Home Documentation VPN - Virtual Private Network VPN server on Centos 5.5

VPN server on Centos 5.5

Posted by peter on December 21, 2011

Installing a vpn server on Centos 5.5

Make sure you yum install the following:

ppp

iptables

make

gcc

gmp-devel

xmlto

bison

flex

xmlto

libpcap-devel

lsof

vim-enhanced

yum install openswan

Edit the file /etc/ipsec.conf and make sure the following is uncommented:

include /etc/ipsec.d/*.conf

edit the file /etc/ipsec.d/ipsec.conf (you will be creating an empty file), and add the following( the indentations are important):

conn L2TP-PSK-NAT
rightsubnet=vhost:%priv
also=L2TP-PSK-noNAT
conn L2TP-PSK-noNAT
authby=secret
pfs=no
auto=add
keyingtries=3
rekey=no
ikelifetime=8h
keylife=1h
type=transport
left=192.168.214.13 #your public IP , or IP to which the clents will be connecting
leftprotoport=17/1701
right=%any
rightprotoport=17/%any

conn block
auto=ignore
conn private
auto=ignore
conn private-or-clear
auto=ignore
conn clear-or-private
auto=ignore
conn clear
auto=ignore
conn packetdefault
auto=ignore

Edit the file /etc/ipsec.secrets and make sure the following line is uncommented:

    include /etc/ipsec.d/*.secrets

Create and edit the file /etc/ipsec.d/ipsec.secrets and add the following:

    192.168.214.13 %any: PSK "server.lap.work"

Enable IP Forwarding in /etc/sysctl.conf (OR make sure it loads when the firewall loads)

    net.ipv4.ip_forward = 1

Reload Sysctl settings with the following command:

    sysctl -p

Enable masquerading with the following command \ (or put it in the firewall scripts):

    iptables -t nat -A POSTROUTING -j MASQUERADE

Create a file /usr/bin/zl2tpset and make it executable, add the following to the file:

NB - first check the /proc/sys/net/ipv4/conf/ folder to see what "sub" folders there are and add "eth1", "eth2" and "default" and "lo" etc as needed. See below.


#!/bin/bash
echo 0 > /proc/sys/net/ipv4/conf/eth0/accept_redirects
echo 0 > /proc/sys/net/ipv4/conf/eth1/accept_redirects
echo 0 > /proc/sys/net/ipv4/conf/eth2/accept_redirects
echo 0 > /proc/sys/net/ipv4/conf/eth3/accept_redirects
echo 0 > /proc/sys/net/ipv4/conf/all/accept_redirects
echo 0 > /proc/sys/net/ipv4/conf/lo/accept_redirects
echo 0 > /proc/sys/net/ipv4/conf/default/accept_redirects
echo 0 > /proc/sys/net/ipv4/conf/eth0/send_redirects
echo 0 > /proc/sys/net/ipv4/conf/eth1/send_redirects
echo 0 > /proc/sys/net/ipv4/conf/eth2/send_redirects
echo 0 > /proc/sys/net/ipv4/conf/eth3/accept_redirects
echo 0 > /proc/sys/net/ipv4/conf/all/send_redirects
echo 0 > /proc/sys/net/ipv4/conf/lo/send_redirects
echo 0 > /proc/sys/net/ipv4/conf/default/send_redirects

Run the above script by typing the following command:

    zl2tpset

Restart ipsec and verify with the following commands:

    service ipsec restart
    ipsec verify

Make the following directories with the following command:

mkdir -p /ztmp/l2tp

Download and install rp-l2tp with the following set of commands:

    cd /ztmp/l2tp
    wget http://mirror.zeddicus.com/sources/rp-l2tp-0.4.tar.gz
    tar zxvf rp-l2tp-0.4.tar.gz
    cd rp-l2tp-0.4
    ./configure
    make
    make install

Run the following commands:

    mkdir /var/run/xl2tpd/
    ln -s /usr/local/sbin/l2tp-control /var/run/xl2tpd/l2tp-control

Download and install xl2pd
cd /ztmp/l2tp
wget http://mirror.zeddicus.com/sources/xl2tpd-1.2.4.tar.gz
tar zxvf xl2tpd-1.2.4.tar.gz
cd xl2tpd-1.2.4
make install

Create and edit with the following commands:

mkdir /etc/xl2tpd

Edit the /etc/xl2tpd/xl2tpd.conf file and add the following:
[global]
ipsec saref = yes
[lns default]
ip range = 10.20.0.200-10.20.0.254
local ip = 10.20.0.2
refuse chap = yes
refuse pap = yes
require authentication = yes
ppp debug = yes
pppoptfile = /etc/ppp/options.xl2tpd
length bit = yes

Execute the following commands:

    cp /etc/ppp/options.xl2tpd{,.bkp}
    rm -rf /etc/ppp/options.xl2tpd

Create and edit the /etc/ppp/options.xl2tpd file and add the following into it:

    require-mschap-v2
    ms-dns 8.8.8.8
    ms-dns 8.8.4.4
    asyncmap 0
    auth
    crtscts
    lock
    hide-password
    modem
    debug
    name l2tpd
    proxyarp
    lcp-echo-interval 30
    lcp-echo-failure 4

Add the user login details to /etc/ppp/chap-secrets file as follows:

    test   l2tpd   test123    *

Run the commands

    zl2tpset
    xl2tpd

Append the following lines to the /etc/rc.local file. (or makesure the "iptables part is in the firewall script):

    iptables -t nat -A POSTROUTING -j MASQUERADE
    /etc/init.d/ipsec restart
    /usr/bin/zl2tpset
    /usr/local/sbin/xl2tpd

Connect to the server with the following credentials:
ServerIP:25.289.2.24
username:test
password:test123
PSK Key:server.lap.work

« Previous

Linux Network Solutions

VPN server on Centos 5.5

Comments:

Leave a Reply