我需要在具有静态 NAT 的网关（假设其公共 IP 为172.31.0.105）和动态 NAT 后面的多个客户端之间配置 IPsec 隧道模式。
阅读一些资源（如这,这， 和这）我发现 roadwarrior 配置应该适合我的情况。
我已经正确地在我的网关和测试客户端中设置并启动了 racoon，当我尝试从客户端 ( ) 设置 VPN 时，racoonctl vc -u user 172.31.0.105我获得了服务器中指定的横幅。
但不知怎的，有些不对劲，他们无法沟通。
这是racoon.conf网关上的：
path certificate "/etc/racoon/certs";
listen {
adminsock disabled;
isakmp 172.31.0.105[500];
isakmp_natt 172.31.0.105[4500];
}
timer
{
natt_keepalive 600 sec;
}
# Phase 1 configuration
remote anonymous {
exchange_mode aggressive;
my_identifier asn1dn;
certificate_type x509 "cert.pem" "key.pem";
proposal_check claim;
generate_policy on;
verify_cert off;
nat_traversal on;
dpd_delay 20;
ike_frag on;
proposal {
authentication_method hybrid_rsa_server;
encryption_algorithm 3des;
hash_algorithm md5;
dh_group 2;
}
}
# Local network information
mode_cfg {
network4 172.31.0.200;
netmask4 255.255.255.0;
dns4 8.8.8.8;
#wins4 10.0.12.1;
pool_size 10;
auth_source system;
banner "/etc/racoon/motd";
pfs_group 2;
}
# Phase 2 proposal
sainfo anonymous {
pfs_group 2;
lifetime time 1 hour;
encryption_algorithm 3des;
authentication_algorithm hmac_md5;
compression_algorithm deflate;
}
这是racoon.conf测试客户端上的：
path certificate "/etc/racoon";
path pre_shared_key "/etc/racoon/psk.txt";
listen {
adminsock "/var/racoon/racoon.sock" "root" "operator" 0660;
}
# Here is the address of the VPN gateway
remote 172.31.0.105 {
exchange_mode aggressive;
ca_type x509 "cacert.pem";
proposal_check obey;
nat_traversal on;
ike_frag on;
mode_cfg on;
passive off;
verify_cert off;
script "/etc/racoon/phase1-up.sh" phase1_up;
script "/etc/racoon/phase1-down.sh" phase1_down;
proposal {
encryption_algorithm 3des;
hash_algorithm md5;
authentication_method hybrid_rsa_client;
dh_group 2;
}
}
sainfo anonymous {
pfs_group 2;
lifetime time 1 hour;
encryption_algorithm 3des;
authentication_algorithm hmac_md5;
compression_algorithm deflate ;
}
以下是 SPD 条目的转储，而 SAD 条目集为空：
root@test-client:/etc/racoon# setkey -PD
(per-socket policy)
Policy:[Invalid direciton]
created: Jan 1 02:28:49 1970 lastused:
lifetime: 0(s) validtime: 0(s)
spid=267 seq=1 pid=2489
refcnt=1
(per-socket policy)
Policy:[Invalid direciton]
created: Jan 1 02:28:49 1970 lastused:
lifetime: 0(s) validtime: 0(s)
spid=276 seq=2 pid=2489
refcnt=1
(per-socket policy)
Policy:[Invalid direciton]
created: Jan 1 02:28:49 1970 lastused:
lifetime: 0(s) validtime: 0(s)
spid=283 seq=3 pid=2489
refcnt=1
(per-socket policy)
Policy:[Invalid direciton]
created: Jan 1 02:28:49 1970 lastused:
lifetime: 0(s) validtime: 0(s)
spid=292 seq=4 pid=2489
refcnt=1
(per-socket policy)
Policy:[Invalid direciton]
created: Jan 1 02:28:50 1970 lastused:
lifetime: 0(s) validtime: 0(s)
spid=299 seq=5 pid=2489
refcnt=1
(per-socket policy)
Policy:[Invalid direciton]
created: Jan 1 02:28:50 1970 lastused:
lifetime: 0(s) validtime: 0(s)
spid=308 seq=6 pid=2489
refcnt=1
(per-socket policy)
Policy:[Invalid direciton]
created: Jan 1 02:28:50 1970 lastused:
lifetime: 0(s) validtime: 0(s)
spid=315 seq=7 pid=2489
refcnt=1
(per-socket policy)
Policy:[Invalid direciton]
created: Jan 1 02:28:50 1970 lastused:
lifetime: 0(s) validtime: 0(s)
spid=324 seq=8 pid=2489
refcnt=1
172.31.0.200[any] 0.0.0.0/0[any] any
out prio def ipsec
esp/tunnel/192.168.66.105-172.31.0.105/require
created: May 23 13:30:05 2014 lastused:
lifetime: 0(s) validtime: 0(s)
spid=345 seq=9 pid=2489
refcnt=1
0.0.0.0/0[any] 172.31.0.200[any] any
in prio def ipsec
esp/tunnel/172.31.0.105-192.168.66.105/require
created: May 23 13:30:05 2014 lastused:
lifetime: 0(s) validtime: 0(s)
spid=352 seq=10 pid=2489
refcnt=1
(per-socket policy)
Policy:[Invalid direciton]
created: May 23 13:38:00 2014 lastused:
lifetime: 0(s) validtime: 0(s)
spid=371 seq=11 pid=2489
refcnt=1
(per-socket policy)
Policy:[Invalid direciton]
created: May 23 13:38:00 2014 lastused:
lifetime: 0(s) validtime: 0(s)
spid=380 seq=12 pid=2489
refcnt=1
(per-socket policy)
Policy:[Invalid direciton]
created: May 23 13:38:01 2014 lastused:
lifetime: 0(s) validtime: 0(s)
spid=387 seq=13 pid=2489
refcnt=1
(per-socket policy)
Policy:[Invalid direciton]
created: May 23 13:38:01 2014 lastused:
lifetime: 0(s) validtime: 0(s)
spid=396 seq=0 pid=2489
refcnt=1
客户端成功设置新的网络接口：
eth0:1 Link encap:Ethernet HWaddr xx:xx:xx:xx:xx:xx
inet addr:172.31.0.200 Bcast:172.31.255.255 Mask:255.255.0.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
但是当我从网关尝试使用此虚拟 IP ( 172.31.0.200) ping 客户端（或者也建立 netcat 会话）时，我得到一个
Destination Host Unreachable