Как правильно настроить VPN в Debian \ Ubuntu?

Question

[Anton Nadtoka]

Как правильно настроить VPN? Перепробовал уже гору мануалов и разных серверов - Debian 6\7\8, Ubuntu 10\12\14. Результат один - не подключается.

https://habrahabr.ru/post/155929/
https://raymii.org/s/tutorials/IPSEC_L2TP_vpn_with...

Логи ( cat /var/log/syslog )

Sep 8 13:03:46 example ipsec_setup: Starting Openswan IPsec U2.6.37/K2.6.32-042stab113.21...
Sep 8 13:03:46 example ipsec_setup: Using NETKEY(XFRM) stack
Sep 8 13:03:46 example ipsec_setup: multiple ip addresses, using 127.0.0.2 on venet0
Sep 8 13:03:46 example ipsec_setup: ...Openswan IPsec started
Sep 8 13:03:46 example ipsec__plutorun: adjusting ipsec.d to /etc/ipsec.d
Sep 8 13:03:46 example pluto: adjusting ipsec.d to /etc/ipsec.d
Sep 8 13:03:46 example ipsec__plutorun: 002 added connection description "L2TP-PSK-NAT"
Sep 8 13:03:46 example ipsec__plutorun: 002 added connection description "L2TP-PSK-noNAT"
Sep 8 13:03:46 example xl2tpd[521]: Enabling IPsec SAref processing for L2TP transport mode SAs
Sep 8 13:03:46 example xl2tpd[521]: IPsec SAref does not work with L2TP kernel mode yet, enabling forceuserspace=yes
Sep 8 13:03:46 example xl2tpd[521]: parse_config: line 9: require authentication must be 'yes' or 'no'
Sep 8 13:03:46 example xl2tpd[521]: init: Unable to load config file
Sep 8 13:03:46 example sm-mta[564]: gethostbyaddr(127.0.0.2) failed: 1
Sep 8 13:03:46 example sm-mta[566]: starting daemon (8.14.4): SMTP+queueing@00:10:00
Sep 8 13:04:02 example ipsec_setup: Stopping Openswan IPsec...
Sep 8 13:04:03 example ipsec_setup: ...Openswan IPsec stopped
Sep 8 13:04:03 example ipsec_setup: Starting Openswan IPsec U2.6.37/K2.6.32-042stab113.21...
Sep 8 13:04:03 example ipsec_setup: Using NETKEY(XFRM) stack
Sep 8 13:04:03 example ipsec_setup: multiple ip addresses, using 127.0.0.2 on venet0
Sep 8 13:04:03 example ipsec_setup: ...Openswan IPsec started
Sep 8 13:04:03 example ipsec__plutorun: adjusting ipsec.d to /etc/ipsec.d
Sep 8 13:04:03 example pluto: adjusting ipsec.d to /etc/ipsec.d
Sep 8 13:04:03 example ipsec__plutorun: 002 added connection description "L2TP-PSK-NAT"
Sep 8 13:04:03 example ipsec__plutorun: 002 added connection description "L2TP-PSK-noNAT"



Хостер виртуалки говорит что они ничего не блокируют. Пробовал просканировать порты - доступен только 22. Как можно узнать кто виноват?

1. Провайдер
2. Хостер
3. Кривые руки
4. IPTables

Comments

[none none]

Вы хотите поднять VPN сервер на L2TP+IPSEC?

[Anton Nadtoka]

да, но перепробовал массу вариантов и все никак

[none none]

Вы вот так сделайте и посмотрите на результат:
ipsec verify

[Anton Nadtoka]

root@example:~# ipsec verify
perl: warning: Setting locale failed.
perl: warning: Please check that your locale settings:
LANGUAGE = (unset),
LC_ALL = (unset),
LC_CTYPE = "UTF-8",
LANG = (unset)
are supported and installed on your system.
perl: warning: Falling back to the standard locale ("C").
Checking your system to see if IPsec got installed and started correctly:
Version check and ipsec on-path [OK]
Linux Openswan U2.6.37/K2.6.32-042stab113.21 (netkey)
Checking for IPsec support in kernel [OK]
SAref kernel support [N/A]
NETKEY: Testing XFRM related proc values [OK]
[OK]
[OK]
Checking that pluto is running [OK]
Pluto listening for IKE on udp 500 [OK]
Pluto listening for NAT-T on udp 4500 [OK]
Two or more interfaces found, checking IP forwarding [OK]
Checking NAT and MASQUERADEing [OK]
Checking for 'ip' command [OK]
Checking /bin/sh is not /bin/dash [WARNING]
Checking for 'iptables' command [OK]
Opportunistic Encryption Support [DISABLED]

[Anton Nadtoka]

были проблемы, но теперь все ок (обращался к хостеру) - ipsec выдавал failed

[Anton Nadtoka]

но VPN все равно не работает

[none none]

У Вас ядро не подерживает SAref - SAref kernel support [N/A].
И честно сказать не понимаю, почему не поднять OpenVPN, он на UDP, для мобильных клиентов самое то.

Answer 1

[Игорь]

Sep 8 13:03:46 example xl2tpd[521]: parse_config: line 9: require authentication must be 'yes' or 'no'
Sep 8 13:03:46 example xl2tpd[521]: init: Unable to load config file

Comments

[Anton Nadtoka]

спасибо, исправил - эффект нулевой

Sep 8 13:38:14 example xl2tpd[515]: Enabling IPsec SAref processing for L2TP transport mode SAs
Sep 8 13:38:14 example xl2tpd[515]: IPsec SAref does not work with L2TP kernel mode yet, enabling forceuserspace=yes
Sep 8 13:38:14 example xl2tpd[515]: setsockopt recvref[30]: Protocol not available
Sep 8 13:38:14 example xl2tpd[515]: This binary does not support kernel L2TP.
Sep 8 13:38:14 example xl2tpd[516]: xl2tpd version xl2tpd-1.3.1 started on example PID:516
Sep 8 13:38:14 example xl2tpd[516]: Written by Mark Spencer, Copyright (C) 1998, Adtran, Inc.
Sep 8 13:38:14 example xl2tpd[516]: Forked by Scott Balmos and David Stipp, (C) 2001
Sep 8 13:38:14 example xl2tpd[516]: Inherited by Jeff McAdams, (C) 2002
Sep 8 13:38:14 example xl2tpd[516]: Forked again by Xelerance (www.xelerance.com) (C) 2006
Sep 8 13:38:14 example xl2tpd[516]: Listening on IP address 0.0.0.0, port 1701
Sep 8 13:38:14 example sm-mta[559]: gethostbyaddr(127.0.0.2) failed: 1
Sep 8 13:38:14 example sm-mta[561]: starting daemon (8.14.4): SMTP+queueing@00:10:00
Sep 8 13:38:36 example ipsec_setup: Stopping Openswan IPsec...
Sep 8 13:38:37 example ipsec_setup: ...Openswan IPsec stopped
Sep 8 13:38:37 example ipsec_setup: Starting Openswan IPsec U2.6.37/K2.6.32-042stab113.21...
Sep 8 13:38:37 example ipsec_setup: Using NETKEY(XFRM) stack
Sep 8 13:38:37 example ipsec_setup: multiple ip addresses, using 127.0.0.2 on venet0
Sep 8 13:38:37 example ipsec_setup: ...Openswan IPsec started
Sep 8 13:38:37 example ipsec__plutorun: adjusting ipsec.d to /etc/ipsec.d
Sep 8 13:38:37 example pluto: adjusting ipsec.d to /etc/ipsec.d
Sep 8 13:38:37 example ipsec__plutorun: 002 added connection description "L2TP-PSK-NAT"
Sep 8 13:38:37 example ipsec__plutorun: 002 added connection description "L2TP-PSK-noNAT"
Sep 8 13:40:01 example CRON[824]: (smmsp) CMD (test -x /etc/init.d/sendmail && /usr/share/sendmail/sendmail cron-msp)

[Игорь]

Anton Nadtoka: почему же нулевой то

Sep 8 13:38:14 example xl2tpd[515]: IPsec SAref does not work with L2TP kernel mode yet, enabling forceuserspace=yes
Sep 8 13:38:14 example xl2tpd[515]: setsockopt recvref[30]: Protocol not available
Sep 8 13:38:14 example xl2tpd[515]: This binary does not support kernel L2TP.

Answer 2

[Алексей Черемисин]

В дополнение, поставили бы openvpn, все проблемы на раз решаются. Ну и для мака есть отличный клиент - https://tunnelblick.net
Для виндовса openvpn клиентов тоже как грязи.

Comments

[Anton Nadtoka]

TunnelBlick я использую, мне также интересно чтобы и телефоны работали без jailbrake на штатном софте