虚拟机搭建strongswan

注：仅作测试用，故服务端和客户端分别安装在了同一网段下的两台Ubuntu上。

服务端

操作系统
配置环境

1 2	sudo apt-get update sudo apt-get install libgmp-dev libssl-dev libcurl4-openssl-dev libsystemd-dev libjson-c-dev make gcc pkg-config libsystemd-dev

安装过程

下载源码并编译

wget https://download.strongswan.org/strongswan-5.8.3.tar.gz
tar xzf strongswan-5.8.3.tar.gz
cd strongswan-5.8.3
./configure --prefix=/usr --sysconfdir=/etc --enable-eap-identity --enable-eap-md5 --enable-eap-mschapv2 --enable-eap-tls --enable-eap-ttls --enable-eap-peap --enable-eap-tnc --enable-eap-dynamic --enable-eap-radius --enable-xauth-eap --enable-xauth-pam  --enable-dhcp  --enable-openssl  --enable-addrblock --enable-unity --enable-certexpire --enable-radattr --enable-swanctl --enable-openssl --disable-gmp --enable-systemd
sudo make
sudo make install

安装成功

生成CA证书和服务器证书

创建服务器证书时，–dn中的CN要填写本机的ip，–san同理

mkdir genPem
cd genPem
# 创建CA密钥
ipsec pki --gen --outform pem > ca-key.pem

# 创建CA证书
ipsec pki --self --in ca-key.pem --dn "C=CN, O=My VPN, CN=My VPN CA" --ca --outform pem > ca-cert.pem

# 创建服务器密钥
ipsec pki --gen --outform pem > server-key.pem

# 创建服务器证书
ipsec pki --pub --in server-key.pem | ipsec pki --issue --cacert ca-cert.pem --cakey ca-key.pem --dn "C=CN, O=My VPN, CN=serverIp" --san="serverIp" --flag serverAuth --outform pem > server-cert.pem

# 将证书和密钥放到正确的位置
sudo cp ca-cert.pem /etc/ipsec.d/cacerts/
sudo cp server-cert.pem /etc/ipsec.d/certs/
sudo cp server-key.pem /etc/ipsec.d/private/

配置/etc/ipsec.secrets（这个文件似乎可有可无，稳妥起见还是加上吧）
1
2
: RSA "server-key.pem"
test : EAP "test"

配置/etc/swanctl/conf.d/192.168.139.129.conf（注意：此处的文件名为本机的ip.conf）

下面的配置文件中有文字注释的部分需要修改

connections {
    ikev2-eap-mschapv2 {
        version = 2
        unique = never
        proposals = aes256-sha1-modp1024
        # proposals = aes256-sha1-modp1024, aes128-sha1-modp1024, 3des-sha1-modp1024
        # proposals = aes256-sha256-prfsha256-modp2048, aes256gcm16-prfsha384-modp1024, default
        rekey_time = 0s
        fragmentation = yes
        dpd_delay = 30s
        send_cert = always
        local_addrs = %any
        local {
            certs = server-cert.pem
            # 服务器ip
            id = 192.168.139.129
        }
        remote {
            auth = eap-mschapv2
            eap_id = %any
            # request_virtual_ip = no
        }
        children {
            ikev2-eap-mschapv2 {
                local_ts = 0.0.0.0/0,::/0
                remote_ts = 0.0.0.0/0
                rekey_time = 0s
                dpd_action = clear
                esp_proposals = aes256-sha256, aes128-sha1, default
            }
        }
    }
}

secrets {
    private-www {
        file = server-key.pem
    }
    # id为用户名，secret为密码
    eap-test {
        id = test
        secret = "123456"
    }
}

启动服务

注：直接启动strongswan时会有一个报错，提示没有这个service，直接把报错信息复制给GPT就行，我也忘记具体的指令了，就是创建一个文件使其能启动strongswan ipsec
1
2
3
sudo systemctl enable strongswan
sudo systemctl start strongswan
sudo systemctl status strongswan

客户端

操作系统

直接命令行安装

1 2	sudo apt update sudo apt install strongswan

配置 /etc/ipsec.conf

带文字注释的要修改

config setup
    charondebug="ike 2, knl 2, cfg 2"

conn %default
    keyexchange=ikev2
    ike=aes256-sha1-modp1024
    esp=aes256-sha1
    dpdaction=clear
    dpddelay=300s
    rekey=no

conn ikev2-vpn
    left=192.168.139.129 # 服务器ip
    leftid=192.168.139.129 # 服务器ip
    leftauth = pubkey
    leftcert=server-cert.pem
    leftsendcert=always
    leftsubnet=192.168.139.0/24 # 两台机器所在的网段
    right=192.168.139.130 # 本机ip
    rightid=192.168.139.130 # 本机ip
    rightsubnet=0.0.0.0/0
    rightauth=eap-mschapv2
    rightsendcert=never
    eap_identity=test
    auto=add

证书和私钥

把在服务端生成的对应文件也放到客户端对应的目录下
配置/etc/ipsec.secrets
1
test : EAP "test"

客户端启动

1 2	sudo ipsec restart sudo ipsec up ikev2-vpn

成功

客户端

服务端

hourhl's blog

StrongSwan部署小记

虚拟机搭建strongswan

服务端

客户端

成功