抱歉，我又要问关于 Strongswan 的问题了。我创建了 Strongswan 服务器，它一方面有多个网络，另一方面是通过 FreeRADIUS EAP-MSCHAPv2 授权的客户端。客户端通过 ipsec.conf 中的类属性和适当的连接定义对网络中的特定 IP 地址具有访问权限：
config setup
charondebug="all"
uniqueids=yes
strictcrlpolicy=no
conn %default
keyexchange=ikev2
conn tunnel
reauth=no
rightsendcert=never
left=87.236.194.XX
leftsubnet=192.168.80.0/24
right=%any
rightsubnet=0.0.0.0/0
keyingtries=0
ikelifetime=1h
lifetime=8h
dpddelay=30
dpdtimeout=120
dpdaction=clear
authby=secret
auto=route
type=tunnel
conn eap-radius
reauth=no
rekey=no
forceencaps=yes
fragmentation=yes
left=%defaultroute
leftauth=pubkey
leftcert=host-vpn.der
leftsendcert=always
leftfirewall=yes
leftsubnet=0.0.0.0/0
[email protected]
lefthostaccess=yes
right=%any
rightsourceip=192.168.80.0/24
rightdns=8.8.8.8
rightauth=eap-radius
rightgroups=Class1
eap_identity=%identity
auto=add
conn eap-radius10
reauth=no
rekey=no
forceencaps=yes
fragmentation=yes
left=%defaultroute
leftauth=pubkey
leftcert=host-vpn.der
leftsendcert=always
leftfirewall=yes
leftsubnet=192.168.10.2/31,192.168.10.4/30,192.168.10.8/29,192.168.10.16/28,192.168.10.32/27,192.168.10.64/26,192.168.10.128/26,192.168.10.192/27,192.168.10.224/28,192.168.10.240/29,192.168.10.248/30,192.168.10.252/31,192.168.10.254/32
[email protected]
lefthostaccess=yes
right=%any
rightsourceip=192.168.80.0/24
rightdns=8.8.8.8
rightauth=eap-radius
rightgroups=Class10
eap_identity=%identity
auto=add
conn eap-radius20
reauth=no
rekey=no
forceencaps=yes
fragmentation=yes
left=%defaultroute
leftauth=pubkey
leftcert=host-vpn.der
leftsendcert=always
leftfirewall=yes
leftsubnet=192.168.20.2/31,192.168.20.4/30,192.168.20.8/29,192.168.20.16/28,192.168.20.32/27,192.168.20.64/26,192.168.20.128/26,192.168.20.192/27,192.168.20.224/28,192.168.20.240/29,192.168.20.248/30,192.168.20.252/31,192.168.20.254/32
[email protected]
lefthostaccess=yes
right=%any
rightsourceip=192.168.80.0/24
rightdns=8.8.8.8
rightauth=eap-radius
rightgroups=Class20
eap_identity=%identity
auto=add
在 Debian 防火墙中我有以下几行：
-A POSTROUTING -s 192.168.80.0/24 -o eth0 -m policy --dir out --pol ipsec -j ACCEPT
-A POSTROUTING -s 192.168.80.0/24 -o eth0 -j MASQUERADE
我的问题是，除 Windows 10 客户端外，所有 Android、iOS 和 Mac OSX 客户端都可以访问适当的特定地址和互联网。由于以前版本的 Windows 10 中的 VPN 连接向导由于此向导中的一些 Microsoft 错误而无法正确创建 EAP-MSCHAPv2 IKEv2 VPN 连接，我已将以下 rasphone.pbk 复制到 C:\Users\XXXX\AppData\Roaming\Microsoft\Network\Connections\Pbk Windows 文件夹
[radius]
Encoding=1
PBVersion=4
Type=2
AutoLogon=0
UseRasCredentials=1
LowDateTime=-1192997568
HighDateTime=30663332
DialParamsUID=191937
Guid=2F7BD8C93E1B8E4885FD6AB316030199
VpnStrategy=7
ExcludedProtocols=0
LcpExtensions=1
DataEncryption=8
SwCompression=0
NegotiateMultilinkAlways=0
SkipDoubleDialDialog=0
DialMode=0
OverridePref=15
RedialAttempts=3
RedialSeconds=60
IdleDisconnectSeconds=0
RedialOnLinkFailure=1
CallbackMode=0
CustomDialDll=
CustomDialFunc=
CustomRasDialDll=
ForceSecureCompartment=0
DisableIKENameEkuCheck=0
AuthenticateServer=0
ShareMsFilePrint=1
BindMsNetClient=1
SharedPhoneNumbers=0
GlobalDeviceSettings=0
PrerequisiteEntry=
PrerequisitePbk=
PreferredPort=VPN2-0
PreferredDevice=WAN Miniport (IKEv2)
PreferredBps=0
PreferredHwFlow=1
PreferredProtocol=1
PreferredCompression=1
PreferredSpeaker=1
PreferredMdmProtocol=0
PreviewUserPw=0
PreviewDomain=0
PreviewPhoneNumber=0
ShowDialingProgress=0
ShowMonitorIconInTaskBar=0
CustomAuthKey=26
CustomAuthData=314442431A00000008000000010000000000000000000000
AuthRestrictions=128
IpPrioritizeRemote=1
IpInterfaceMetric=0
IpHeaderCompression=0
IpAddress=0.0.0.0
IpDnsAddress=0.0.0.0
IpDns2Address=0.0.0.0
IpWinsAddress=0.0.0.0
IpWins2Address=0.0.0.0
IpAssign=1
IpNameAssign=1
IpDnsFlags=0
IpNBTFlags=1
TcpWindowSize=0
UseFlags=2
IpSecFlags=0
IpDnsSuffix=
Ipv6Assign=1
Ipv6Address=::
Ipv6PrefixLength=0
Ipv6PrioritizeRemote=1
Ipv6InterfaceMetric=0
Ipv6NameAssign=1
Ipv6DnsAddress=::
Ipv6Dns2Address=::
Ipv6Prefix=0000000000000000
Ipv6InterfaceId=0000000000000000
DisableClassBasedDefaultRoute=0
DisableMobility=0
NetworkOutageTime=0
ProvisionType=0
PreSharedKey=
CacheCredentials=1
NumCustomPolicy=0
NumEku=0
UseMachineRootCert=0
NumServers=0
RouteVersion=1
NumRoutes=0
NumNrptRules=0
AutoTiggerCapable=0
NumAppIds=0
NumClassicAppIds=0
SecurityDescriptor=
ApnInfoProviderId=
ApnInfoUsername=
ApnInfoPassword=
ApnInfoAccessPoint=
ApnInfoAuthentication=1
ApnInfoCompression=0
DeviceComplianceEnabled=0
DeviceComplianceSsoEnabled=0
DeviceComplianceSsoEku=
DeviceComplianceSsoIssuer=
FlagsSet=0
Options=0
DisableDefaultDnsSuffixes=0
NumTrustedNetworks=0
NumDnsSearchSuffixes=0
PowershellCreatedProfile=0
ProxyFlags=0
ProxySettingsModified=0
ProvisioningAuthority=
AuthTypeOTP=0
GREKeyDefined=0
NumPerAppTrafficFilters=0
AlwaysOnCapable=0
PrivateNetwork=0
NETCOMPONENTS=
ms_msclient=1
ms_server=1
MEDIA=rastapi
Port=VPN2-0
Device=WAN Miniport (IKEv2)
DEVICE=vpn
PhoneNumber=ikev2.domain.cz
AreaCode=
CountryCode=0
CountryID=0
UseDialingRules=0
Comment=
FriendlyName=
LastSelectedPhone=0
PromoteAlternates=0
TryNextAlternateOnFail=1
此类 Windows VPN 客户端能够正确连接到远程网络中的相应 IP，但无法访问互联网，但有一个例外 - 当通过 RADIUS 选择的连接定义（leftsubnet=0.0.0.0/0）时，互联网访问有效。当 VPN 连接的高级 TCP/IP 设置中的使用远程网络上的默认网关选项启用时（IpPrioritizeRemote=1），客户端可以访问远程网络但不能访问互联网，如果禁用此选项，客户端可以访问互联网但不能访问任何远程网络。
我没有路由方面的经验，但我认为应该可以配置 Windows VPN 连接，使其表现得像正常工作的 Android、iOS 和 OSX 连接一样，除了可以访问特定的 IP 地址之外，还可以访问互联网。
对于任何帮助提前感谢
答案1
ecdsa 谢谢你为我指明了正确的方向。解决方案最终非常简单。我以管理员身份从 PowerShell 创建了新连接：
Add-VpnConnection -Name "radius" -ServerAddress "ikev2.domain.cz" –TunnelType IKEv2 -EncryptionLevel Required -AuthenticationMethod EAP -SplitTunneling –AllUserConnection
然后我添加了路线：
Add-VpnConnectionRoute -ConnectionName "radius" -DestinationPrefix 192.168.10.0/24 -PassThru
Add-VpnConnectionRoute -ConnectionName "radius" -DestinationPrefix 192.168.20.0/24 -PassThru
现在，Windows 客户端运行顺畅，并且也可以访问适当的 IP 和互联网。