☰

从 CLI 连接到 IPSec IKEv2 VPN

tag-icon • tag-icon vpn amazon-ec2 ipsec
从 CLI 连接到 IPSec IKEv2 VPN

我已经按照此步骤在 AWS ec2 实例上设置了 IPSec VPNhttps://github.com/hwdsl2/setup-ipsec-vpn。VPN 运行良好，我能够从我的手机和笔记本电脑（Android、Windows、OSX）连接到它。现在我想从另一个 ec2 实例连接到它。我试过这个：https://github.com/hwdsl2/setup-ipsec-vpn/blob/master/docs/ikev2-howto.md#linux但它不起作用，因为它需要 GUI，而 ec2 没有 GUI。我已将 .p12 文件传输到新创建的 ec2 实例，但无法对其进行配置。

在寻找解决方案时，我从 Chat GPT 获得了以下信息：

#!/bin/bash

# Set variables
VPN_SERVER="vpn.trebuchet.one"
P12_FILE="$HOME/vpn.p12"
P12_PASSWORD="<P12_PASSWORD>"

# Install StrongSwan
sudo apt-get update
sudo apt-get install -y strongswan

# Create VPN configuration directory
sudo mkdir -p /etc/ipsec.d/myvpn

# Copy .p12 file to VPN configuration directory
sudo cp "$P12_FILE" /etc/ipsec.d/myvpn/myvpn.p12

# Create VPN configuration file
sudo bash -c "cat > /etc/ipsec.d/myvpn/myvpn.conf << EOL
conn myvpn
    keyexchange=ikev2
    dpdaction=clear
    dpddelay=300s
    eap_identity=%identity
    leftauth=eap-tls
    leftcert=myvpn.p12
    leftsourceip=%config
    right=$VPN_SERVER
    rightauth=pubkey
    rightsubnet=0.0.0.0/0
    rightid=%any
    type=tunnel
    auto=add
EOL"

# Update /etc/ipsec.secrets file with .p12 password
sudo bash -c "echo ': P12 myvpn.p12 \"$P12_PASSWORD\"' >> /etc/ipsec.secrets"

# Restart StrongSwan service
sudo systemctl restart strongswan

# Initiate VPN connection
sudo ipsec up myvpn

echo "VPN connection established"

运行这个我得到：

no config named 'myvpn'

那么有人能帮我配置 VPN 客户端吗？如果有一些安装脚本或我可以使用的东西就太好了，因为我计划将来自动执行此过程。

供参考：

我尝试这样做是为了将本地计算机连接到 VPN 并使用 ec2 作为代理服务器。本地服务器已在我的大学中设置，我需要它能够从互联网访问，我无法要求大学为其分配静态 IP。我还没有弄清楚如何进行代理。因此，如果有比执行所有这些 VPN 操作更好的方法，那么这也是可以的。

答案1

我终于找到了基于此的解决方案这里。

我是这样做的：

安装网络管理器和 Strong Swan 插件

sudo apt install network-manager network-manager-strongswan

编辑全局管理的设备文件，将非管理的设备更改为无

echo "[keyfile]
unmanaged-devices=none" | sudo tee /usr/lib/NetworkManager/conf.d/10-globally-managed-devices.conf

重新启动网络管理器服务

sudo systemctl restart NetworkManager

导入 .p12 证书

CERT_PATH=path/to/your/.p12

openssl pkcs12 -in $CERT_PATH -cacerts -nokeys -out $HOME/ca.cer
openssl pkcs12 -in $CERT_PATH -clcerts -nokeys -out $HOME/client.cer
openssl pkcs12 -in $CERT_PATH -nocerts -nodes  -out $HOME/client.key
rm $CERT_PATH

sudo chown root:root ca.cer client.cer client.key
sudo chmod 600 ca.cer client.cer client.key

创建 VPN 连接

注意：此处的名称VPN可以是任何你想要的

$SERVER="your server IP/domain"

sudo nmcli c add type vpn ifname -- vpn-type strongswan connection.id VPN connection.autoconnect no vpn.data 'address = $SERVER, certificate = $HOME/ca.cer, encap = no, esp = aes128gcm16, ipcomp = no, method = key, proposal = yes, usercert = $HOME/client.cer, userkey = $HOME/client.key, virtual = yes'

连接到它

nmcli c up 'Wired connection 1'
nmcli c up VPN
nmcli c

检查是否已连接

ifconfig

你应该会看到你的 VPN 的一个新条目，通常称为tunnel

建议以 root 身份运行这里的所有步骤，sudo su以便 $HOME 为/root。

这是我根据这些步骤创建的完整脚本，您可以按如下方式运行它./vpn.sh path/to/.p12 vpn.yourdomain.com

vpn网站

#!/bin/bash

# Check if the correct number of arguments were provided
if [ "$#" -ne 2 ]; then
    echo "Usage: $0 <certificate path> <server address>"
    exit 1
fi

CERT_PATH=$1
SERVER_ADDRESS=$2

# Step 1: Install Network manager and strongswan plugin
sudo apt update
sudo apt-get install -y network-manager network-manager-strongswan

# Step 2: Edit the globally managed devices file and change unmanaged devices to none
echo "[keyfile]
unmanaged-devices=none" | sudo tee /usr/lib/NetworkManager/conf.d/10-globally-managed-devices.conf

# Step 3: Restart the network manager service
sudo systemctl restart NetworkManager

# Step 4: Check if the devices are managed
nmcli d

# Step 6: Import the .p12 certificate
openssl pkcs12 -in $CERT_PATH -cacerts -nokeys -out $HOME/ca.cer
openssl pkcs12 -in $CERT_PATH -clcerts -nokeys -out $HOME/client.cer
openssl pkcs12 -in $CERT_PATH -nocerts -nodes  -out $HOME/client.key
rm $CERT_PATH

sudo chown $USER:$USER $HOME/ca.cer $HOME/client.cer $HOME/client.key
sudo chmod 600 $HOME/ca.cer $HOME/client.cer $HOME/client.key

# Step 7: Create a VPN connection in NetworkManager and enable it.
sudo nmcli c add type vpn ifname -- vpn-type strongswan connection.id VPN connection.autoconnect no vpn.data "address = $SERVER_ADDRESS, certificate = $HOME/ca.cer, encap = no, esp = aes128gcm16, ipcomp = no, method = key, proposal = yes, usercert = $HOME/client.cer, userkey = $HOME/client.key, virtual = yes"

nmcli c up 'Wired connection 1'
nmcli c up VPN
nmcli c

相关内容