Establish a L2TP/IPSEC VPN
fr:Mettre en place un VPN L2TP/IPSEC
en:Establish a L2TP/IPSEC VPN
es:Establecer una VPN de L2TP/IPSEC
pt:Estabelecer uma VPN L2TP/IPSEC
it:Stabilire una connessione VPN L2TP/IPSEC
nl:Stellen een L2TP/IPSEC VPN
de:Etablieren Sie ein L2TP/IPSEC-VPN
zh:建立 L2TP/IPSEC VPN
ar:إنشاء L2TP/IPSEC VPN
ja:L2TP と IPSEC VPN を確立します。
pl:Ustanowić połączenie sieci VPN L2TP/IPSEC
ru:Установить L2TP/IPSEC VPN
ro:Stabilească un VPN L2TP/IPSEC
he:הקמת VPN של L2TP/IPSEC
This article has been created by an automatic translation software. You can view the article source here.
Introduction
A VPN (Virtual Private Network) est un système permettant de créer un lien direct entre des ordinateurs distants. On utilise notamment ce terme dans le milieu de la dématérialisation fiscale et dans le travail à distance, ainsi que pour l'accès à des structures de type cloud computing. L'avantage du L2TP (Layer 2 Tunelling Protocol) réside dans l'utilisation d'une clé pré partagée en plus des identifiants de connexion habituels. A cela s'ajoute IPSEC, une technologie d'encapsulation cryptée dans la trame IP.
Prerequisites
To follow this tutorial you must have :
- A machine under a Linux distribution (Debian 8Fedora, CentOS, Ubuntu, Raspberry Pi...) Does not work under Debian 8 because of the repository of OpenSwan which no longer exist
- Know your public ip address, if you do not know here!
Tutorial
Firstly, log you in root (or via a user who has superuser rights). You can use Putty to connect to a machine remotely via SSH or simply open a terminal if you have access to the graphical interface of your machine.
Update and installation packages
First, update your machine and install the necessary repository :
apt-get update && apt-get upgrade -y
apt-get install openswan xl2tpd ppp lsof
OpenSwan will ask you some questions, answer y with the default values.'.
Adding rules to the firewall
Then we'll add a rule to iptables to allow VPN traffic (replace %SERVERIP% by the ip of your Server) :
iptables -t nat -A POSTROUTING -j SNAT --to-source %SERVERIP% -o eth0
Then run the following commands to enable the routing of IP packets:
echo "net.ipv4.ip_forward = 1" | tee -a /etc/sysctl.conf
echo "net.ipv4.conf.all.accept_redirects = 0" | tee -a /etc/sysctl.conf
echo "net.ipv4.conf.all.send_redirects = 0" | tee -a /etc/sysctl.conf
echo "net.ipv4.conf.default.rp_filter = 0" | tee -a /etc/sysctl.conf
echo "net.ipv4.conf.default.accept_source_route = 0" | tee -a /etc/sysctl.conf
echo "net.ipv4.conf.default.send_redirects = 0" | tee -a /etc/sysctl.conf
echo "net.ipv4.icmp_ignore_bogus_error_responses = 1" | tee -a /etc/sysctl.conf
for vpn in /proc/sys/net/ipv4/conf/*; do echo 0 > $vpn/accept_redirects; echo 0 > $vpn/send_redirects; done
sysctl -p
Make the persistent to restarting the machine :
nano /etc/rc.local
Then, add at the end just before the exit 0 :
for vpn in /proc/sys/net/ipv4/conf/*; do echo 0 > $vpn/accept_redirects; echo 0 > $vpn/send_redirects; done
iptables -t nat -A POSTROUTING -j SNAT --to-source %SERVERIP% -o eth+
Implementation ofIPSEC
Create a new configuration file ipsec :
mv /etc/ipsec.conf /etc/ipsec.conf.bak && nano /etc/ipsec.conf
Then stick this : Not forgetting to replace %SERVERIP% by the IP address of the Server
version 2 # conforms to second version of ipsec.conf specification
config setup
dumpdir=/var/run/pluto/
#in what directory should things started by setup (notably the Pluto daemon) be allowed to dump core?
nat_traversal=yes
#whether to accept/offer to support NAT (NAPT, also known as "IP Masqurade") workaround for IPsec
virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v6:fd00::/8,%v6:fe80::/10
#contains the networks that are allowed as subnet= for the remote client. In other words, the address ranges that may live behind a NAT router through which a client connects.
protostack=netkey
#decide which protocol stack is going to be used.
force_keepalive=yes
keep_alive=60
# Send a keep-alive packet every 60 seconds.
conn L2TP-PSK-noNAT
authby=secret
#shared secret. Use rsasig for certificates.
pfs=no
#Disable pfs
auto=add
#the ipsec tunnel should be started and routes created when the ipsec daemon itself starts.
keyingtries=3
#Only negotiate a conn. 3 times.
ikelifetime=8h
keylife=1h
ike=aes256-sha1,aes128-sha1,3des-sha1
phase2alg=aes256-sha1,aes128-sha1,3des-sha1
# https://lists.openswan.org/pipermail/users/2014-April/022947.html
# specifies the phase 1 encryption scheme, the hashing algorithm, and the diffie-hellman group. The modp1024 is for Diffie-Hellman 2. Why 'modp' instead of dh? DH2 is a 1028 bit encryption algorithm that modulo's a prime number, e.g. modp1028. See RFC 5114 for details or the wiki page on diffie hellmann, if interested.
type=transport
#because we use l2tp as tunnel protocol
left=%SERVERIP%
#fill in server IP above
leftprotoport=17/1701
right=%any
rightprotoport=17/%any
dpddelay=10
# Dead Peer Dectection (RFC 3706) keepalives delay
dpdtimeout=20
# length of time (in seconds) we will idle without hearing either an R_U_THERE poll from our peer, or an R_U_THERE_ACK reply.
dpdaction=clear
# When a DPD enabled peer is declared dead, what action should be taken. clear means the eroute and SA with both be cleared.
On crée ensuite le preshared secret (the pre shared key) :
nano /etc/ipsec.secrets
Then enter this line :
%SERVERIP% %any: PSK "VotreClePlusOuMoinsSecurisee"
Consider replacing %SERVERIP% par l'IP de votre Server. Si vous séchez pour la création de votre clé vous pouvez utilisez la commande suivante :
openssl rand -hex 30
We check that everything is fine, so you use this command :
ipsec verify
And you must get :
Checking your system to see if IPsec got installed and started correctly:
Version check and ipsec on-path [OK]
Linux Openswan U2.6.38/K3.13.0-24-generic (netkey)
Checking for IPsec support in kernel [OK]
SAref kernel support [N/A]
NETKEY: Testing XFRM related proc values [OK]
[OK]
[OK]
Checking that pluto is running [OK]
Pluto listening for IKE on udp 500 [OK]
Pluto listening for NAT-T on udp 4500 [OK]
Checking for 'ip' command [OK]
Checking /bin/sh is not /bin/dash [WARNING]
Checking for 'iptables' command [OK]
Opportunistic Encryption Support [DISABLED]
Configuration de xl2tpd
Let's start by editing a new configuration file :
mv /etc/xl2tpd/xl2tpd.conf /etc/xl2tpd/xl2tpd.conf.bak && nano /etc/xl2tpd/xl2tpd.conf
Then stick this :
[global]
ipsec saref = yes
saref refinfo = 30
;debug avp = yes
;debug network = yes
;debug state = yes
;debug tunnel = yes
[lns default]
ip range = 172.16.1.30-172.16.1.100
local ip = 172.16.1.1
refuse pap = yes
require authentication = yes
;ppp debug = yes
pppoptfile = /etc/ppp/options.xl2tpd
length bit = yes
PPP configuration
For this part, we will again create a new configuration file (too new in one sentence :3) :
mv /etc/ppp/options.xl2tpd /etc/ppp/options.xl2tpd.bak && nano /etc/ppp/options.xl2tpd
Then insert this :
require-mschap-v2
ms-dns 8.8.8.8
ms-dns 8.8.4.4
auth
mtu 1200
mru 1000
crtscts
hide-password
modem
name l2tpd
proxyarp
lcp-echo-interval 30
lcp-echo-failure 4
Here, I used the public DNS to Google, free for you to modify and use the ones of your choice ! ;)
Adding users
FINALLY ! This crucial step will allow you to set the login and passwords to your vpn users, just edit this file :
nano /etc/ppp/chap-secrets
below a typical line:
jean l2tpd 0F92E5FC2414101EA *
ATTENTION : This file is case sensitive, if you put a capital letter, you need to keep it when you type your login or password.
Finally restart :
/etc/init.d/ipsec restart && /etc/init.d/xl2tpd restart
This article seem useful to you ?
Enable comment auto-refresher