{"id":131,"date":"2024-10-30T17:54:38","date_gmt":"2024-10-30T09:54:38","guid":{"rendered":"https:\/\/zhoujibin.com\/?p=131"},"modified":"2024-10-30T17:54:38","modified_gmt":"2024-10-30T09:54:38","slug":"linux%e6%90%ad%e5%bb%bal2tp%e6%9c%8d%e5%8a%a1","status":"publish","type":"post","link":"https:\/\/zhoujibin.com\/?p=131","title":{"rendered":"Linux\u642d\u5efaL2TP\u670d\u52a1"},"content":{"rendered":"\n

\u57fa\u7840\u73af\u5883<\/h1>\n\n\n\n

\u7cfb\u7edf\u7248\u672c<\/h2>\n\n\n\n
centos7.6<\/code><\/pre>\n\n\n\n
ip\u5730\u5740<\/h2>\n\n\n\n
# \u53ef\u4f7f\u7528ifconfig\u67e5\u770b inet \u5bf9\u5e94\u7684\u503c\u5373\u53ef\nifcongig\neth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500\n        inet 172.17.21.70  netmask 255.255.192.0  broadcast 172.17.63.255\n        ether 00:16:3e:0a:ae:40  txqueuelen 1000  (Ethernet)\n        RX packets 26818  bytes 38644694 (36.8 MiB)\n        RX errors 0  dropped 0  overruns 0  frame 0\n        TX packets 3048  bytes 313650 (306.2 KiB)\n        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0\n\nlo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536\n        inet 127.0.0.1  netmask 255.0.0.0\n        loop  txqueuelen 1000  (Local Loopback)\n        RX packets 0  bytes 0 (0.0 B)\n        RX errors 0  dropped 0  overruns 0  frame 0\n        TX packets 0  bytes 0 (0.0 B)\n        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0<\/code><\/pre>\n\n\n\n
\u4e00\u952e\u5b89\u88c5<\/h1>\n\n\n\n
\u83b7\u53d6\u811a\u672c<\/h2>\n\n\n\n
\u5728\u7ebf\u811a\u672c<\/h3>\n\n\n\n
# \u83b7\u53d6\u5728\u7ebf\u811a\u672c\nwget --no-check-certificate https:\/\/raw.githubusercontent.com\/teddysun\/across\/master\/l2tp.sh<\/code><\/pre>\n\n\n\n
\u79bb\u7ebf\u811a\u672c<\/h3>\n\n\n\n
# \u65b0\u5efa\u811a\u672c\u6587\u4ef6\uff0c\u8f93\u5165\u4e0b\u5217\u5185\u5bb9\u5373\u53ef\ntouch l2tp.sh;\n\n#!\/usr\/bin\/env bash\nPATH=\/bin:\/sbin:\/usr\/bin:\/usr\/sbin:\/usr\/local\/bin:\/usr\/local\/sbin:~\/bin\nexport PATH\n#=======================================================================#\n#   System Supported:  CentOS 6+ \/ Debian 7+ \/ Ubuntu 12+               #\n#   Description: L2TP VPN Auto Installer                                #\n#   Author: Teddysun <i@teddysun.com>                                   #\n#   Intro:  https:\/\/teddysun.com\/448.html                               #\n#=======================================================================#\ncur_dir=`pwd`\n\nlibreswan_filename=\"libreswan-3.27\"\ndownload_root_url=\"https:\/\/dl.lamp.sh\/files\"\n\nrootness(){\n    if [[ $EUID -ne 0 ]]; then\n       echo \"Error:This script must be run as root!\" 1>&2\n       exit 1\n    fi\n}\n\ntunavailable(){\n    if [[ ! -e \/dev\/net\/tun ]]; then\n        echo \"Error:TUN\/TAP is not available!\" 1>&2\n        exit 1\n    fi\n}\n\ndisable_selinux(){\nif [ -s \/etc\/selinux\/config ] && grep 'SELINUX=enforcing' \/etc\/selinux\/config; then\n    sed -i 's\/SELINUX=enforcing\/SELINUX=disabled\/g' \/etc\/selinux\/config\n    setenforce 0\nfi\n}\n\nget_opsy(){\n    [ -f \/etc\/redhat-release ] && awk '{print ($1,$3~\/^[0-9]\/?$3:$4)}' \/etc\/redhat-release && return\n    [ -f \/etc\/os-release ] && awk -F'[= \"]' '\/PRETTY_NAME\/{print $3,$4,$5}' \/etc\/os-release && return\n    [ -f \/etc\/lsb-release ] && awk -F'[=\"]+' '\/DESCRIPTION\/{print $2}' \/etc\/lsb-release && return\n}\n\nget_os_info(){\n    IP=$( ip addr | egrep -o '[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}' | egrep -v \"^192\\.168|^172\\.1[6-9]\\.|^172\\.2[0-9]\\.|^172\\.3[0-2]\\.|^10\\.|^127\\.|^255\\.|^0\\.\" | head -n 1 )\n    [ -z ${IP} ] && IP=$( wget -qO- -t1 -T2 ipv4.icanhazip.com )\n\n    local cname=$( awk -F: '\/model name\/ {name=$2} END {print name}' \/proc\/cpuinfo | sed 's\/^[ \\t]*\/\/;s\/[ \\t]*$\/\/' )\n    local cores=$( awk -F: '\/model name\/ {core++} END {print core}' \/proc\/cpuinfo )\n    local freq=$( awk -F: '\/cpu MHz\/ {freq=$2} END {print freq}' \/proc\/cpuinfo | sed 's\/^[ \\t]*\/\/;s\/[ \\t]*$\/\/' )\n    local tram=$( free -m | awk '\/Mem\/ {print $2}' )\n    local swap=$( free -m | awk '\/Swap\/ {print $2}' )\n    local up=$( awk '{a=$1\/86400;b=($1%86400)\/3600;c=($1%3600)\/60;d=$1%60} {printf(\"%ddays, %d:%d:%d\\n\",a,b,c,d)}' \/proc\/uptime )\n    local load=$( w | head -1 | awk -F'load average:' '{print $2}' | sed 's\/^[ \\t]*\/\/;s\/[ \\t]*$\/\/' )\n    local opsy=$( get_opsy )\n    local arch=$( uname -m )\n    local lbit=$( getconf LONG_BIT )\n    local host=$( hostname )\n    local kern=$( uname -r )\n\n    echo \"########## System Information ##########\"\n    echo \n    echo \"CPU model            : ${cname}\"\n    echo \"Number of cores      : ${cores}\"\n    echo \"CPU frequency        : ${freq} MHz\"\n    echo \"Total amount of ram  : ${tram} MB\"\n    echo \"Total amount of swap : ${swap} MB\"\n    echo \"System uptime        : ${up}\"\n    echo \"Load average         : ${load}\"\n    echo \"OS                   : ${opsy}\"\n    echo \"Arch                 : ${arch} (${lbit} Bit)\"\n    echo \"Kernel               : ${kern}\"\n    echo \"Hostname             : ${host}\"\n    echo \"IPv4 address         : ${IP}\"\n    echo \n    echo \"########################################\"\n}\n\ncheck_sys(){\n    local checkType=$1\n    local value=$2\n\n    local release=''\n    local systemPackage=''\n\n    if [[ -f \/etc\/redhat-release ]]; then\n        release=\"centos\"\n        systemPackage=\"yum\"\n    elif cat \/etc\/issue | grep -Eqi \"debian\"; then\n        release=\"debian\"\n        systemPackage=\"apt\"\n    elif cat \/etc\/issue | grep -Eqi \"ubuntu\"; then\n        release=\"ubuntu\"\n        systemPackage=\"apt\"\n    elif cat \/etc\/issue | grep -Eqi \"centos|red hat|redhat\"; then\n        release=\"centos\"\n        systemPackage=\"yum\"\n    elif cat \/proc\/version | grep -Eqi \"debian\"; then\n        release=\"debian\"\n        systemPackage=\"apt\"\n    elif cat \/proc\/version | grep -Eqi \"ubuntu\"; then\n        release=\"ubuntu\"\n        systemPackage=\"apt\"\n    elif cat \/proc\/version | grep -Eqi \"centos|red hat|redhat\"; then\n        release=\"centos\"\n        systemPackage=\"yum\"\n    fi\n\n    if [[ ${checkType} == \"sysRelease\" ]]; then\n        if [ \"$value\" == \"$release\" ];then\n            return 0\n        else\n            return 1\n        fi\n    elif [[ ${checkType} == \"packageManager\" ]]; then\n        if [ \"$value\" == \"$systemPackage\" ];then\n            return 0\n        else\n            return 1\n        fi\n    fi\n}\n\nrand(){\n    index=0\n    str=\"\"\n    for i in {a..z}; do arr[index]=${i}; index=`expr ${index} + 1`; done\n    for i in {A..Z}; do arr[index]=${i}; index=`expr ${index} + 1`; done\n    for i in {0..9}; do arr[index]=${i}; index=`expr ${index} + 1`; done\n    for i in {1..10}; do str=\"$str${arr[$RANDOM%$index]}\"; done\n    echo ${str}\n}\n\nis_64bit(){\n    if [ `getconf WORD_BIT` = '32' ] && [ `getconf LONG_BIT` = '64' ] ; then\n        return 0\n    else\n        return 1\n    fi\n}\n\ndownload_file(){\n    if [ -s ${1} ]; then\n        echo \"$1 [found]\"\n    else\n        echo \"$1 not found!!!download now...\"\n        if ! wget -c -t3 -T60 ${download_root_url}\/${1}; then\n            echo \"Failed to download $1, please download it to ${cur_dir} directory manually and try again.\"\n            exit 1\n        fi\n    fi\n}\n\nversionget(){\n    if [[ -s \/etc\/redhat-release ]];then\n        grep -oE  \"[0-9.]+\" \/etc\/redhat-release\n    else\n        grep -oE  \"[0-9.]+\" \/etc\/issue\n    fi\n}\n\ncentosversion(){\n    if check_sys sysRelease centos;then\n        local code=${1}\n        local version=\"`versionget`\"\n        local main_ver=${version%%.*}\n        if [ \"${main_ver}\" == \"${code}\" ];then\n            return 0\n        else\n            return 1\n        fi\n    else\n        return 1\n    fi\n}\n\ndebianversion(){\n    if check_sys sysRelease debian;then\n        local version=$( get_opsy )\n        local code=${1}\n        local main_ver=$( echo ${version} | sed 's\/[^0-9]\/\/g')\n        if [ \"${main_ver}\" == \"${code}\" ];then\n            return 0\n        else\n            return 1\n        fi\n    else\n        return 1\n    fi\n}\n\nversion_check(){\n    if check_sys packageManager yum; then\n        if centosversion 5; then\n            echo \"Error: CentOS 5 is not supported, Please re-install OS and try again.\"\n            exit 1\n        fi\n    fi\n}\n\nget_char(){\n    SAVEDSTTY=`stty -g`\n    stty -echo\n    stty cbreak\n    dd if=\/dev\/tty bs=1 count=1 2> \/dev\/null\n    stty -raw\n    stty echo\n    stty $SAVEDSTTY\n}\n\npreinstall_l2tp(){\n\n    echo\n    if [ -d \"\/proc\/vz\" ]; then\n        echo -e \"\\033[41;37m WARNING: \\033[0m Your VPS is based on OpenVZ, and IPSec might not be supported by the kernel.\"\n        echo \"Continue installation? (y\/n)\"\n        read -p \"(Default: n)\" agree\n        [ -z ${agree} ] && agree=\"n\"\n        if [ \"${agree}\" == \"n\" ]; then\n            echo\n            echo \"L2TP installation cancelled.\"\n            echo\n            exit 0\n        fi\n    fi\n    echo\n    echo \"Please enter IP-Range:\"\n    read -p \"(Default Range: 192.168.18):\" iprange\n    [ -z ${iprange} ] && iprange=\"192.168.18\"\n\n    echo \"Please enter PSK:\"\n    read -p \"(Default PSK: teddysun.com):\" mypsk\n    [ -z ${mypsk} ] && mypsk=\"teddysun.com\"\n\n    echo \"Please enter Username:\"\n    read -p \"(Default Username: teddysun):\" username\n    [ -z ${username} ] && username=\"teddysun\"\n\n    password=`rand`\n    echo \"Please enter ${username}'s password:\"\n    read -p \"(Default Password: ${password}):\" tmppassword\n    [ ! -z ${tmppassword} ] && password=${tmppassword}\n\n    echo\n    echo \"ServerIP:${IP}\"\n    echo \"Server Local IP:${iprange}.1\"\n    echo \"Client Remote IP Range:${iprange}.2-${iprange}.254\"\n    echo \"PSK:${mypsk}\"\n    echo\n    echo \"Press any key to start... or press Ctrl + C to cancel.\"\n    char=`get_char`\n\n}\n\ninstall_l2tp(){\n\n    mknod \/dev\/random c 1 9\n\n    if check_sys packageManager apt; then\n        apt-get -y update\n\n        if debianversion 7; then\n            if is_64bit; then\n                local libnspr4_filename1=\"libnspr4_4.10.7-1_amd64.deb\"\n                local libnspr4_filename2=\"libnspr4-0d_4.10.7-1_amd64.deb\"\n                local libnspr4_filename3=\"libnspr4-dev_4.10.7-1_amd64.deb\"\n                local libnspr4_filename4=\"libnspr4-dbg_4.10.7-1_amd64.deb\"\n                local libnss3_filename1=\"libnss3_3.17.2-1.1_amd64.deb\"\n                local libnss3_filename2=\"libnss3-1d_3.17.2-1.1_amd64.deb\"\n                local libnss3_filename3=\"libnss3-tools_3.17.2-1.1_amd64.deb\"\n                local libnss3_filename4=\"libnss3-dev_3.17.2-1.1_amd64.deb\"\n                local libnss3_filename5=\"libnss3-dbg_3.17.2-1.1_amd64.deb\"\n            else\n                local libnspr4_filename1=\"libnspr4_4.10.7-1_i386.deb\"\n                local libnspr4_filename2=\"libnspr4-0d_4.10.7-1_i386.deb\"\n                local libnspr4_filename3=\"libnspr4-dev_4.10.7-1_i386.deb\"\n                local libnspr4_filename4=\"libnspr4-dbg_4.10.7-1_i386.deb\"\n                local libnss3_filename1=\"libnss3_3.17.2-1.1_i386.deb\"\n                local libnss3_filename2=\"libnss3-1d_3.17.2-1.1_i386.deb\"\n                local libnss3_filename3=\"libnss3-tools_3.17.2-1.1_i386.deb\"\n                local libnss3_filename4=\"libnss3-dev_3.17.2-1.1_i386.deb\"\n                local libnss3_filename5=\"libnss3-dbg_3.17.2-1.1_i386.deb\"\n            fi\n            rm -rf ${cur_dir}\/l2tp\n            mkdir -p ${cur_dir}\/l2tp\n            cd ${cur_dir}\/l2tp\n            download_file \"${libnspr4_filename1}\"\n            download_file \"${libnspr4_filename2}\"\n            download_file \"${libnspr4_filename3}\"\n            download_file \"${libnspr4_filename4}\"\n            download_file \"${libnss3_filename1}\"\n            download_file \"${libnss3_filename2}\"\n            download_file \"${libnss3_filename3}\"\n            download_file \"${libnss3_filename4}\"\n            download_file \"${libnss3_filename5}\"\n            dpkg -i ${libnspr4_filename1} ${libnspr4_filename2} ${libnspr4_filename3} ${libnspr4_filename4}\n            dpkg -i ${libnss3_filename1} ${libnss3_filename2} ${libnss3_filename3} ${libnss3_filename4} ${libnss3_filename5}\n\n            apt-get -y install wget gcc ppp flex bison make pkg-config libpam0g-dev libcap-ng-dev iptables \\\n                               libcap-ng-utils libunbound-dev libevent-dev libcurl4-nss-dev libsystemd-daemon-dev\n        else\n            apt-get -y install wget gcc ppp flex bison make python libnss3-dev libnss3-tools libselinux-dev iptables \\\n                               libnspr4-dev pkg-config libpam0g-dev libcap-ng-dev libcap-ng-utils libunbound-dev \\\n                               libevent-dev libcurl4-nss-dev libsystemd-dev\n        fi\n        apt-get -y --no-install-recommends install xmlto\n        apt-get -y install xl2tpd\n\n        compile_install\n    elif check_sys packageManager yum; then\n        echo \"Adding the EPEL repository...\"\n        yum -y install epel-release yum-utils\n        [ ! -f \/etc\/yum.repos.d\/epel.repo ] && echo \"Install EPEL repository failed, please check it.\" && exit 1\n        yum-config-manager --enable epel\n        echo \"Adding the EPEL repository complete...\"\n\n        if centosversion 7; then\n            yum -y install ppp libreswan xl2tpd firewalld\n            yum_install\n        elif centosversion 6; then\n            yum -y remove libevent-devel\n            yum -y install libevent2-devel\n            yum -y install nss-devel nspr-devel pkgconfig pam-devel \\\n                           libcap-ng-devel libselinux-devel lsof \\\n                           curl-devel flex bison gcc ppp make iptables gmp-devel \\\n                           fipscheck-devel unbound-devel xmlto libpcap-devel xl2tpd\n\n            compile_install\n        fi\n    fi\n\n}\n\nconfig_install(){\n\n    cat > \/etc\/ipsec.conf<<EOF\nversion 2.0\n\nconfig setup\n    protostack=netkey\n    nhelpers=0\n    uniqueids=no\n    interfaces=%defaultroute\n    virtual_private=%v4:10.0.0.0\/8,%v4:192.168.0.0\/16,%v4:172.16.0.0\/12,%v4:!${iprange}.0\/24\n\nconn l2tp-psk\n    rightsubnet=vhost:%priv\n    also=l2tp-psk-nonat\n\nconn l2tp-psk-nonat\n    authby=secret\n    pfs=no\n    auto=add\n    keyingtries=3\n    rekey=no\n    ikelifetime=8h\n    keylife=1h\n    type=transport\n    left=%defaultroute\n    leftid=${IP}\n    leftprotoport=17\/1701\n    right=%any\n    rightprotoport=17\/%any\n    dpddelay=40\n    dpdtimeout=130\n    dpdaction=clear\n    sha2-truncbug=yes\nEOF\n\n    cat > \/etc\/ipsec.secrets<<EOF\n%any %any : PSK \"${mypsk}\"\nEOF\n\n    cat > \/etc\/xl2tpd\/xl2tpd.conf<<EOF<\/code><\/pre>\n\n\n
[global]<\/p>\n\n\n\n
port = 1701<\/p>\n\n\n
[lns default]<\/p>\n\n\n\n
ip range = ${iprange}.2-${iprange}.254 local ip = ${iprange}.1 require chap = yes refuse pap = yes require authentication = yes name = l2tpd ppp debug = yes pppoptfile = \/etc\/ppp\/options.xl2tpd length bit = yes EOF cat > \/etc\/ppp\/options.xl2tpd<<EOF ipcp-accept-local ipcp-accept-remote require-mschap-v2 ms-dns 8.8.8.8 ms-dns 8.8.4.4 noccp auth hide-password idle 1800 mtu 1410 mru 1410 nodefaultroute debug proxyarp connect-delay 5000 EOF rm -f \/etc\/ppp\/chap-secrets cat > \/etc\/ppp\/chap-secrets<<EOF # Secrets for authentication using CHAP # client server secret IP addresses ${username} l2tpd ${password} * EOF } compile_install(){ rm -rf ${cur_dir}\/l2tp mkdir -p ${cur_dir}\/l2tp cd ${cur_dir}\/l2tp download_file “${libreswan_filename}.tar.gz” tar -zxf ${libreswan_filename}.tar.gz cd ${cur_dir}\/l2tp\/${libreswan_filename} cat > Makefile.inc.local <<‘EOF’ WERROR_CFLAGS = USE_DNSSEC = false USE_DH31 = false USE_GLIBC_KERN_FLIP_HEADERS = true EOF make programs && make install \/usr\/local\/sbin\/ipsec –version >\/dev\/null 2>&1 if [ $? -ne 0 ]; then echo “${libreswan_filename} install failed.” exit 1 fi config_install cp -pf \/etc\/sysctl.conf \/etc\/sysctl.conf.bak sed -i ‘s\/net.ipv4.ip_forward = 0\/net.ipv4.ip_forward = 1\/g’ \/etc\/sysctl.conf for each in `ls \/proc\/sys\/net\/ipv4\/conf\/`; do echo “net.ipv4.conf.${each}.accept_source_route=0” >> \/etc\/sysctl.conf echo “net.ipv4.conf.${each}.accept_redirects=0” >> \/etc\/sysctl.conf echo “net.ipv4.conf.${each}.send_redirects=0” >> \/etc\/sysctl.conf echo “net.ipv4.conf.${each}.rp_filter=0” >> \/etc\/sysctl.conf done sysctl -p if centosversion 6; then [ -f \/etc\/sysconfig\/iptables ] && cp -pf \/etc\/sysconfig\/iptables \/etc\/sysconfig\/iptables.old.`date +%Y%m%d` if [ “`iptables -L -n | grep -c ‘\\-\\-‘`” == “0” ]; then cat > \/etc\/sysconfig\/iptables <<EOF # Added by L2TP VPN script *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [0:0] -A INPUT -m state –state RELATED,ESTABLISHED -j ACCEPT -A INPUT -p icmp -j ACCEPT -A INPUT -i lo -j ACCEPT -A INPUT -p tcp –dport 22 -j ACCEPT -A INPUT -p udp -m multiport –dports 500,4500,1701 -j ACCEPT -A FORWARD -m state –state RELATED,ESTABLISHED -j ACCEPT -A FORWARD -s ${iprange}.0\/24 -j ACCEPT COMMIT *nat :PREROUTING ACCEPT [0:0] :OUTPUT ACCEPT [0:0] :POSTROUTING ACCEPT [0:0] -A POSTROUTING -s ${iprange}.0\/24 -j SNAT –to-source ${IP} COMMIT EOF else iptables -I INPUT -p udp -m multiport –dports 500,4500,1701 -j ACCEPT iptables -I FORWARD -m state –state RELATED,ESTABLISHED -j ACCEPT iptables -I FORWARD -s ${iprange}.0\/24 -j ACCEPT iptables -t nat -A POSTROUTING -s ${iprange}.0\/24 -j SNAT –to-source ${IP} \/etc\/init.d\/iptables save fi if [ ! -f \/etc\/ipsec.d\/cert9.db ]; then echo > \/var\/tmp\/libreswan-nss-pwd certutil -N -f \/var\/tmp\/libreswan-nss-pwd -d \/etc\/ipsec.d rm -f \/var\/tmp\/libreswan-nss-pwd fi chkconfig –add iptables chkconfig iptables on chkconfig –add ipsec chkconfig ipsec on chkconfig –add xl2tpd chkconfig xl2tpd on \/etc\/init.d\/iptables restart \/etc\/init.d\/ipsec start \/etc\/init.d\/xl2tpd start else [ -f \/etc\/iptables.rules ] && cp -pf \/etc\/iptables.rules \/etc\/iptables.rules.old.`date +%Y%m%d` if [ “`iptables -L -n | grep -c ‘\\-\\-‘`” == “0” ]; then cat > \/etc\/iptables.rules <<EOF # Added by L2TP VPN script *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [0:0] -A INPUT -m state –state RELATED,ESTABLISHED -j ACCEPT -A INPUT -p icmp -j ACCEPT -A INPUT -i lo -j ACCEPT -A INPUT -p tcp –dport 22 -j ACCEPT -A INPUT -p udp -m multiport –dports 500,4500,1701 -j ACCEPT -A FORWARD -m state –state RELATED,ESTABLISHED -j ACCEPT -A FORWARD -s ${iprange}.0\/24 -j ACCEPT COMMIT *nat :PREROUTING ACCEPT [0:0] :OUTPUT ACCEPT [0:0] :POSTROUTING ACCEPT [0:0] -A POSTROUTING -s ${iprange}.0\/24 -j SNAT –to-source ${IP} COMMIT EOF else iptables -I INPUT -p udp -m multiport –dports 500,4500,1701 -j ACCEPT iptables -I FORWARD -m state –state RELATED,ESTABLISHED -j ACCEPT iptables -I FORWARD -s ${iprange}.0\/24 -j ACCEPT iptables -t nat -A POSTROUTING -s ${iprange}.0\/24 -j SNAT –to-source ${IP} \/sbin\/iptables-save > \/etc\/iptables.rules fi cat > \/etc\/network\/if-up.d\/iptables <<EOF #!\/bin\/sh \/sbin\/iptables-restore < \/etc\/iptables.rules EOF chmod +x \/etc\/network\/if-up.d\/iptables if [ ! -f \/etc\/ipsec.d\/cert9.db ]; then echo > \/var\/tmp\/libreswan-nss-pwd certutil -N -f \/var\/tmp\/libreswan-nss-pwd -d \/etc\/ipsec.d rm -f \/var\/tmp\/libreswan-nss-pwd fi update-rc.d -f xl2tpd defaults cp -f \/etc\/rc.local \/etc\/rc.local.old.`date +%Y%m%d` sed –follow-symlinks -i -e ‘\/^exit 0\/d’ \/etc\/rc.local cat >> \/etc\/rc.local <<EOF # Added by L2TP VPN script echo 1 > \/proc\/sys\/net\/ipv4\/ip_forward \/usr\/sbin\/service ipsec start exit 0 EOF chmod +x \/etc\/rc.local echo 1 > \/proc\/sys\/net\/ipv4\/ip_forward \/sbin\/iptables-restore < \/etc\/iptables.rules \/usr\/sbin\/service ipsec start \/usr\/sbin\/service xl2tpd restart fi } yum_install(){ config_install cp -pf \/etc\/sysctl.conf \/etc\/sysctl.conf.bak echo “# Added by L2TP VPN” >> \/etc\/sysctl.conf echo “net.ipv4.ip_forward=1” >> \/etc\/sysctl.conf echo “net.ipv4.tcp_syncookies=1” >> \/etc\/sysctl.conf echo “net.ipv4.icmp_echo_ignore_broadcasts=1” >> \/etc\/sysctl.conf echo “net.ipv4.icmp_ignore_bogus_error_responses=1” >> \/etc\/sysctl.conf for each in `ls \/proc\/sys\/net\/ipv4\/conf\/`; do echo “net.ipv4.conf.${each}.accept_source_route=0” >> \/etc\/sysctl.conf echo “net.ipv4.conf.${each}.accept_redirects=0” >> \/etc\/sysctl.conf echo “net.ipv4.conf.${each}.send_redirects=0” >> \/etc\/sysctl.conf echo “net.ipv4.conf.${each}.rp_filter=0″ >> \/etc\/sysctl.conf done sysctl -p cat > \/etc\/firewalld\/services\/xl2tpd.xml<<EOF <?xml version=”1.0″ encoding=”utf-8″?> <service> <short>xl2tpd<\/short> <description>L2TP IPSec<\/description> <port protocol=”udp” port=”4500″\/> <port protocol=”udp” port=”1701″\/> <\/service> EOF chmod 640 \/etc\/firewalld\/services\/xl2tpd.xml systemctl enable ipsec systemctl enable xl2tpd systemctl enable firewalld systemctl status firewalld > \/dev\/null 2>&1 if [ $? -eq 0 ]; then firewall-cmd –reload echo “Checking firewalld status…” firewall-cmd –list-all echo “add firewalld rules…” firewall-cmd –permanent –add-service=ipsec firewall-cmd –permanent –add-service=xl2tpd firewall-cmd –permanent –add-masquerade firewall-cmd –reload else echo “Firewalld looks like not running, trying to start…” systemctl start firewalld if [ $? -eq 0 ]; then echo “Firewalld start successfully…” firewall-cmd –reload echo “Checking firewalld status…” firewall-cmd –list-all echo “adding firewalld rules…” firewall-cmd –permanent –add-service=ipsec firewall-cmd –permanent –add-service=xl2tpd firewall-cmd –permanent –add-masquerade firewall-cmd –reload else echo “Failed to start firewalld. please enable udp port 500 4500 1701 manually if necessary.” fi fi systemctl restart ipsec systemctl restart xl2tpd echo “Checking ipsec status…” systemctl -a | grep ipsec echo “Checking xl2tpd status…” systemctl -a | grep xl2tpd echo “Checking firewalld status…” firewall-cmd –list-all } finally(){ cd ${cur_dir} rm -fr ${cur_dir}\/l2tp # create l2tp command cp -f ${cur_dir}\/`basename $0` \/usr\/bin\/l2tp echo “Please wait a moment…” sleep 5 ipsec verify echo echo “###############################################################” echo “# L2TP VPN Auto Installer #” echo “# System Supported: CentOS 6+ \/ Debian 7+ \/ Ubuntu 12+ #” echo “# Intro: https:\/\/teddysun.com\/448.html #” echo “# Author: Teddysun <i@teddysun.com> #” echo “###############################################################” echo “If there is no [FAILED] above, you can connect to your L2TP ” echo “VPN Server with the default Username\/Password is below:” echo echo “Server IP: ${IP}” echo “PSK : ${mypsk}” echo “Username : ${username}” echo “Password : ${password}” echo echo “If you want to modify user settings, please use below command(s):” echo “l2tp -a (Add a user)” echo “l2tp -d (Delete a user)” echo “l2tp -l (List all users)” echo “l2tp -m (Modify a user password)” echo echo “Welcome to visit our website: https:\/\/teddysun.com\/448.html” echo “Enjoy it!” echo } l2tp(){ clear echo echo “###############################################################” echo “# L2TP VPN Auto Installer #” echo “# System Supported: CentOS 6+ \/ Debian 7+ \/ Ubuntu 12+ #” echo “# Intro: https:\/\/teddysun.com\/448.html #” echo “# Author: Teddysun <i@teddysun.com> #” echo “###############################################################” echo rootness tunavailable disable_selinux version_check get_os_info preinstall_l2tp install_l2tp finally } list_users(){ if [ ! -f \/etc\/ppp\/chap-secrets ];then echo “Error: \/etc\/ppp\/chap-secrets file not found.” exit 1 fi local line=”+——————————————-+\\n” local string=%20s printf “${line}|${string} |${string} |\\n${line}” Username Password grep -v “^#” \/etc\/ppp\/chap-secrets | awk ‘{printf “|’${string}’ |’${string}’ |\\n”, $1,$3}’ printf ${line} } add_user(){ while : do read -p “Please input your Username:” user if [ -z ${user} ]; then echo “Username can not be empty” else grep -w “${user}” \/etc\/ppp\/chap-secrets > \/dev\/null 2>&1 if [ $? -eq 0 ];then echo “Username (${user}) already exists. Please re-enter your username.” else break fi fi done pass=`rand` echo “Please input ${user}’s password:” read -p “(Default Password: ${pass}):” tmppass [ ! -z ${tmppass} ] && pass=${tmppass} echo “${user} l2tpd ${pass} *” >> \/etc\/ppp\/chap-secrets echo “Username (${user}) add completed.” } del_user(){ while : do read -p “Please input Username you want to delete it:” user if [ -z ${user} ]; then echo “Username can not be empty” else grep -w “${user}” \/etc\/ppp\/chap-secrets >\/dev\/null 2>&1 if [ $? -eq 0 ];then break else echo “Username (${user}) is not exists. Please re-enter your username.” fi fi done sed -i “\/^\\<${user}\\>\/d” \/etc\/ppp\/chap-secrets echo “Username (${user}) delete completed.” } mod_user(){ while : do read -p “Please input Username you want to change password:” user if [ -z ${user} ]; then echo “Username can not be empty” else grep -w “${user}” \/etc\/ppp\/chap-secrets >\/dev\/null 2>&1 if [ $? -eq 0 ];then break else echo “Username (${user}) is not exists. Please re-enter your username.” fi fi done pass=`rand` echo “Please input ${user}’s new password:” read -p “(Default Password: ${pass}):” tmppass [ ! -z ${tmppass} ] && pass=${tmppass} sed -i “\/^\\<${user}\\>\/d” \/etc\/ppp\/chap-secrets echo “${user} l2tpd ${pass} *” >> \/etc\/ppp\/chap-secrets echo “Username ${user}’s password has been changed.” } # Main process action=$1 if [ -z ${action} ] && [ “`basename $0`” != “l2tp” ]; then action=install fi case ${action} in install) l2tp 2>&1 | tee ${cur_dir}\/l2tp.log ;; -l|–list) list_users ;; -a|–add) add_user ;; -d|–del) del_user ;; -m|–mod) mod_user ;; -h|–help) echo “Usage: `basename $0` -l,–list List all users” echo ” `basename $0` -a,–add Add a user” echo ” `basename $0` -d,–del Delete a user” echo ” `basename $0` -m,–mod Modify a user password” echo ” `basename $0` -h,–help Print this help information” ;; *) echo “Usage: `basename $0` [-l,–list|-a,–add|-d,–del|-m,–mod|-h,–help]” && exit ;; esac<\/p>\n\n\n\n
\u6267\u884c\u811a\u672c<\/h2>\n\n\n\n
# \u8d4b\u4e88\u811a\u672c\u6267\u884c\u6743\u9650\nchmod +x l2tp.sh\n# \u6267\u884c\u811a\u672c\uff08\u82e5\u975eroot\u7528\u6237\uff0c\u9700\u8981\u4f7f\u7528sudo .\/l2tp.sh \u6267\u884c\uff09\n.\/l2tp.sh\n\n# \u811a\u672c\u6267\u884c\u5b8c\u6bd5\u540e\u4f1a\u51fa\u73b0\u4e0b\u5217\u754c\u9762\uff0c\u6b64\u5904\u8f93\u5165\u57fa\u7840\u73af\u5883\u4e2dip\u5730\u5740\u5bf9\u5e94\u7684\u8303\u56f4\u6bb5\u5373\u53ef\uff0c\u6b64\u5904\u4e3a\uff1a172.17.21\nPlease input IP-Range:\n(Default Range: 192.168.18):\n\u8f93\u5165\u672c\u5730IP\u6bb5\u8303\u56f4\uff08\u672c\u5730\u7535\u8111\u8fde\u63a5\u5230VPS\u540e\u7ed9\u5206\u914d\u7684\u4e00\u4e2a\u672c\u5730IP\u5730\u5740\uff09\uff0c\u76f4\u63a5\u56de\u8f66\u610f\u5473\u7740\u8f93\u5165\u9ed8\u8ba4\u503c192.168.18\n\n# \u6b64\u5904\u53ef\u81ea\u5b9a\u4e49\u8f93\u5165\nPlease input PSK:\n(Default PSK: teddysun.com):\nPSK\u610f\u4e3a\u9884\u5171\u4eab\u5bc6\u94a5\uff0c\u5373\u6307\u5b9a\u4e00\u4e2a\u5bc6\u94a5\u5c06\u6765\u5728\u8fde\u63a5\u65f6\u9700\u8981\u7528\u5230\uff0c\u76f4\u63a5\u56de\u8f66\u610f\u5473\u7740\u8f93\u5165\u9ed8\u8ba4\u503cteddysun.com\n\nPlease input Username:\n(Default Username: teddysun):\nUsername\u610f\u4e3a\u7528\u6237\u540d\uff0c\u5373\u7b2c\u4e00\u4e2a\u9ed8\u8ba4\u7528\u6237\u3002\u76f4\u63a5\u56de\u8f66\u610f\u5473\u7740\u8f93\u5165\u9ed8\u8ba4\u503cteddysun\n\nPlease input teddysun\u2019s password:\n(Default Password: Q4SKhu2EXQ):\n\u8f93\u5165\u7528\u6237\u7684\u5bc6\u7801\uff0c\u9ed8\u8ba4\u4f1a\u968f\u673a\u751f\u6210\u4e00\u4e2a10\u4f4d\u5305\u542b\u5927\u5c0f\u5199\u5b57\u6bcd\u548c\u6570\u5b57\u7684\u5bc6\u7801\uff0c\u5f53\u7136\u4f60\u4e5f\u53ef\u4ee5\u6307\u5b9a\u5bc6\u7801\u3002\n\nServerIP:your_server_main_IP\n\u663e\u793a\u4f60\u7684 VPS \u7684\u4e3b IP\uff08\u5982\u679c\u662f\u591a IP \u7684 VPS \u4e5f\u53ea\u663e\u793a\u4e00\u4e2a\uff09\n\nServer Local IP:192.168.18.1\n\u663e\u793a\u4f60\u7684 VPS \u7684\u672c\u5730 IP\uff08\u9ed8\u8ba4\u5373\u53ef\uff09\n\nClient Remote IP Range:192.168.18.2-192.168.18.254\n\u663e\u793a IP \u6bb5\u8303\u56f4\n\nPSK:teddysun.com\n\u663e\u793a PSK\n\nPress any key to start\u2026or Press Ctrl+c to cancel\n\u6309\u4e0b\u4efb\u610f\u6309\u952e\u7ee7\u7eed\uff0c\u5982\u679c\u60f3\u53d6\u6d88\u5b89\u88c5\uff0c\u8bf7\u6309Ctrl+c\u952e\n\n# \u7b49\u5f85\u5b89\u88c5\u7ed3\u679c\u5373\u53ef<\/code><\/pre>\n\n\n\n
\u57fa\u7840\u547d\u4ee4<\/h1>\n\n\n\n
# \u65b0\u589e\u7528\u6237\nl2tp -a \n# \u5220\u9664\u7528\u6237\nl2tp -d \n# \u4fee\u6539\u73b0\u6709\u7684\u7528\u6237\u7684\u5bc6\u7801\nl2tp -m \n# \u5217\u51fa\u6240\u6709\u7528\u6237\u540d\u548c\u5bc6\u7801\nl2tp -l \n# \u5217\u51fa\u5e2e\u52a9\u4fe1\u606f\nl2tp -h \n\n# \u67e5\u770b ipsec \u8fd0\u884c\u72b6\u6001\nipsec status\n# \u542f\u52a8 ipsec\nipsec start\n# \u505c\u6b62 ipsec\nipsec stop\n# \u91cd\u542f ipsec\nipsec restart\n# ipsec \u7b80\u4ecb:https:\/\/baike.baidu.com\/item\/IPSec\/2472311<\/code><\/pre>\n\n\n\n
\u5f00\u653eUDP\u7aef\u53e3<\/h1>\n\n\n\n
# \u653e\u884c500\u30014500\u7aef\u53e3<\/code><\/pre>\n\n\n\n
\u914d\u7f6e IPsec\/L2TP VPN \u5ba2\u6237\u7aef<\/h1>\n\n\n\n
\u914d\u7f6e\u539f\u6587\u8fde\u63a5<\/a><\/p>\n\n\n\n
\n\n\n\n