openswan安装配置手册(RSA)

来源：互联网发布：ios上玩的编程游戏编辑：程序博客网时间：2024/06/03 16:11
下载地址:www.openswan.org/download下载源码包:openswan-2.6.32.tar.gz64 位CentOS 5.8 系统环境1,解压编译安装openswantar -xvf openswan-2.6.32.tar.gzcd openswan-2.6.32make programsmake installipsec --versionLinux Openswan 2.6.32 (netkey)See `ipsec --copyright' for copyright information.2,修改系统配置文件echo “0” > /selinux/enforce (service selinux stop)sysctl -a | egrep "ipv4.*(accept|send)_redirects" | awk -F "=" '{print $1"= 0"}' >> /etc/sysctl.confvi /etc/sysctl.conf   将下面两项net.ipv4.ip_forward = 0net.ipv4.conf.default.rp_filter = 1改为net.ipv4.ip_forward = 1net.ipv4.conf.default.rp_filter = 0执行以下命令使设置生效sysctl -p 3,配置SA,CA和SB,CB的ip地址CA: 192.168.11.25SA: eth0 192.168.11.215, eth1 192.168.13.215CB: 192.168.15.191SB: eth0 192.168.15.214, eth1 192.168.13.2144,在SA和SB下分别执行以下命令,配置NAT表,为数组包加伪装在SA上执行以下命令iptables -t nat -A POSTROUTING -o eth1 -s 192.168.11.0/24 ! -d 192.168.15.0/24 -j MASQUERADE在SB上执行以下命令iptables -t nat -A POSTROUTING -o eth1 -s 192.168.15.0/24 ! -d 192.168.11.0/24 -j MASQUERADE  5,生成RSA密钥SA:ipsec newhostkey --output /etc/ipsec.secretsipsec showhostkey --leftSB:ipsec newhostkey --output /etc/ipsec.secretsipsec showhostkey --right6,配置/etc/ipsec.conf文件SA:vim /etc/ipsec.confconn net-netauto=add (start)left=192.168.13.215leftsubnet=192.168.11.0/24leftid=@192.168.13.215leftrsasigkey=0sAQN6LeaT4+zbXLzVbQ4F3YOZd5G47vMf4OiCNXkWgDe5r2AAA0+sIMp5C//fEDk8WUvH3t8FuwLW1bDdXO6ZNQejdAia074cvyhNn0Ru2RIQRS8JaDI1lRUmogK24uP+gm9pVA+UJKX5ipzLHvjO19xhnyvH6Yomhz2Eop6LYlx5IEkanLvG6yXhPrY7xPk4zoONkmKtx0Vj/jkxWby66fnc06eyAVY1yvw3xZ6IUnWw0Lg8WCZ/O06K1gvZ0WUJuyARnNYbO3hAQQ1DUM8KiKL0NtiTnNAYMv6e4p9yB+nJv3BgZrxZbq8YB5icif9zIango3QGDrK6I4C9Yvre3WSsjM4dBgCRV3SrsNqhzjrdUn3Zleftnexthop=%defaultrouteright=192.168.13.214rightsubnet=192.168.15.0/24rightid=@192.168.13.214rightrsasigkey=0sAQOM9iwp+nY6LBTZmuVCT1xod9SILPiWFJ+orYCvssYe2c0HWpsQH5lt5YffJ5JC7KxBHBrVEZvbJ+m+L3k6720VzFTbtB4/sOsP9PdNFz7JJk8dba55IP9+Op6FlZAcW7NbdL7xlL0KZoPekswd9JfzZ+TcHmwnfkLvO0pghjzZCRYi3CJO5nEoD2x8EDq4o+8D/D46f72UNWweCO4kqrPeHpF22sxUhAG3Ul2PGc9f76sNjUfVbGUGi9XX4MUotw/0blp2xYHPxVh/U7DbOG4rqChW3LF1yo6+atQUSMa2XvihXYwjfFEfP+uZH4Uku2KK4At6ZTdxx97Z+oxlkUapSp/jz4qQAK1NnOjl3PYyw40hrightnexthop=%defaultrouteSB:与SA所执行操作完全相同service ipsec restart (service ipsec status)7,启动openswan虚拟vpn在SA和SB上分别执行以下命令,启动ipsecipsec auto --add net-netipsec auto --up net-net8 验证ipsec是否配置成功在网络层进行通信(飞秋),在SA或SB上tcpdump命令抓包验证tcpdump –i eth0 host 192.168.11.11 and 192.168.15.15
0 0