네트워크 관리자가 없는 Debian 10의 L2TP/IPSec VPN

저는 2대의 컴퓨터를 가지고 있습니다. 둘 다 Debian 10을 실행하고 있습니다. 동일한 원격 VPN 서버에 연결해야 합니다. 하나에는 데스크톱 관리자(네트워크 관리자 포함)가 있고 다른 하나에는 없습니다. 데스크탑 관리자가 있는 하나와 Debian GUI다른 하나 에 전화하겠습니다 Debian Server.

Network Manager를 사용하여 원격 VPN 서버에 성공적으로 연결했지만 원격 VPN 서버에 Debian GUI연결할 수 없습니다 .Debian Server

개인정보 보호를 위해 세부정보가 수정된 네트워크 관리자 설정은 다음과 같습니다.

My LAN IP address on client PC before turning on the VPN: 192.168.0.1
VPN Type: TTL2TP VPN
VPN Gateway public IP address: 100.100.100.100
Remote network domain: mywindowsdomain
Remote network username: me
Remote network password: mypassword
Enable IPSec tunnel to L2TP host: yes
Pre-shared key: mypresharedkey
Phase 1 Algorithms: aes256-md5-modp1024
Phase 2 Algorithms: aes256-md5
Enforce UDP encapsulation: yes
L2TP PPP authentication: MS Chap v2
Allow BSD data compression: yes
Allow deflate compression: yes
Use TCP header compression: yes
Use protocol field compression negotiation: yes
Use address/control compression: yes
MTU: 1400
MRU: 1400

이것은 원격 VPN 서버에 성공적으로 연결할 수 있는 Network Manager에서 사용하는 유일한 설정입니다 Debian GUI. 을 설치한 후에 Debian Server는 작동 할 수만 있다면 어떤 클라이언트를 사용하든 상관하지 않습니다. 이것들은 데비안 10에서 사용할 수 있는 것들입니다. 나는 다음과 같이 구성하려고합니다 :Debian Serverstrongswanxl2tpd

$ cat /etc/xl2tpd/xl2tpd.conf
[lac vpn-connection]
lns = 100.100.100.100
ppp debug = yes
pppoptfile = /etc/ppp/options.l2tpd.client
length bit = yes

$ cat /etc/sysctl.conf
net.ipv4.ip_forward = 1
net.ipv6.conf.all.forwarding = 1
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0

$ cat /etc/ipsec.secrets
include /var/lib/strongswan/ipsec.secrets.inc
192.168.0.1 100.100.100.100 : PSK "mypresharedkey"

$ cat /etc/ipsec.conf
config setup                                                                    
    virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12        
    nat_traversal=yes
    protostack=netkey
    plutoopts="--interface=eth0"
    strictcrlpolicy=yes
    uniqueids = no
conn L2TP-PSK
    pfs=no
    auto=add
    authby=secret
    # phase 1
    keyexchange=ikev1
    ike=aes256-md5-modp1024
    # phase 2
    esp=aes256-md5
    forceencaps=yes
    keyingtries=3
    dpddelay=30
    dpdtimeout=120
    dpdaction=clear
    rekey=yes
    ikelifetime=8h
    keylife=1h
    type=transport
    type=tunnel
    left=192.168.0.1
    leftprotoport=17/1701
    right=100.100.100.100
    rightprotoport=17/1701

include /var/lib/strongswan/ipsec.conf.inc

$ cat /etc/ppp/options.l2tpd.client
ipcp-accept-local
ipcp-accept-remote
refuse-eap
refuse-pap
refuse-chap
refuse-mschap
require-mschap-v2
nobsdcomp
nodeflate
noccp
noauth
idle 1800
mtu 1400
mru 1400
defaultroute
usepeerdns
debug
connect-delay 5000
name mywindowsdomain\\me
password mypassword

$ cat /etc/strongswan.conf
charon {
    # this line commented out on 2020-11-19
    #load_modular = yes
    plugins {
        include strongswan.d/charon/*.conf
    }
}

include strongswan.d/*.conf

이 문제를 진단하는 데 필요한 파일이 누락된 경우 알려주시면 해당 내용을 여기에 추가할 수 있습니다.

그런 다음 모든 것을 시작하고 다음과 같은 결과를 얻습니다.

$ sudo systemctl restart xl2tpd.service
$ sudo systemctl status xl2tpd.service 
● xl2tpd.service - LSB: layer 2 tunelling protocol daemon
   Loaded: loaded (/etc/init.d/xl2tpd; generated)
   Active: active (running) since Thu 2020-11-19 21:13:41 ACDT; 12s ago
     Docs: man:systemd-sysv-generator(8)
  Process: 11111 ExecStart=/etc/init.d/xl2tpd start (code=exited, status=0/SUCCESS)
    Tasks: 1 (limit: 4915)
   Memory: 876.0K
   CGroup: /system.slice/xl2tpd.service
           └─11112 /usr/sbin/xl2tpd

$ sudo systemctl restart strongswan.service
$ sudo systemctl status strongswan.service 
● strongswan.service - strongSwan IPsec IKEv1/IKEv2 daemon using ipsec.conf
   Loaded: loaded (/lib/systemd/system/strongswan.service; enabled; vendor preset: enabled)
   Active: active (running) since Thu 2020-11-19 21:17:16 ACDT; 9s ago
 Main PID: 11113 (starter)
    Tasks: 18 (limit: 4915)
   Memory: 3.4M
   CGroup: /system.slice/strongswan.service
           ├─11114 /usr/lib/ipsec/starter --daemon charon --nofork
           └─11115 /usr/lib/ipsec/charon

$ # all good so far i guess, but then this fails:
$ sudo ipsec up L2TP-PSK
initiating Main Mode IKE_SA L2TP-PSK[2] to 100.100.100.100
generating ID_PROT request 0 [ SA V V V V V ]
sending packet: from 192.168.0.1[500] to 100.100.100.100[500] (240 bytes)
received packet: from 100.100.100.100[500] to 192.168.0.1[500] (188 bytes)
parsed ID_PROT response 0 [ SA V V V V V ]
received NAT-T (RFC 3947) vendor ID
received DPD vendor ID
received unknown vendor ID: 88:77:44:11:55:aa:66:88:cc:aa:22:dd:00:00:00:00
received FRAGMENTATION vendor ID
received FRAGMENTATION vendor ID
selected proposal: IKE:AES_CBC_256/HMAC_MD5_96/PRF_HMAC_MD5/MODP_1024
generating ID_PROT request 0 [ KE No NAT-D NAT-D ]
sending packet: from 192.168.0.1[500] to 100.100.100.100[500] (236 bytes)
received packet: from 100.100.100.100[500] to 192.168.0.1[500] (220 bytes)
parsed ID_PROT response 0 [ KE No NAT-D NAT-D ]
local host is behind NAT, sending keep alives
generating ID_PROT request 0 [ ID HASH N(INITIAL_CONTACT) ]
sending packet: from 192.168.0.1[4500] to 100.100.100.100[4500] (92 bytes)
received packet: from 100.100.100.100[4500] to 192.168.0.1[4500] (76 bytes)
parsed ID_PROT response 0 [ ID HASH ]
IKE_SA L2TP-PSK[2] established between 192.168.0.1[192.168.0.1]...100.100.100.100[100.100.100.100]
scheduling reauthentication in 28017s
maximum IKE_SA lifetime 28557s
generating QUICK_MODE request 3034622638 [ HASH SA No ID ID ]
sending packet: from 192.168.0.1[4500] to 100.100.100.100[4500] (204 bytes)
received packet: from 100.100.100.100[4500] to 192.168.0.1[4500] (76 bytes)
parsed INFORMATIONAL_V1 request 3102838840 [ HASH N(NO_PROP) ]
received NO_PROPOSAL_CHOSEN error notify
establishing connection 'L2TP-PSK' failed

내가 사용한 소스(많은 조합을 시도했습니다):

https://wiki.archlinux.org/index.php/Openswan_L2TP/IPsec_VPN_client_setup https://github.com/xelerance/Openswan/wiki/L2tp-ipsec-configuration-using-openswan-and-xl2tpd http://manpages.ubuntu.com/manpages/bionic/man5/ipsec.conf.5.html