172.31.0.105고정 NAT가 있는 게이트웨이(공용 IP로 가정 )와 동적 NAT 뒤에 있는 여러 클라이언트 간에 IPsec 터널 모드를 구성해야 합니다 .
다음과 같은 리소스를 읽어보세요.이것,이것, 그리고이것) 나는 로드워리어 구성이 내 상황에 적합하다는 것을 알았습니다.
게이트웨이와 테스트 클라이언트에서 racoon을 올바르게 설정하고 시작했습니다. 클라이언트에서 VPN을 설정하려고 하면() racoonctl vc -u user 172.31.0.105서버에 지정된 배너가 표시됩니다.
하지만 뭔가 문제가 있어서 의사소통이 불가능했습니다.
이것은 racoon.conf게이트웨이에 있습니다:
path certificate "/etc/racoon/certs";
listen {
adminsock disabled;
isakmp 172.31.0.105[500];
isakmp_natt 172.31.0.105[4500];
}
timer
{
natt_keepalive 600 sec;
}
# Phase 1 configuration
remote anonymous {
exchange_mode aggressive;
my_identifier asn1dn;
certificate_type x509 "cert.pem" "key.pem";
proposal_check claim;
generate_policy on;
verify_cert off;
nat_traversal on;
dpd_delay 20;
ike_frag on;
proposal {
authentication_method hybrid_rsa_server;
encryption_algorithm 3des;
hash_algorithm md5;
dh_group 2;
}
}
# Local network information
mode_cfg {
network4 172.31.0.200;
netmask4 255.255.255.0;
dns4 8.8.8.8;
#wins4 10.0.12.1;
pool_size 10;
auth_source system;
banner "/etc/racoon/motd";
pfs_group 2;
}
# Phase 2 proposal
sainfo anonymous {
pfs_group 2;
lifetime time 1 hour;
encryption_algorithm 3des;
authentication_algorithm hmac_md5;
compression_algorithm deflate;
}
이것은 racoon.conf테스트 클라이언트에 있습니다:
path certificate "/etc/racoon";
path pre_shared_key "/etc/racoon/psk.txt";
listen {
adminsock "/var/racoon/racoon.sock" "root" "operator" 0660;
}
# Here is the address of the VPN gateway
remote 172.31.0.105 {
exchange_mode aggressive;
ca_type x509 "cacert.pem";
proposal_check obey;
nat_traversal on;
ike_frag on;
mode_cfg on;
passive off;
verify_cert off;
script "/etc/racoon/phase1-up.sh" phase1_up;
script "/etc/racoon/phase1-down.sh" phase1_down;
proposal {
encryption_algorithm 3des;
hash_algorithm md5;
authentication_method hybrid_rsa_client;
dh_group 2;
}
}
sainfo anonymous {
pfs_group 2;
lifetime time 1 hour;
encryption_algorithm 3des;
authentication_algorithm hmac_md5;
compression_algorithm deflate ;
}
다음은 SAD 항목 세트가 비어 있는 동안 SPD 항목의 덤프입니다.
root@test-client:/etc/racoon# setkey -PD
(per-socket policy)
Policy:[Invalid direciton]
created: Jan 1 02:28:49 1970 lastused:
lifetime: 0(s) validtime: 0(s)
spid=267 seq=1 pid=2489
refcnt=1
(per-socket policy)
Policy:[Invalid direciton]
created: Jan 1 02:28:49 1970 lastused:
lifetime: 0(s) validtime: 0(s)
spid=276 seq=2 pid=2489
refcnt=1
(per-socket policy)
Policy:[Invalid direciton]
created: Jan 1 02:28:49 1970 lastused:
lifetime: 0(s) validtime: 0(s)
spid=283 seq=3 pid=2489
refcnt=1
(per-socket policy)
Policy:[Invalid direciton]
created: Jan 1 02:28:49 1970 lastused:
lifetime: 0(s) validtime: 0(s)
spid=292 seq=4 pid=2489
refcnt=1
(per-socket policy)
Policy:[Invalid direciton]
created: Jan 1 02:28:50 1970 lastused:
lifetime: 0(s) validtime: 0(s)
spid=299 seq=5 pid=2489
refcnt=1
(per-socket policy)
Policy:[Invalid direciton]
created: Jan 1 02:28:50 1970 lastused:
lifetime: 0(s) validtime: 0(s)
spid=308 seq=6 pid=2489
refcnt=1
(per-socket policy)
Policy:[Invalid direciton]
created: Jan 1 02:28:50 1970 lastused:
lifetime: 0(s) validtime: 0(s)
spid=315 seq=7 pid=2489
refcnt=1
(per-socket policy)
Policy:[Invalid direciton]
created: Jan 1 02:28:50 1970 lastused:
lifetime: 0(s) validtime: 0(s)
spid=324 seq=8 pid=2489
refcnt=1
172.31.0.200[any] 0.0.0.0/0[any] any
out prio def ipsec
esp/tunnel/192.168.66.105-172.31.0.105/require
created: May 23 13:30:05 2014 lastused:
lifetime: 0(s) validtime: 0(s)
spid=345 seq=9 pid=2489
refcnt=1
0.0.0.0/0[any] 172.31.0.200[any] any
in prio def ipsec
esp/tunnel/172.31.0.105-192.168.66.105/require
created: May 23 13:30:05 2014 lastused:
lifetime: 0(s) validtime: 0(s)
spid=352 seq=10 pid=2489
refcnt=1
(per-socket policy)
Policy:[Invalid direciton]
created: May 23 13:38:00 2014 lastused:
lifetime: 0(s) validtime: 0(s)
spid=371 seq=11 pid=2489
refcnt=1
(per-socket policy)
Policy:[Invalid direciton]
created: May 23 13:38:00 2014 lastused:
lifetime: 0(s) validtime: 0(s)
spid=380 seq=12 pid=2489
refcnt=1
(per-socket policy)
Policy:[Invalid direciton]
created: May 23 13:38:01 2014 lastused:
lifetime: 0(s) validtime: 0(s)
spid=387 seq=13 pid=2489
refcnt=1
(per-socket policy)
Policy:[Invalid direciton]
created: May 23 13:38:01 2014 lastused:
lifetime: 0(s) validtime: 0(s)
spid=396 seq=0 pid=2489
refcnt=1
클라이언트가 새 네트워크 인터페이스를 성공적으로 설정했습니다.
eth0:1 Link encap:Ethernet HWaddr xx:xx:xx:xx:xx:xx
inet addr:172.31.0.200 Bcast:172.31.255.255 Mask:255.255.0.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
그러나 게이트웨이에서 이 가상 IP()를 사용하여 172.31.0.200클라이언트에 ping을 시도하거나 netcat 세션을 설정하려고 하면 다음과 같은 오류가 발생합니다.
Destination Host Unreachable