\/l2tp-over-ipsec-ubuntu<\/a>
\nhttp:\/\/rootmanager.com\/ubuntu-ipsec-l2tp-windows-domain-auth\/setting-up-openswan-xl2tpd-with-native-windows-clients.html<\/a>
\nhttp:\/\/wiki.debian.org\/HowTo\/iPhoneVPNServer<\/a>
\nhttp:\/\/wingloon.com\/2012\/01\/11\/how-to-install-setup-l2tp-over-ipsec-vpn-in-debian-lenny\/<\/a>
\nhttp:\/\/blackpenguins.ru\/?p=151<\/a>
\nhttp:\/\/louwrentius.com\/blog\/2011\/12\/setting-up-a-vpn-with-your-iphone-using-l2tp,-ipsec-and-linux\/<\/a>
\nhttp:\/\/www.alsigned.ru\/?p=836<\/a>
\nhttps:\/\/www.openswan.org\/projects\/openswan\/wiki\/L2TPIPsec_configuration_using_openswan_and_xl2tpd<\/a>
\nhttp:\/\/www.linux.org.ru\/forum\/admin\/8189019<\/a>
\nhttp:\/\/support.microsoft.com\/default.aspx?scid=kb;EN-US;q281555<\/a>
\nhttp:\/\/confoundedtech.blogspot.ru\/2011\/08\/android-nexus-one-ipsec-psk-vpn-with.html<\/a>
\nhttp:\/\/www.vpnfortress.com\/setup\/android-l2tp-setup.html<\/a>
\nhttp:\/\/www.mayrhofer.eu.org\/l2tp-ipsec-gateway-for-mobile-phones<\/a>
\nhttp:\/\/unixadmins.su\/index.php?topic=1282.0<\/a>
\nhttp:\/\/www.lostbyte.com\/projects\/l2tpipsec-vpn-for-ios\/<\/a>
\nhttp:\/\/www.jacco2.dds.nl\/networking\/linux-l2tp.html<\/a>
\nhttp:\/\/en.gentoo-wiki.com\/w\/index.php?title=IPsec_L2TP_VPN_server<\/a>
\nhttp:\/\/www.aa-asterisk.org.uk\/index.php\/Setting_up_an_L2TP\/IPSec_server_on_Debian<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Network layout: Internet === Router (192.168.0.1) === Debian SRV(192.168.0.2, GW 192.168.0.1, DNS 192.168.0.1) apt-get install openswan xl2tpd ppp \/etc\/ipsec.conf: version 2.0 config setup plutostderrlog=\/var\/log\/ipsec.log nat_traversal=yes virtual_private=%v4:!10.0.0.0\/24 oe=off protostack=netkey conn %default forceencaps=yes compress=yes conn l2tp-psk-nat rightsubnet=vhost:%priv also=l2tp-psk-nonat conn l2tp-psk-nonat authby=secret pfs=no auto=add keyingtries=3 rekey=no dpddelay=40 dpdtimeout=130 dpdaction=clear keyexchange=ike ikelifetime=8h keylife=1h type=transport left=192.168.0.2 leftprotoport=17\/1701 leftnexthop=192.168.0.1 right=%any rightprotoport=17\/%any […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[231],"tags":[29,32,179,28,178,14,180,11],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/trichev.com\/blog\/wp-json\/wp\/v2\/posts\/425"}],"collection":[{"href":"https:\/\/trichev.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/trichev.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/trichev.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/trichev.com\/blog\/wp-json\/wp\/v2\/comments?post=425"}],"version-history":[{"count":9,"href":"https:\/\/trichev.com\/blog\/wp-json\/wp\/v2\/posts\/425\/revisions"}],"predecessor-version":[{"id":520,"href":"https:\/\/trichev.com\/blog\/wp-json\/wp\/v2\/posts\/425\/revisions\/520"}],"wp:attachment":[{"href":"https:\/\/trichev.com\/blog\/wp-json\/wp\/v2\/media?parent=425"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/trichev.com\/blog\/wp-json\/wp\/v2\/categories?post=425"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/trichev.com\/blog\/wp-json\/wp\/v2\/tags?post=425"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}