modprobe ppp-compress-18 && echo yes

cat /dev/net/tun

yum install -y epel-release

yum install -y make gcc gmp-devel xmlto bison flex xmlto libpcap-devel lsof vim-enhanced man xl2tpd libreswan nano

nano /etc/ppp/options.xl2tpd

require-mschap-v2 #加上这个

ipcp-accept-local

ipcp-accept-remote

ms-dns 8.8.8.8

ms-dns 1.1.1.1

# ms-dns 192.168.1.1

# ms-dns 192.168.1.3

# ms-wins 192.168.1.2

# ms-wins 192.168.1.4

noccp

auth

#obsolete: crtscts

idle 1800

mtu 1410

mru 1410

nodefaultroute

debug

#obsolete: lock

proxyarp

connect-delay 5000

# To allow authentication against a Windows domain EXAMPLE, and require the

# user to be in a group "VPN Users". Requires the samba-winbind package

# require-mschap-v2

# plugin winbind.so

# ntlm_auth-helper '/usr/bin/ntlm_auth --helper-protocol=ntlm-server-1 --require-membership-of="EXAMPLE\\VPN Users"'

# You need to join the domain on the server, for example using samba:

# http://rootmanager.com/ubuntu-ipsec-l2tp-windows-domain-auth/setting-up-openswan-xl2tpd-with-native-windows-clients-lucid.html

nano /etc/xl2tpd/xl2tpd.conf 

;

; This is a minimal sample xl2tpd configuration file for use

; with L2TP over IPsec.

;

; The idea is to provide an L2TP daemon to which remote Windows L2TP/IPsec

; clients connect. In this example, the internal (protected) network

; is 192.168.1.0/24. A special IP range within this network is reserved

; for the remote clients: 192.168.1.128/25

; (i.e. 192.168.1.128 ... 192.168.1.254)

;

; The listen-addr parameter can be used if you want to bind the L2TP daemon

; to a specific IP address instead of to all interfaces. For instance,

; you could bind it to the interface of the internal LAN (e.g. 192.168.1.98

; in the example below). Yet another IP address (local ip, e.g. 192.168.1.99)

; will be used by xl2tpd as its address on pppX interfaces.

[global]

listen-addr = 192.168.5.243 #改成自己的外网IP

;

; requires openswan-2.5.18 or higher - Also does not yet work in combination

; with kernel mode l2tp as present in linux 2.6.23+

ipsec saref = yes #去掉；注释号

; Use refinfo of 22 if using an SAref kernel patch based on openswan 2.6.35 or

; when using any of the SAref kernel patches for kernels up to 2.6.35.

; saref refinfo = 30

;

; force userspace = yes

;

; debug tunnel = yes

[lns default]

ip range = 192.168.1.100-192.168.1.200 #分配给VPN客户端的IP，这个可以随便用，但是后面对应的要改

local ip = 192.168.1.99 #本地的IP网段一致不要被分配就行

require chap = yes

refuse pap = yes

require authentication = yes

name = LinuxVPNserver

ppp debug = yes

pppoptfile = /etc/ppp/options.xl2tpd

length bit = yes

nano /etc/ppp/chap-secrets

# Secrets for authentication using CHAP 
#client		server	secret		IP addresses
test            *       123456          *

nano /etc/ipsec.d/ipsec.secrets

#include /etc/ipsec.d/*.secrets 
%any  %any: PSK "123456"

nano /etc/sysctl.conf

net.ipv4.ip_forward = 1

net.ipv4.conf.all.accept_redirects = 0

net.ipv4.conf.all.rp_filter = 0

net.ipv4.conf.all.send_redirects = 0

net.ipv4.conf.default.accept_redirects = 0

net.ipv4.conf.default.rp_filter = 0

net.ipv4.conf.default.send_redirects = 0

net.ipv4.conf.eth0.accept_redirects = 0 #每三句对应一个网卡

net.ipv4.conf.eth0.rp_filter = 0

net.ipv4.conf.eth0.send_redirects = 0

net.ipv4.conf.lo.accept_redirects = 0

net.ipv4.conf.lo.rp_filter = 0

net.ipv4.conf.lo.send_redirects = 0

sysctl -p

nano /etc/ipsec.d/l2tp_psk.conf

conn L2TP-PSK-NAT
    rightsubnet=vhost:%priv
    also=L2TP-PSK-noNAT
conn L2TP-PSK-noNAT
    authby=secret
    pfs=no
    auto=add
    keyingtries=3
    dpddelay=30
    dpdtimeout=120
    dpdaction=clear
    rekey=no
    ikelifetime=8h
    keylife=1h
    type=transport
    left=10.20.120.2  #也是网卡IP
    leftprotoport=17/1701
    right=%any
    rightprotoport=17/%any

yum install -y iptables
yum install -y iptables-services

systemctl stop firewalld
systemctl mask firewalld

iptables -L -n

iptables -P INPUT ACCEPT
iptables -F
iptables -X
iptables -Z

iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -o eth0 -j MASQUERADE
iptables -I FORWARD -s 192.168.1.0/24 -j ACCEPT
iptables -I FORWARD -d 192.168.1.0/24 -j ACCEPT
 
iptables -A INPUT -p udp -m policy --dir in --pol ipsec -m udp --dport 1701 -j ACCEPT
iptables -A INPUT -p udp -m udp --dport 1701 -j ACCEPT
iptables -A INPUT -p udp -m udp --dport 500 -j ACCEPT
iptables -A INPUT -p udp -m udp --dport 4500 -j ACCEPT
iptables -A INPUT -p esp -j ACCEPT
iptables -A INPUT -m policy --dir in --pol ipsec -j ACCEPT
 
iptables -A FORWARD -i ppp+ -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
 
service iptables save
/bin/systemctl restart iptables.service

systemctl start ipsec
systemctl enable ipsec
ipsec verify

systemctl start xl2tpd
systemctl enable xl2tpd
systemctl status xl2tpd

使用预共享密钥的L2TP/IPsec
服务器地址：
预共享密钥：123456
账号一：test
密码：123456