На моем сервере Ubuntu 16.04 служба xl2tpd
работает успешно.
Мой /etc/ipsec.conf
:
version 2.0
config setup
nat_traversal=yes
oe=off
protostack=netkey
conn L2TP-PSK
authby=secret
pfs=no
rekey=no
type=tunnel
esp=aes128-sha1
ike=aes128-sha-modp1024
ikelifetime=8h
keylife=1h
left=51.15.67.126
leftnexthop=%defaultroute
leftprotoport=17/1701
right=%any
rightprotoport=17/%any
rightsubnetwithin=0.0.0.0/0
auto=add
dpddelay=30
dpdtimeout=120
dpdaction=clear
Мой /etc/ipsec.secrets
:
%any %any: PSK "MySecret"
Мой /etc/xl2tpd/xl2tpd.conf
:
[global]
ipsec saref = yes
[lns default]
ip range = 192.168.1.231-192.168.1.239
local ip = 192.168.1.230
refuse chap = yes
refuse pap = yes
require authentication = yes
ppp debug = no
pppoptfile = /etc/ppp/options.xl2tpd
length bit = yes
Мой /etc/ppp/options.xl2tpd
:
require-mschap-v2
ms-dns 8.8.8.8
ms-dns 8.8.4.4
asyncmap 0
auth
crtscts
lock
hide-password
modem
debug
name l2tpd
proxyarp
lcp-echo-interval 30
lcp-echo-failure 4
Мой / etc / ppp / chap-secrets
:
* * MyText *
Мой / etc /rc.local[1178331 provided:[12115 visiblejournalctl -xe
output:
Jun 05 14:29:07 vkmarket.ru kernel: random: nonblocking pool is initialized
Jun 05 14:29:08 vkmarket.ru charon[3375]: 11[NET] received packet: from 92.63.69.35[478] to 10.8.76.29[500] (444 bytes)
Jun 05 14:29:08 vkmarket.ru charon[3375]: 11[ENC] parsed ID_PROT request 0 [ SA V V V V V V ]
Jun 05 14:29:08 vkmarket.ru charon[3375]: 11[IKE] no IKE config found for 10.8.76.29...92.63.69.35, sending NO_PROPOSAL_CHOSEN
Jun 05 14:29:08 vkmarket.ru charon[3375]: 11[ENC] generating INFORMATIONAL_V1 request 1643143040 [ N(NO_PROP) ]
Jun 05 14:29:08 vkmarket.ru charon[3375]: 11[NET] sending packet: from 10.8.76.29[500] to 92.63.69.35[478] (40 bytes)
Jun 05 14:29:11 vkmarket.ru charon[3375]: 12[NET] received packet: from 92.63.69.35[478] to 10.8.76.29[500] (444 bytes)
Jun 05 14:29:11 vkmarket.ru charon[3375]: 12[ENC] parsed ID_PROT request 0 [ SA V V V V V V ]
Jun 05 14:29:11 vkmarket.ru charon[3375]: 12[IKE] no IKE config found for 10.8.76.29...92.63.69.35, sending NO_PROPOSAL_CHOSEN
Jun 05 14:29:11 vkmarket.ru charon[3375]: 12[ENC] generating INFORMATIONAL_V1 request 2523483634 [ N(NO_PROP) ]
Jun 05 14:29:11 vkmarket.ru charon[3375]: 12[NET] sending packet: from 10.8.76.29[500] to 92.63.69.35[478] (40 bytes)
Jun 05 14:29:14 vkmarket.ru charon[3375]: 13[NET] received packet: from 92.63.69.35[478] to 10.8.76.29[500] (444 bytes)
Jun 05 14:29:14 vkmarket.ru charon[3375]: 13[ENC] parsed ID_PROT request 0 [ SA V V V V V V ]
Jun 05 14:29:14 vkmarket.ru charon[3375]: 13[IKE] no IKE config found for 10.8.76.29...92.63.69.35, sending NO_PROPOSAL_CHOSEN
Jun 05 14:29:14 vkmarket.ru charon[3375]: 13[ENC] generating INFORMATIONAL_V1 request 3268885545 [ N(NO_PROP) ]
Jun 05 14:29:14 vkmarket.ru charon[3375]: 13[NET] sending packet: from 10.8.76.29[500] to 92.63.69.35[478] (40 bytes)
Jun 05 14:29:36 vkmarket.ru systemd[1]: sys-subsystem-net-devices-eth0.device: Job sys-subsystem-net-devices-eth0.device/start timed out.
Jun 05 14:29:36 vkmarket.ru systemd[1]: Timed out waiting for device sys-subsystem-net-devices-eth0.device.
-- Subject: Unit sys-subsystem-net-devices-eth0.device has failed
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
--
-- Unit sys-subsystem-net-devices-eth0.device has failed.
--
-- The result is timeout.
Jun 05 14:29:36 vkmarket.ru systemd[1]: sys-subsystem-net-devices-eth0.device: Job sys-subsystem-net-devices-eth0.device/start failed with result 'timeout'.
Jun 05 14:29:36 vkmarket.ru systemd[1]: Startup finished in 19.348s (kernel) + 1min 30.912s (userspace) = 1min 50.261s.
-- Subject: System start-up is now complete
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
--
-- All system services necessary queued for starting at boot have been
-- successfully started. Note that this does not mean that the machine is
-- now idle as services might still be busy with completing start-up.
--
-- Kernel start-up required 19348529 microseconds.
--
-- Initial RAM disk start-up required INITRD_USEC microseconds.
--
-- Userspace start-up required 90912634 microseconds.
Jun 05 14:35:01 vkmarket.ru CRON[3950]: pam_unix(cron:session): session opened for user root by (uid=0)
Jun 05 14:35:01 vkmarket.ru CRON[3954]: (root) CMD (command -v debian-sa1 > /dev/null && debian-sa1 1 1)
Jun 05 14:35:01 vkmarket.ru CRON[3950]: pam_unix(cron:session): session closed for user root
Jun 05 14:43:08 vkmarket.ru systemd[1]: Starting Cleanup of Temporary Directories...
-- Subject: Unit systemd-tmpfiles-clean.service has begun start-up
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
--
-- Unit systemd-tmpfiles-clean.service has begun starting up.
Jun 05 14:43:08 vkmarket.ru systemd-tmpfiles[3979]: [/usr/lib/tmpfiles.d/var.conf:14] Duplicate line for path "/var/log", ignoring.
Jun 05 14:43:08 vkmarket.ru systemd[1]: Started Cleanup of Temporary Directories.
-- Subject: Unit systemd-tmpfiles-clean.service has finished start-up
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
--
-- Unit systemd-tmpfiles-clean.service has finished starting up.
--
-- The start-up result is done.
В вашем журнале я не вижу свидетельств работы xl2tp, возможно, служба не запущена или не активна (ошибки конфигурации?).
Попробуйте эту настройку, она мне очень помогла: (источник: strongSwan + xl2tpd VPN-сервер: как настроить несколько файлов конфигурации? )
Не используйте агрессивный режим, соединение будет менее безопасным. В любом случае попробуйте с этой конфигурацией. Я использую его на своем VPN-сервере с strongswan-5.3.5 и xl2tpd-1.3.6
ipsec.conf
настройка конфигурации cachecrls = да uniqueids = да charondebug = "" conn% по умолчанию keyingtries =% навсегда dpddelay = 30 с dpdtimeout = 120 с подключение L2TP dpdaction = clear # IP-адрес сервера left = 192.168.1.130 # Шлюз по умолчанию для сервера leftnexthop = 192.168.1.254 leftprotoport = 17/1701 rightprotoport = 17 /% любое right =% любой rightubnet = 0.0.0.0 / 0 leftauth = psk rightauth = psk leftid = "
" ikelifetime = 1 час keylife = 8h ike = aes128-sha1-modp1536, aes128-sha1-modp1024, aes128-md5-modp1536, aes128-md5-modp1024,3des-sha1-modp1536,3des-sha1-modp1024,3des-md5-modp1536,3des-md10245-modp esp = aes128-sha1-modp1536, aes128-sha1-modp1024, aes128-md5-modp1536, aes128-md5-modp1024,3des-sha1-modp1536,3des-sha1-modp1024,3des-md5-modp1536,3des-md10245-modp auto = добавить keyexchange = ike тип = транспорт блок подключения auto = игнорировать conn private auto = игнорировать conn private-or-clear auto = игнорировать conn clear-or-private auto = игнорировать conn clear auto = игнорировать conn packetdefault auto = игнорировать ipsec.secrets
% any: PSK "<мой- пароль>" /etc/xl2tpd/xl2tpd.conf
[глобальный] ipsec saref = нет отладочный туннель = нет отладка avp = нет сеть отладки = нет состояние отладки = нет [lns по умолчанию] диапазон ip = 10.0.0.20-10.0.0.30 локальный IP = 10.0.0.1 требуется аутентификация = да name = l2tp передать peer = да ppp debug = нет pppoptfile = /etc/ppp/options.xl2tpd бит длины = да аутентификация unix = да
/etc/ppp/options.xl2tpd
ipcp-accept-local ipcp-accept-remote мс-днс 10.0.0.1 авторизация холостой ход 1800 MTU 1200 mru 1200 nodefaultroute замок proxyarp подключение-задержка 5000 имя l2tpd ifname l2tp авторизоваться
/ etc / ppp / chap-secrets
имя пользователя * "l2tppassword" *
перезапустить службы
sudo service strongswan restart sudo service xl2tpd перезапуск