Freebsd下基于ipsec的Site to Site 的VPN

Freebsd下基于ipsec的Site to Site 的VPN:
192.168.1.0/24--PC1----------PC2--10.5.21.0/24
PC1的内ip : 172.16.1.1
PC1的外ip: 192.168.1.160
PC2的内ip: 10.0.0.1
PC2的外ip: 192.168.1.200
1. 编译内核vpn,在里面加入下面参数:
options IPSEC
options IPSEC_ESP
options IPSEC_DEBUG
device gif
freebsd# cd /usr/src
freebsd# make buildkernel KERNCONF=vpn
freebsd# make installkernel KERNCONF=vpn
2修改/etc/rc.conf
对PC1机如下:
defaultrouter="192.168.1.254"
gif_interfaces="YES"
gif_interfaces="gif0"
gifconfig_gif0="192.168.1.160 192.168.1.200"
ifconfig_gif0="gif0 172.16.1.1 10.0.0.1 netmask 255.255.255.0"
gateway_enable="YES"
ipsec_enable="YES"
ipsec_file="/etc/ipsec.conf"
static_routes="vpn"
route_vpn="-net 10.0.0.0/24 10.0.0.1"
对PC2主机如下:
defaultrouter="192.168.1.254"
gif_interfaces="YES"
gif_interfaces="gif0"
gifconfig_gif0="192.168.1.200 192.168.1.160"
ifconfig_gif0="gif0 10.0.0.1 172.16.1.1 netmask 255.255.255.0"
gateway_enable="YES"
ipsec_enable="YES"
ipsec_file="/etc/ipsec.conf"
static_routes="vpn"
route_vpn="-net 172.16.1.0/24 172.16.1.1"
3 安装racoon
freebsd# cd /usr/ports/security/racoon
freebsd# make install clean
freebsd# cd /usr/local/etc/racoon
freebsd# ee psk.txt
PC1加入:
192.168.1.200 lexian
PC2加入:
192.168.1.160 lexian
freebsd# chmod 0600 psk.txt
编辑racoon.conf:
freebsd# cp racoon.conf.dist racoon.conf
对PC1机做如下修改
将此三行注释
#path certificate "/usr/local/etc/cert"
#my_identifier user_fqdn "
lingfeng@lingfeng.cn
";
#peers_identifier
打开此行的注释
my_identifier address;
将listen {}中的isakmp这行修改为
isakmp 192.168.1.160 [500];
对PC2机如下
将此三行注释
#path certificate "/usr/local/etc/cert"
#my_identifier user_fqdn "
lingfeng@lingfeng.cn
";
#peers_identifier
打开此行的注释
my_identifier address;
将listen {}中的isakmp这行修改为
isakmp 192.168.1.200 [500];
freebsd# chmod 0600 racoon.conf
4 编辑/etc/ipsec.conf
PC1:
flush;
spdflush;
spdadd 172.16.1.0/24 10.0.0.0/24 any -P out ipsec esp/tunnel/192.168.1.160-192.168.1.200/require;
spdadd 10.0.0.0/24 172.16.1.0/24 any -P in ipsec esp/tunnel/192.168.1.200-192.168.1.160/require;
PC2:
flush;
spdflush;
spdadd 10.0.0.0/24 172.16.1.0/24 any -P out ipsec esp/tunnel/192.168.1.200-192.168.1.160/require;
spdadd 172.16.1.0/24 10.0.0.0/24 any -P in ipsec esp/tunnel/192.168.1.160-192.168.1.200/require;
编写启动脚本
PC1机:
/usr/local/etc/rc.d/ipsec.sh如下

标签：

版权申明：本站文章部分自网络，如有侵权，请联系：west999com@outlook.com
特别注意：本站所有转载文章言论不代表本站观点，本站所提供的摄影照片，插画，设计作品，如需使用，请与原作者联系，版权归原作者所有