Linode announced a new facility in Tokyo, Japan at September 20, 2011. It’s a big good news for us inside the wall. The download speed, and latency, is pretty awesome!!
I migrated my linode(actually it belongs to my boss) from USA to Tokyo with no doubt. And rebuild it from Ubuntu to Gentoo. As a desktop, Ubuntu plays so good so far.But as a server, Ubuntu sucks !!
OK, everything is ready, all we need is a L2TP VPN server.
Here is my L2TP VPN configuration.
First of all, choose a faster mirror server, this is my selection: gentoo.channelx.biz, chosen from mirrorselect (emerge mirrorselect). And add it to /etc/make.conf, replace the original one.
U can run this command if u don’t have an original GENTOO_MIRRORS config in /etc/make.conf.
echo 'GENTOO_MIRRORS="http://gentoo.channelx.biz/" ' >> /etc/make.conf
The software we need: openswan , xl2tpd , ppp. We can install them all with the ‘emerge’ command, but I found there’s something wrong with the openswan (v2.4.15-r2), we must upgrade openswan to version 2.6.31, even though this version is masked.
Solve the masked problem:
echo 'EMERGE_DEFAULT_OPTS="--autounmask=n" ' >> /etc/make.conf
echo '=net-misc/openswan-2.6.31 ' >> /etc/portage/package.accept_keywords
OK, install it:
emerge =net-misc/openswan-2.6.31
Let’s do some copy and paste.
Configure the ipsec.
copy the content of /etc/ipsec.d/examples/sysctl.conf to /etc/sysctl.conf ,and make sure the rp_filter options are commented.
# Enables source route verification
#net.ipv4.conf.default.rp_filter = 1
# Enable reverse path
#net.ipv4.conf.all.rp_filter = 1
u can run this command:
cat /etc/ipsec.d/examples/sysctl.conf >> /etc/sysctl.conf
and active the sysctl.conf:
Edit the /etc/ipsec.conf :
echo 'include /etc/ipsec.d/examples/l2tp-psk.conf' >> /etc/ipsec.conf
when ignore the commented line:
#cat /etc/ipsec.conf | egrep -v "^[[:space:]]*#" | grep -v "^$"
conn L2TP-PSK-NAT
rightsubnet=vhost:%priv
also=L2TP-PSK-noNAT
conn L2TP-PSK-noNAT
authby=secret
pfs=no
auto=add
keyingtries=3
rekey=no
ikelifetime=8h
keylife=1h
type=transport
left=YourPublicIP
leftprotoport=17/1701
right=%any
rightprotoport=17/0
conn passthrough-for-non-l2tp
type=passthrough
left=YourPublicIP
leftnexthop=YourGatewayIP
right=0.0.0.0
rightsubnet=0.0.0.0/0
auto=routeand remember to replace the “YourPublicIP” , “YourGatewayIP” to the correct value.
edit /etc/ipsec.secrets :
YourIPAddress %any: PSK "sharedsecret"
do the same replacement.
Configure the iptables.
iptables -t nat -A POSTROUTING -j MASQUERADE
/etc/init.d/iptables save
rc-updat add iptables default
Configure xl2tpd :
# cat /etc/xl2tpd/xl2tpd.conf
[global]
ipsec saref = yes
[lns default]
ip range = 172.16.80.128-172.16.80.254
local ip = 172.16.80.1
require chap = yes
refuse pap = yes
require authentication = yes
name = xl2tpd
ppp debug = yes
pppoptfile = /etc/ppp/options.xl2tpd
length bit = yes
Configure PPP :
# cat /etc/ppp/options.xl2tpd
ipcp-accept-local
ipcp-accept-remote
ms-dns 8.8.8.8
ms-dns 8.8.4.4
noccp
auth
crtscts
idle 1800
mtu 1410
mru 1410
nodefaultroute
debug
lock
proxyarp
connect-delay 5000
# cat /etc/ppp/chap-secrets
Username xl2tpd Password *
do some replacement here.
start the services:
/etc/init.d/ipsec start
/etc/init.d/xl2tpd start
Have fun .
PS: ipsec verify failed ?
Pluto listening for IKE on udp 500 [FAILED]
Cannot execute command "lsof -i UDP:500": No such file or directory
Pluto listening for NAT-T on udp 4500 [FAILED]
Cannot execute command "lsof -i UDP:4500": No such file or directory
it’s all right, because the command ‘lsof‘ is missing, just ‘emerge lsof‘
Reference:
http://riobard.com/blog/2010-04-30-l2tp-over-ipsec-ubuntu/
http://apple4.us/2010/05/setting-up-l2tp-vpn-on-debian-ubuntu.html
http://forums.gentoo.org/viewtopic-t-324500-highlight-openswan.html (the ppp configuration part, it’s different between gentoo and ubuntu)
——————————
update: 2011-09-26
If u can connect successfully at the first time, but failed at the second. Here’s the solution.
Add the following lines to your L2TP-PSK-noNAT connection and restart ipsec (/etc/init.d/ipsec restart )
dpddelay=40
dpdtimeout=130
dpdaction=clear
Reference:
http://lists.openswan.org/pipermail/users/2011-January/019945.html
