![如何自动启动 swanctl.conf 配置的隧道](https://linux22.com/image/165559/%E5%A6%82%E4%BD%95%E8%87%AA%E5%8A%A8%E5%90%AF%E5%8A%A8%20swanctl.conf%20%E9%85%8D%E7%BD%AE%E7%9A%84%E9%9A%A7%E9%81%93.png)
环境:Debian 10、KDE、完整桌面
# ipsec --version
Linux strongSwan U5.7.2/K4.19.0-6-amd64
# swanctl --version
strongSwan swanctl 5.7.2
# systemctl status strongswan
● strongswan.service - strongSwan IPsec IKEv1/IKEv2 daemon using ipsec.conf
Loaded: loaded (/lib/systemd/system/strongswan.service; enabled; vendor preset: enabled)
Active: inactive (dead) since Fri 2019-12-13 09:35:03 -03; 4h 34min ago
Process: 6067 ExecStart=/usr/sbin/ipsec start --nofork (code=exited, status=0/SUCCESS)
Main PID: 6067 (code=exited, status=0/SUCCESS)
# systemctl status strongswan-swanctl
● strongswan-swanctl.service - strongSwan IPsec IKEv1/IKEv2 daemon using swanctl
Loaded: loaded (/lib/systemd/system/strongswan-swanctl.service; enabled; vendor preset: enabled)
Active: active (running) since Fri 2019-12-13 09:11:34 -03; 4h 56min ago
Main PID: 6373 (charon-systemd)
Status: "charon-systemd running, strongSwan 5.7.2, Linux 4.19.0-6-amd64, x86_64"
Tasks: 17 (limit: 4915)
Memory: 8.5M
CGroup: /system.slice/strongswan-swanctl.service
└─6373 /usr/sbin/charon-systemd
在花了近两天的时间学习和研究 IPSec 和 IKEv2 之后,我成功地使用strongswan 和 swanctl 连接到公司网关(Lancom LCOS、IKEv2 PSK、User-FQDN 身份)。
重新启动后,我必须运行以下命令:
sudo /usr/sbin/swanctl --load-all
no files found matching '/etc/swanctl/conf.d/*.conf'
loaded ike secret 'ike'
no authorities found, 0 unloaded
no pools found, 0 unloaded
loaded connection 'IKEv2PSK'
successfully loaded 1 connections, 0 unloaded
进而sudo /usr/sbin/swanctl --initiate --child myVpn
[IKE] establishing CHILD_SA myVpn{2}
... lots of log lines ...
initiate completed successfully
我想让隧道自动启动,也许使用类似的 systemd 单元
sudo systemctl swanctl-myVpn start
但是我没有找到任何文档如何实现这一点,这也让我想知道这是否是一个坏主意?
答案1
@ecdsa 为我指明了正确的方向。start_action
在配置中添加 a是解决方案:
connections {
IKEv2PSK {
remote_addrs = SOME.DYNDNS-IP.COM, 81.81.81.81
vips = 0.0.0.0
version = 2
dpd_delay = 30
dpd_timeout = 90
proposals = aes256-sha256-modp2048
local {
auth = psk
id = @@[email protected]
}
remote {
auth = psk
id = 81.81.81.81
}
children {
anicVpn {
remote_ts = 192.168.0.0/24
updown = /usr/lib/ipsec/_updown iptables
esp_proposals = aes256-sha256-modp2048
start_action = trap # <----- trap: on traffic | start: on boot
}
}
}
}
现在,对服务器进行简单的 ping 操作即可启动隧道。该选项start
还可用于在系统启动时直接启动并运行隧道。来源:swanctl.conf
更新
请注意,这在 Ubuntu 中不起作用,因为 AppArmor 会阻止 updown 脚本开箱即用
答案2
通过将以下内容添加到文件中,我可以获得start_action = start
在 Ubuntu 上工作的选项/etc/strongswan.d/charon.conf
:
# Section containing a list of scripts (name = path) that are executed when
# the daemon is started.
start-scripts {
swanctl-creds = swanctl --load-creds --noprompt
swanctl-conns = swanctl --load-conns
}