yum install xl2tpd
yum install -y libreswan
vim /etc/ipsec.d/l2tp_psk.conf
conn L2TP-PSK-NAT
rightsubnet=vhost:%priv
also=L2TP-PSK-noNAT
conn L2TP-PSK-noNAT
authby=secret
pfs=no
auto=add
keyingtries=3
dpddelay=30
dpdtimeout=120
dpdaction=clear
rekey=no
ikelifetime=8h
keylife=1h
type=transport
left=172.16.100.99
leftprotoport=17/1701
right=%any
rightprotoport=17/%any
vim /etc/ipsec.d/ipsec.secrets
: PSK "jtvpnpsk"
vim /etc/ppp/chap-secrets
jtkjvpn * JtkjVPN123 *
vim /etc/sysctl.conf
net.ipv4.ip_forward = 1
# for ipsec
net.ipv4.conf.default.rp_filter = 0
net.ipv4.conf.default.send_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv4.conf.all.rp_filter = 0
net.ipv4.conf.em1.rp_filter = 0
net.ipv4.conf.em2.rp_filter = 0
net.ipv4.conf.em3.rp_filter = 0
net.ipv4.conf.em4.rp_filter = 0
net.ipv4.conf.docker0.rp_filter = 0
systemctl enable ipsec
systemctl start ipsec
systemctl status ipsec
ipsec verify
systemctl restart ipsec
vim /etc/xl2tpd/xl2tpd.conf
ip range = 172.18.1.10-172.18.1.250
local ip = 172.18.1.11
vim /etc/ppp/options.xl2tpd
require-mschap-v2
ipcp-accept-local
ipcp-accept-remote
ms-dns 10.96.0.10
yum install iptables-services
iptables -t nat -A POSTROUTING -s 172.18.1.10/24 -o em1 -j MASQUERADE
iptables -I FORWARD -s 172.18.1.10/24 -j ACCEPT
iptables -I FORWARD -d 172.18.1.10/24 -j ACCEPT
iptables -A INPUT -p udp -m policy --dir in --pol ipsec -m udp --dport 1701 -j ACCEPT
iptables -A INPUT -p udp -m udp --dport 1701 -j ACCEPT
iptables -A INPUT -p udp -m udp --dport 500 -j ACCEPT
iptables -A INPUT -p udp -m udp --dport 4500 -j ACCEPT
iptables -A INPUT -p esp -j ACCEPT
iptables -A INPUT -m policy --dir in --pol ipsec -j ACCEPT
iptables -A FORWARD -i ppp+ -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
service iptables save
# vim /etc/sysconfig/iptables
-A INPUT -i ppp+ -j ACCEPT
-A INPUT -p tcp -m tcp --dport 1723 -j ACCEPT
-A INPUT -p gre -j ACCEPT
-A INPUT -p udp -m policy --dir in --pol ipsec -m udp --dport 1701 -j ACCEPT
-A INPUT -p udp -m udp --dport 1701 -j ACCEPT
-A INPUT -p udp -m udp --dport 500 -j ACCEPT
-A INPUT -p udp -m udp --dport 4500 -j ACCEPT
-A INPUT -p esp -j ACCEPT
-A INPUT -m policy --dir in --pol ipsec -j ACCEPT
-A FORWARD -d 172.18.1.0/24 -j ACCEPT
-A FORWARD -s 172.18.1.0/24 -j ACCEPT
-A FORWARD -i ppp+ -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j TCPMSS --set-mss 1356
-A FORWARD -j ACCEPT
-A FORWARD -i ppp+ -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -o ppp+ -j ACCEPT
-A OUTPUT -p gre -j ACCEPT
-A DOCKER-ISOLATION-STAGE-1 -i docker0 ! -o docker0 -j DOCKER-ISOLATION-STAGE-2
-A DOCKER-ISOLATION-STAGE-1 -j RETURN
-A DOCKER-ISOLATION-STAGE-2 -o docker0 -j DROP
-A DOCKER-ISOLATION-STAGE-2 -j RETURN
-A DOCKER-USER -j RETURN
COMMIT
# Completed on Wed Dec 28 10:09:03 2022
# Generated by iptables-save v1.4.21 on Wed Dec 28 10:09:03 2022
*nat
:PREROUTING ACCEPT [99:6637]
:INPUT ACCEPT [70:4486]
:OUTPUT ACCEPT [168:10504]
:POSTROUTING ACCEPT [5:300]
:DOCKER - [0:0]
-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER
-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER
-A POSTROUTING -s 169.254.32.0/28 ! -o docker0 -j MASQUERADE
-A POSTROUTING -o em1 -j MASQUERADE
-A POSTROUTING -o ppp+ -j MASQUERADE
-A POSTROUTING -s 172.16.26.0/24 -j SNAT --to-source 172.16.100.99
-A POSTROUTING -s 172.16.26.0/24 -o em1 -j MASQUERADE
-A POSTROUTING -o em1 -j MASQUERADE
-A POSTROUTING -s 172.18.1.0/24 -o em1 -j MASQUERADE
-A DOCKER -i docker0 -j RETURN
COMMIT
# Completed on Wed Dec 28 10:09:03 2022
VIM Linux Life