一、L2tp 环境搭建
1、安装EPEL源（CentOS7官方源中已经去掉了xl2tpd，或者官网手动下载）
在centos7 版本后， 提供ipsec 服务包由libreswan替代了openswan
yum install -y make gcc gmp-devel xmlto bison flex xmlto libpcap-devel lsof vim-enhanced man yum install xl2tpd yum install libreswan2、修改ipsec的配置文件
[root@localhost ~]# vim /etc/ipsec.conf（只添加一行nat_traversal=yes即可）
# NAT-TRAVERSAL support # exclude networks used on server side by adding %v4:!a.b.c.0/24 # It seems that T-Mobile in the US and Rogers/Fido in Canada are # using 25/8 as "private" address space on their wireless networks. # This range has never been announced via BGP (at least up to 2015) nat_traversal=yes ###在配置文件里加入这一行，充许传透nat建立l2tp连接 virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:25.0.0.0/8,%v4:100.64.0.0/10,%v6:fd00::/8,%v6:fe80::/103、建立ipsec 与 l2tp 服务关联的配置文件
#因为这个文件没有所以需要手动创建
[root@localhost ~]# vim /etc/ipsec.d/l2tp_psk.conf
conn L2TP-PSK-NAT
rightsubnet=vhost:%priv
also=L2TP-PSK-noNAT
conn L2TP-PSK-noNAT
authby=secret
pfs=no
auto=add
keyingtries=3
dpddelay=30
dpdtimeout=120
dpdaction=clear
rekey=no
ikelifetime=8h
keylife=1h
type=transport
left=192.168.4.197 ###192.168.4.197 是自己的网卡Ip地址
leftprotoport=17/1701
right=%any
rightprotoport=17/%any4、当建立l2tp连接时，需要输入预共享密匙，以下为预共享密匙的配置文件。
#如果这个文件也没有也需要手动创建，访问的IP地址和密码
[root@localhost ~]# vim /etc/ipsec.d/ipsec.secrets #include /etc/ipsec.d/*.secrets 192.168.4.197 %any: PSK "123456789" #120.86.124.5 是外网网卡地址，PSK是预存共享密匙5、修改内核支持，可以对照以下配置修改，修改完后运行sysctl -p 使配置生效
[root@localhost ~]# cat /etc/sysctl.conf vm.swappiness = 0 net.ipv4.ip_forward = 1 net.ipv4.neigh.default.gc_stale_time=120 net.ipv4.conf.all.rp_filter=0 net.ipv4.conf.default.rp_filter=0 net.ipv4.conf.default.arp_announce = 2 net.ipv4.conf.all.arp_announce=2 net.ipv4.tcp_max_tw_buckets = 5000 net.ipv4.tcp_syncookies = 1 net.ipv4.tcp_max_syn_backlog = 1024 net.ipv4.tcp_synack_retries = 2 net.ipv4.conf.lo.arp_announce=2 net.ipv4.conf.default.accept_redirects = 0 net.ipv4.conf.default.send_redirects = 0 net.ipv4.conf.default.accept_source_route = 0 [root@localhost ~]# sysctl -p6、检验ipsec服务配置
#重启ipsec systemctl restart ipsec
#检验ipsec服务配置 ipsec verify
//报错处理，当出现以上几个[ENABLED]错误提示时 ，不用在意，可以继续。当然全部OK更好。7、启动服务
#启动ipsec systemctl start ipsec #设置为开机自启 systemctl enable ipsec8、修改L2tp的配置文件
[root@localhost ~]# vim /etc/xl2tpd/xl2tpd.conf [global] listen-addr = 192.168.4.197 ###本机外网网卡IP ipsec saref = yes ###取消注释 [lns default] ip range = 192.168.1.128-192.168.1.254 local ip = 192.168.1.99 require chap = yes refuse pap = yes require authentication = yes name = Linux×××server ppp debug = yes pppoptfile = /etc/ppp/options.xl2tpd length bit = yes9、修改xl2tpd属性配置文件
[root@localhost ~]# vim /etc/ppp/options.xl2tpd require-mschap-v2 ###添加此行 ipcp-accept-local ipcp-accept-remote #dns 写自己的网卡DNS ，写成8.8.8.8也行 ms-dns 192.168.0.2 #ms-dns 8.8.8.8 noccp auth crtscts idle 1800 mtu 1410 mru 1410 nodefaultroute debug lock proxyarp connect-delay 5000
10、添加用户名和密码（**登录的用户名和密码）
建立xl2tpd连接的用户，建立l2tp连接需要输入的用户名和密码就在该文件里配置：
vim /etc/ppp/chap-secrets # Secrets for authentication using CHAP # client server secret IP addresses test * 123 *
11、iptables安装配置
CentOS7默认的防火墙不是iptables,而是firewalle.
1）安装iptable iptable-service
yum install -y iptables yum install iptables-services
2）禁用/停止自带的firewalld服务
#停止firewalld服务
systemctl stop firewalld#冻结firewalld服务
systemctl mask firewalld
3）设置现有规则
#查看iptables现有规则
iptables -L -n#先允许所有,不然有可能会杯具
iptables -P INPUT ACCEPT#清空所有默认规则
iptables -F
#清空所有自定义规则
iptables -X
#所有计数器归0
iptables -Z4）开启地址转换(eth0为外网网卡，根据实际情况替换。)
iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -o eth0 -j MASQUERADE iptables -I FORWARD -s 192.168.1.0/24 -j ACCEPT iptables -I FORWARD -d 192.168.1.0/24 -j ACCEPT iptables -A INPUT -p udp -m policy --dir in --pol ipsec -m udp --dport 1701 -j ACCEPT iptables -A INPUT -p udp -m udp --dport 1701 -j ACCEPT iptables -A INPUT -p udp -m udp --dport 500 -j ACCEPT iptables -A INPUT -p udp -m udp --dport 4500 -j ACCEPT iptables -A INPUT -p esp -j ACCEPT iptables -A INPUT -m policy --dir in --pol ipsec -j ACCEPT iptables -A FORWARD -i ppp+ -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT service iptables save /bin/systemctl restart iptables.service12、完成服务配置
#启动xl2tp服务 systemctl start xl2tpd #设置开机自启 systemctl enable xl2tpd #查看状态 systemctl status xl2tpd如果启动失败，报错如下：
Job for xl2tpd.service failed because the control process exited with error code. See "systemctl status xl2tpd.service" and "journalctl -xe" for details. # systemctl status xl2tpd.service xl2tpd.service - Level 2 Tunnel Protocol Daemon (L2TP) Loaded: loaded (/usr/lib/systemd/system/xl2tpd.service; disabled; vendor preset: disabled) Active: failed (Result: start-limit) since Sat 2018-07-07 07:11:31 UTC; 12s ago Process: 3985 ExecStartPre=/sbin/modprobe -q l2tp_ppp (code=exited, status=1/FAILURE) Jul 07 07:11:31 ip-192-168-4-197.ap-northeast-1.compute.internal systemd[1]: xl2tpd.service: control process exited, code=exited status=1 Jul 07 07:11:31 ip-192-168-4-197.ap-northeast-1.compute.internal systemd[1]: Failed to start Level 2 Tunnel Protocol Daemon (L2TP). Jul 07 07:11:31 ip-192-168-4-197.ap-northeast-1.compute.internal systemd[1]: Unit xl2tpd.service entered failed state. Jul 07 07:11:31 ip-192-168-4-197.ap-northeast-1.compute.internal systemd[1]: xl2tpd.service failed. Jul 07 07:11:31 ip-192-168-4-197.ap-northeast-1.compute.internal systemd[1]: xl2tpd.service holdoff time over, scheduling restart. Jul 07 07:11:31 ip-192-168-4-197.ap-northeast-1.compute.internal systemd[1]: start request repeated too quickly for xl2tpd.service Jul 07 07:11:31 ip-192-168-4-197.ap-northeast-1.compute.internal systemd[1]: Failed to start Level 2 Tunnel Protocol Daemon (L2TP). Jul 07 07:11:31 ip-192-168-4-197.ap-northeast-1.compute.internal systemd[1]: Unit xl2tpd.service entered failed state. Jul 07 07:11:31 ip-192-168-4-197.ap-northeast-1.compute.internal systemd[1]: xl2tpd.service failed.
解决方法：
centos7 ，查看资料之后发现是内核重新挂载l2tp_ppp，在xl2tpd.service中删除掉“ExecStartPre=/sbin/modprobe -q l2tp_ppp”就可以，另外注意Restart项
systemctl daemon-reload systemctl start xl2tpd
如果Mac L2TP ×××无法连接：
解决方法：
需要在MAC中配置一个options文件在\etc\ppp目录下：
1.点击此处，在弹出框中输入：\etc\ppp,进入ppp文件夹，发现里面是空的
2.添加一个文件options，注意不要用记事本创建，创建出来之后类型是不一样的。 要用命令行创建。 在options文件中输入： plugin L2TP.ppp l2tpnoipsec
bh1imgbh1img
kvnkvnkvnkvnkvnkvn
quachalaquachala
nickelnickel