[开发工具]轻松搭建strongswan（免证书）

基于 StrongSwan 和 xl2tpd，?轻松实现搭建的脚本，很好用：

Github脚本地址

执行脚本后只需要修改iptables和内网转发配置：

以Debian为例：

配置iptables

vim?/etc/iptables-strongswan

*nat
:PREROUTING ACCEPT [152:9504]
:INPUT ACCEPT [8:386]
:OUTPUT ACCEPT [57:4191]
:POSTROUTING ACCEPT [57:4191]
-A POSTROUTING -s 10.1.0.0/24 -o eth0 -m policy --dir out --pol ipsec -j ACCEPT
-A POSTROUTING -s 10.1.0.0/24 -o eth0 -j MASQUERADE
COMMIT
# Completed on Fri Feb  5 08:06:47 2021
# Generated by iptables-save v1.8.4 on Fri Feb  5 08:06:47 2021
*mangle
:PREROUTING ACCEPT [1340:108626]
:INPUT ACCEPT [1340:108626]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [1129:166056]
:POSTROUTING ACCEPT [1129:166056]
COMMIT
# Completed on Fri Feb  5 08:06:47 2021
# Generated by iptables-save v1.8.4 on Fri Feb  5 08:06:47 2021
*raw
:PREROUTING ACCEPT [1340:108626]
:OUTPUT ACCEPT [1129:166056]
COMMIT
# Completed on Fri Feb  5 08:06:47 2021
# Generated by iptables-save v1.8.4 on Fri Feb  5 08:06:47 2021
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [71:11660]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -i eth0 -p ah -j ACCEPT
-A INPUT -i eth0 -p esp -j ACCEPT
-A INPUT -i eth0 -p udp -m udp --dport 500 -j ACCEPT
-A INPUT -i eth0 -p udp -m udp --dport 4500 -j ACCEPT
-A INPUT -p udp -m udp --dport 1812 -j ACCEPT
-A INPUT -p udp -m udp --dport 1813 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 8080 -j ACCEPT
-A INPUT -p udp -m policy --dir in --pol ipsec -m udp --dport 1701 -j ACCEPT
-A INPUT -p udp -m udp --dport 1701 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -i eth0 -m policy --dir in --pol ipsec -j ACCEPT
-A FORWARD -d 10.1.0.0/24 -j ACCEPT
-A FORWARD -s 10.1.0.0/24 -j ACCEPT
-A FORWARD -d 10.1.0.0/24 -o eth0 -m policy --dir out --pol ipsec -j ACCEPT
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT
# Completed on Fri Feb  5 08:06:47 2021

vim /etc/network/if-pre-up.d/iptables

#!/bin/bash
/sbin/iptables-restore < /etc/iptables-strongswan

添加执行权限并执行该脚本?

chmod +x?/etc/network/if-pre-up.d/iptables

/etc/network/if-pre-up.d/iptables

?可以用iptables --list查看是否生效

配置内网转发

vim /etc/sysctl.conf

?在末尾添加如下配置，保存后执行sysctl -p命令使之生效

#开启内核ipv4转发
net.ipv4.ip_forward = 1
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0
 
#开启内核ipv6转发
net.ipv6.conf.all.forwarding = 1

如果电脑无法连接可以参考这篇文章：解决 win10 VPN连接错误

这里搭建的是l2tp协议，免证书安装。也可以用IKEv2协议的证书连接，日后有机会再出IKEv2连接的教程。