☰

Debian 10 上的 L2TP/IPSec VPN 无需网络管理器

tag-icon • tag-icon debian vpn l2tp
Debian 10 上的 L2TP/IPSec VPN 无需网络管理器

我有 2 台计算机 - 都运行 Debian 10。我需要将它们连接到同一个远程 VPN 服务器。一个有桌面管理器（带有网络管理器），另一个没有。我将把带有桌面管理器的一个称为 ，Debian GUI另一个称为Debian Server。

我已使用 Network Manager 成功连接Debian GUI到远程 VPN 服务器，但是我无法连接Debian Server到远程 VPN 服务器。

以下是网络管理器设置，出于隐私原因修改了详细信息：

My LAN IP address on client PC before turning on the VPN: 192.168.0.1
VPN Type: TTL2TP VPN
VPN Gateway public IP address: 100.100.100.100
Remote network domain: mywindowsdomain
Remote network username: me
Remote network password: mypassword
Enable IPSec tunnel to L2TP host: yes
Pre-shared key: mypresharedkey
Phase 1 Algorithms: aes256-md5-modp1024
Phase 2 Algorithms: aes256-md5
Enforce UDP encapsulation: yes
L2TP PPP authentication: MS Chap v2
Allow BSD data compression: yes
Allow deflate compression: yes
Use TCP header compression: yes
Use protocol field compression negotiation: yes
Use address/control compression: yes
MTU: 1400
MRU: 1400

网络管理员

网络管理器 ipsec 设置

网络管理器 ppp 设置

这些是我在网络管理器中使用的唯一设置，我能够成功连接到 上的远程 VPN 服务器Debian GUI。然而我一直无法在Debian Server.在Debian Server我安装了strongswan和xl2tpd.我不在乎我使用哪个客户端，只要我能让它工作即可，这些只是我在 Debian 10 中发现的可用客户端。我尝试像这样配置它们：

$ cat /etc/xl2tpd/xl2tpd.conf
[lac vpn-connection]
lns = 100.100.100.100
ppp debug = yes
pppoptfile = /etc/ppp/options.l2tpd.client
length bit = yes

$ cat /etc/sysctl.conf
net.ipv4.ip_forward = 1
net.ipv6.conf.all.forwarding = 1
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0

$ cat /etc/ipsec.secrets
include /var/lib/strongswan/ipsec.secrets.inc
192.168.0.1 100.100.100.100 : PSK "mypresharedkey"

$ cat /etc/ipsec.conf
config setup                                                                    
    virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12        
    nat_traversal=yes
    protostack=netkey
    plutoopts="--interface=eth0"
    strictcrlpolicy=yes
    uniqueids = no
conn L2TP-PSK
    pfs=no
    auto=add
    authby=secret
    # phase 1
    keyexchange=ikev1
    ike=aes256-md5-modp1024
    # phase 2
    esp=aes256-md5
    forceencaps=yes
    keyingtries=3
    dpddelay=30
    dpdtimeout=120
    dpdaction=clear
    rekey=yes
    ikelifetime=8h
    keylife=1h
    type=transport
    type=tunnel
    left=192.168.0.1
    leftprotoport=17/1701
    right=100.100.100.100
    rightprotoport=17/1701

include /var/lib/strongswan/ipsec.conf.inc

$ cat /etc/ppp/options.l2tpd.client
ipcp-accept-local
ipcp-accept-remote
refuse-eap
refuse-pap
refuse-chap
refuse-mschap
require-mschap-v2
nobsdcomp
nodeflate
noccp
noauth
idle 1800
mtu 1400
mru 1400
defaultroute
usepeerdns
debug
connect-delay 5000
name mywindowsdomain\\me
password mypassword

$ cat /etc/strongswan.conf
charon {
    # this line commented out on 2020-11-19
    #load_modular = yes
    plugins {
        include strongswan.d/charon/*.conf
    }
}

include strongswan.d/*.conf

如果诊断此问题所需的任何文件丢失，请告诉我，我可以在此处添加其内容。

然后我开始一切并得到以下结果：

$ sudo systemctl restart xl2tpd.service
$ sudo systemctl status xl2tpd.service 
● xl2tpd.service - LSB: layer 2 tunelling protocol daemon
   Loaded: loaded (/etc/init.d/xl2tpd; generated)
   Active: active (running) since Thu 2020-11-19 21:13:41 ACDT; 12s ago
     Docs: man:systemd-sysv-generator(8)
  Process: 11111 ExecStart=/etc/init.d/xl2tpd start (code=exited, status=0/SUCCESS)
    Tasks: 1 (limit: 4915)
   Memory: 876.0K
   CGroup: /system.slice/xl2tpd.service
           └─11112 /usr/sbin/xl2tpd

$ sudo systemctl restart strongswan.service
$ sudo systemctl status strongswan.service 
● strongswan.service - strongSwan IPsec IKEv1/IKEv2 daemon using ipsec.conf
   Loaded: loaded (/lib/systemd/system/strongswan.service; enabled; vendor preset: enabled)
   Active: active (running) since Thu 2020-11-19 21:17:16 ACDT; 9s ago
 Main PID: 11113 (starter)
    Tasks: 18 (limit: 4915)
   Memory: 3.4M
   CGroup: /system.slice/strongswan.service
           ├─11114 /usr/lib/ipsec/starter --daemon charon --nofork
           └─11115 /usr/lib/ipsec/charon

$ # all good so far i guess, but then this fails:
$ sudo ipsec up L2TP-PSK
initiating Main Mode IKE_SA L2TP-PSK[2] to 100.100.100.100
generating ID_PROT request 0 [ SA V V V V V ]
sending packet: from 192.168.0.1[500] to 100.100.100.100[500] (240 bytes)
received packet: from 100.100.100.100[500] to 192.168.0.1[500] (188 bytes)
parsed ID_PROT response 0 [ SA V V V V V ]
received NAT-T (RFC 3947) vendor ID
received DPD vendor ID
received unknown vendor ID: 88:77:44:11:55:aa:66:88:cc:aa:22:dd:00:00:00:00
received FRAGMENTATION vendor ID
received FRAGMENTATION vendor ID
selected proposal: IKE:AES_CBC_256/HMAC_MD5_96/PRF_HMAC_MD5/MODP_1024
generating ID_PROT request 0 [ KE No NAT-D NAT-D ]
sending packet: from 192.168.0.1[500] to 100.100.100.100[500] (236 bytes)
received packet: from 100.100.100.100[500] to 192.168.0.1[500] (220 bytes)
parsed ID_PROT response 0 [ KE No NAT-D NAT-D ]
local host is behind NAT, sending keep alives
generating ID_PROT request 0 [ ID HASH N(INITIAL_CONTACT) ]
sending packet: from 192.168.0.1[4500] to 100.100.100.100[4500] (92 bytes)
received packet: from 100.100.100.100[4500] to 192.168.0.1[4500] (76 bytes)
parsed ID_PROT response 0 [ ID HASH ]
IKE_SA L2TP-PSK[2] established between 192.168.0.1[192.168.0.1]...100.100.100.100[100.100.100.100]
scheduling reauthentication in 28017s
maximum IKE_SA lifetime 28557s
generating QUICK_MODE request 3034622638 [ HASH SA No ID ID ]
sending packet: from 192.168.0.1[4500] to 100.100.100.100[4500] (204 bytes)
received packet: from 100.100.100.100[4500] to 192.168.0.1[4500] (76 bytes)
parsed INFORMATIONAL_V1 request 3102838840 [ HASH N(NO_PROP) ]
received NO_PROPOSAL_CHOSEN error notify
establishing connection 'L2TP-PSK' failed

我使用的来源（我尝试了很多组合）：

https://wiki.archlinux.org/index.php/Openswan_L2TP/IPsec_VPN_client_setup https://github.com/xelerance/Openswan/wiki/L2tp-ipsec-configuration-using-openswan-and-xl2tpd http://manpages.ubuntu.com/manpages/bionic/man5/ipsec.conf.5.html

答案1

它在 IPsec 快速模式提案（即第 2 阶段提案）中失败，GUI 中的内容与文件中的内容不匹配ipsec.conf，缺少的感叹号可能很重要。

Debian 服务器是否根本不使用 NetworkManager 进行有线（或 WiFi）网络？ NetworkManager 有一个命令行界面。

您可以通过以下命令使用 NetworkManager CLI nmcli：

  • 列出所有 NM 连接：nmcli con
  • 打开 VPN 连接：nmcli con up id VPN-Connection-Name
  • 关闭 VPN 连接：nmcli con down id VPN-Connection-Name

在哪里VPN 连接名称是输出中列出的 VPN 连接的实际名称nmcli con。

/etc/NetworkManager/system-connections/您可以将存储在桌面计算机下的相应 NetworkManager VPN 连接配置文件复制到无头服务器。

要获取新的 VPN 连接配置文件（或编辑该文件时可能对其进行的更改），请发出以下命令：

  • nmcli con reload

请务必安装network-manager-l2tp，您将不需要 GNOME GUInetwork-manager-l2tp-gnome软件包。

相关内容