Tady je fungujici konfigurace PSK L2TP/IPSEC (libreswan/centos7).
Stroj ma 2 sitova rozhrani - 192.168.172.5 je vnejsi a za druhym (192.168.15.5) je sit, kam se pristupuje (192.168.15.0/24) a odkud se taky berou adresy pro l2tp klienty i server.
Na firewallu jsou treba jen 2 UDP "vpichy" - porty 500 a 4500 zevne na 192.168.172.5
Pod windows za natem je treba nahrat nekam do registru nejakou hodnotu a restartovat.
========================================
https://libreswan.org/wiki/VPN_server_for_remote_clients_using_IKEv1_with_L2TP
========================================
yum install epel-release libreswan lsof ppp
yum install --enablerepo=epel xl2tpd
========================================
cp -p /etc/xl2tpd/xl2tpd.conf /etc/xl2tpd/xl2tpd.conf.original
cp -p /etc/ppp/options.xl2tpd /etc/ppp/options.xl2tpd.original
cp -p /etc/ipsec.conf /etc/ipsec.conf.original
vi /etc/xl2tpd/xl2tpd.conf
vi /etc/ppp/options.xl2tpd
vi /etc/ipsec.conf
vi /etc/ppp/chap-secrets
vi /etc/ipsec.d/l2tp-ipsec.conf
vi /etc/ipsec.d/l2tp-ipsec.secrets
vi /etc/sysctl.d/98-ipsec.conf
chmod 600 /etc/ipsec.d/l2tp-ipsec.conf
chmod 600 /etc/ipsec.d/l2tp-ipsec.secrets
chmod 600 /etc/ppp/chap-secrets
========================================
systemctl enable ipsec
###### kvuli povoleni xl2tpd jsem kdysi musel na chvili vypnout selinux ######
###### mozna by stacil relabel nebo restart, pokud uz to nefunguje samo ######
systemctl enable xl2tpd
========================================
systemctl start ipsec
systemctl start xl2tpd
========================================
ipsec verify
========================================
cat /etc/sysctl.d/98-ipsec.conf
===
net.ipv4.ip_forward=1
#
net.ipv4.conf.default.rp_filter=0
net.ipv4.conf.all.rp_filter=0
#
net.ipv4.conf.default.arp_filter=1
net.ipv4.conf.all.arp_filter=1
#
net.ipv4.conf.default.send_redirects=0
net.ipv4.conf.all.send_redirects=0
#
net.ipv4.conf.default.accept_redirects=0
net.ipv4.conf.all.accept_redirects=0
========================================
cat /etc/xl2tpd/xl2tpd.conf
===
[global]
listen-addr = 192.168.172.5
ipsec saref = yes
force userspace = yes
debug tunnel = no
[lns default]
ip range = 192.168.15.16-192.168.15.32
local ip = 192.168.15.10
require chap = yes
refuse pap = yes
require authentication = yes
name = MYVPNSERVER
ppp debug = no
pppoptfile = /etc/ppp/options.xl2tpd
length bit = yes
========================================
cat /etc/ppp/options.xl2tpd
===
ipcp-accept-local
ipcp-accept-remote
noccp
auth
crtscts
# when having MTU issues, can be decreased to about 1200
mtu 1410
mru 1410
nodefaultroute
debug
lock
proxyarp
connect-delay 5000
========================================
cat /etc/ppp/chap-secrets
===
# Secrets for authentication using CHAP
# client server secret IP addresses
user1 * "password1" 10.10.64.2
user2 * "password2" 10.10.64.3
user10 * "secret10" *
user47 * "paparde11" *
========================================
cat /etc/ipsec.d/l2tp-ipsec.conf
===
conn l2tp-ipsec
type=transport
authby=secret
ikev2=never
auto=add
# Apple's and Microsoft's L2TP/IPsec clients do not enable PFS
pfs=no
rekey=no
phase2=esp
encapsulation=yes
nat-keepalive=yes
salifetime=3h
ikelifetime=2h
left=%defaultroute
leftprotoport=17/1701
right=%any
rightprotoport=17/%any
# Apple iOS doesn't send delete notify so we need dead peer detection
# to detect vanishing clients
dpddelay=10
dpdtimeout=90
dpdaction=clear
========================================
cat /etc/ipsec.d/l2tp-ipsec.secrets
===
: PSK "strongrandomstring"
========================================
diff /etc/ipsec.conf /etc/ipsec.conf.original
===
12,13d11
< listen=192.168.172.5
< uniqueids=no
46c44
< virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:25.0.0.0/8,%v4:100.64.0.0/10,%v6:fd00::/8,%v6:fe80::/10,%v4:!192.168.15.0/24
---
> virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:25.0.0.0/8,%v4:100.64.0.0/10,%v6:fd00::/8,%v6:fe80::/10
========================================