linux下搭建Ipsec+L2TP VPN服务（线上）

安装软件及依赖包

yum -y install epel-release
yum -y install ipsec-tools
yum -y install gmp gmp-devel gawk flex bison
yum -y install openswan ppp xl2tpd

内核调优：cat /etc/sysctl.conf

net.ipv4.ip_forward = 1
net.ipv4.conf.default.rp_filter = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0
net.ipv4.conf.all.log_martians = 0
net.ipv4.conf.default.log_martians = 0
net.ipv4.conf.default.accept_source_route = 0
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv4.icmp_ignore_bogus_error_responses = 1
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0

net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_fin_timeout = 30
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_tw_recycle = 1
net.ipv4.ip_local_port_range = 1000 65000
net.ipv4.tcp_max_syn_backlog = 8192
net.ipv4.tcp_max_tw_buckets = 5000

kernel.shmmax = 67108864
fs.file-max = 65535

cd/etc/ipsec.d/
ls./*.conf|xargs-I{}mv{}{}.bak
vimL2TP.conf
cat /etc/ipsec.d/L2TP.conf
conn L2TP-PSK-NAT
rightsubnet=vhost:%priv
also=L2TP-PSK-noNAT

conn L2TP-PSK-noNAT
authby=secret
pfs=no
auto=add
keyingtries=3
rekey=no
ikelifetime=8h
keylife=1h
type=transport
left=165.227.2.134
leFTProtoport=17/1701
right=%any
rightprotoport=17/%any

165.227.2.134 %any: PSK "123456"

iptables -A FORWARD -s 10.0.0.0/8 -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j TCPMSS --set-mss 1356
iptables -t nat -A POSTROUTING -s 10.0.0.0/8 -j SNAT --to-source 165.227.2.134
iptables -I INPUT -p udp -m udp -m state --state NEW --dport 1701 -j ACCEPT
iptables -I INPUT -p udp -m udp -m state --state NEW --dport 500 -j ACCEPT
iptables -I INPUT -p esp -j ACCEPT
/etc/init.d/iptables save

苹果手机测试：

电脑端测试：VPN.pbk