CentOS下实现GRE over IPsec

本文IPsec部分参考 sqzhao 的CSDN 博客，原文地址请点击：https://blog.csdn.net/sqzhao/article/details/76093994?utm_source=copy

一、方案背景
两台centos7服务器构建安全的VPN通道实现内网互通，IPsec接收端需要有弹性IP且安全组放通发起端的UDP500和UDP4500端口。

二、IP规划
接收端：
IPsec地址：192.168.255.31/32，GRE地址：192.168.254.1/30
发起端：
IPsec地址：192.168.255.28/32，GRE地址：192.168.254.2/30

三、部署IPsec
3.1、安装所需软件

yum install epel-release
yum install strongswan openssl iproute iptables

3.2、生成证书（在接收端生成，将client.cert.p12复制到发起端）

    export PUBLIC_IP=x.x.x.x   # 这里换成接收端的公网IPmkdir -p /usr/local/ipsec && cd /usr/local/ipsec/strongswan pki --gen --outform pem > ca.pemstrongswan pki --self --in ca.pem --dn "C=CN, O=VPN, CN=strongSwan CA" --ca --lifetime 3652 \--outform pem > ca.cert.pemstrongswan pki --gen --outform pem > server.pemstrongswan pki --pub --in server.pem | strongswan pki --issue --lifetime 3652 --cacert ca.cert.pem \--cakey ca.pem --dn "C=CN, O=VPN, CN=${PUBLIC_IP}" --san="${PUBLIC_IP}" \--flag serverAuth --flag ikeIntermediate --outform pem > server.cert.pemstrongswan pki --gen --outform pem > client.pemstrongswan pki --pub --in client.pem | strongswan pki --issue --lifetime 3652 --cacert ca.cert.pem \--cakey ca.pem --dn "C=CN, O=VPN, CN=strongSwan Client" --outform pem > client.cert.pemopenssl pkcs12 -export -inkey client.pem -in client.cert.pem -name "strongSwan Client" \-certfile ca.cert.pem -caname "strongSwan CA" -out client.cert.p12# Export Password: ###输入私钥密码，这里的密码需要配置到发起端ipsec.secrets文件里

3.3、copy证书到对应文件夹（client.cert.p12是由上一步接收端生成的，直接copy过来）

#    接收端证书cp -r ca.cert.pem /etc/strongswan/ipsec.d/cacerts/  cp -r server.cert.pem /etc/strongswan/ipsec.d/certs/  cp -r server.pem /etc/strongswan/ipsec.d/private/  cp -r client.cert.pem /etc/strongswan/ipsec.d/certs/  cp -r client.pem /etc/strongswan/ipsec.d/private/
#    发起端证书cp -r client.cert.p12 /etc/strongswan/ipsec.d/private/

3.4、接收端配置文件和密码文件

    cat >strongswan.conf <<EOF# strongswan.conf - strongSwan configuration file## Refer to the strongswan.conf(5) manpage for details## Configuration changes should be made in the included filescharon {load_modular = yesduplicheck.enable = nocompress = yesplugins {include strongswan.d/charon/*.conf}dns1 = 8.8.8.8}include strongswan.d/*.confEOF

    cat > ipsec.conf << EOF# ipsec.conf - strongSwan IPsec configuration file# basic configurationconfig setup# strictcrlpolicy=yesuniqueids = never# Add connections here.conn %defaultleft=%anyleftsubnet=192.168.255.31/32right=%anyrightsourceip=192.168.255.28/32dpdaction=clearconn IKEv2-CERTkeyexchange=ikev2leftauth=pubkeyleftcert=server.cert.pemrightauth=pubkeyrightcert=client.cert.pemauto=startEOF

    cat >ipsec.secrets <<EOF# ipsec.secrets - strongSwan IPsec secrets file: RSA server.pem: PSK "12345678"stone : XAUTH "PCeva2016"stone : EAP “PCeva2016"EOF

    cp -r strongswan.conf ipsec.conf ipsec.secrets /etc/strongswan/

3.5、发起端配置文件和加密文件

    cat > strongswan.conf <<EOF# strongswan.conf - strongSwan configuration file## Refer to the strongswan.conf(5) manpage for details## Configuration changes should be made in the included filescharon {load_modular = noplugins {include strongswan.d/charon/*.confresolve {file = /etc/resolv.conf}}}include strongswan.d/*.confEOF

cat > ipsec.conf <<EOF# ipsec.conf - strongSwan IPsec configuration file# basic configurationconfig setup# strictcrlpolicy=yesuniqueids = never# Add connections here.conn %defaultdpdaction=clearconn rwkeyexchange=ikev2left=%anyleftsourceip=%configleftauth=pubkeyleftid="C=CN, O=VPN, CN=strongSwan Client"right=${PUBLIC_IP}rightid="C=CN, O=VPN, CN=${PUBLIC_IP}"rightsubnet=192.168.255.31/32rightauth=pubkeyauto=startEOF

    cat > ipsec.secrets <<EOF# ipsec.secrets - strongSwan IPsec secrets file: P12 client.cert.p12 "admin"  # 这里的admin是3.2里输入的密码: PSK "12345678"stone : XAUTH "PCeva2016"stone : EAP “PCeva2016"EOF

    cp -f ipsec.conf ipsec.secrets strongswan.conf /etc/strongswan/

3.6、启动strongswan并检查IPsec状态

    strongswan start/restart/stopstrongswan status
#    正常输出：Security Associations (1 up, 0 connecting):IKEv2-CERT[11]: ESTABLISHED 2 hours ago, 172.31.28.1[C=CN, O=VPN, CN=x.x.x.x]...x.x.x.x[C=CN, O=VPN, CN=strongSwan Client]IKEv2-CERT{40}:  INSTALLED, TUNNEL, reqid 10, ESP in UDP SPIs: cc60cb68_i c56c711e_oIKEv2-CERT{40}:   192.168.255.31/32 === 192.168.255.28/32ip address ls eth0
#    正常输出：2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 9001 qdisc pfifo_fast state UP qlen 1000link/ether 06:b3:38:c9:2f:5f brd ff:ff:ff:ff:ff:ffinet 172.31.28.1/20 brd 172.31.31.255 scope global dynamic eth0valid_lft 2973sec preferred_lft 2973secinet 192.168.255.31/32 scope global eth0valid_lft forever preferred_lft foreverping 192.168.255.28 -c 1ping 192.168.255.31 -c 1

四、GRE配置和路由配置（另一端的GRE配置互换IP即可）

    #!/bin/bashremote_ipsec=192.168.255.31local_ipsec=192.168.255.28remote_gre=192.168.254.1local_gre=192.168.254.2gre_mask=30remote_subnets=(172.31.0.0/16)   # 数组中每个子网用空格隔开strongswan statusping -c 1 -W 1 ${remote_ipsec} &>/dev/nullif [ $? -eq 0 ];thenecho ">>>ipsec ok"echo ">>>start add gre tunnel"modprobe ip_greip tunnel del tunnel0ip tunnel add tunnel0 mode gre remote ${remote_ipsec} local ${local_ipsec}ip link set tunnel0 up mtu 1400ip address add ${local_gre}/${gre_mask} peer ${remote_gre}/${gre_mask} dev tunnel0#       ip route add ${remote_subnet} via ${remote_gre} dev tunnel0ping -c 1 -W 1 ${remote_gre} &>/dev/nullif [ $? -eq 0 ]; thenecho ">>>gre tunnel ok"fielseecho ">>>ipsec error, exit"exit 1fiecho ">>>start add ip route"for subnet in ${remote_subnets[@]}doip route add ${subnet} via ${remote_gre} dev tunnel0done

五、配置VPC路由和NAT
VPC路由表中访问对端内网网段的路由指向本端的ECS主机

隧道内的流量从tunnel0接口进来从eth0出去，转换为eth0的接口IP
    接收端NAT：
    iptables -t nat -A POSTROUTING -s 172.16.0.0/16 -o eth0 -j SNAT --to 172.18.0.1
    iptables -t nat -A POSTROUTING -s 172.17.0.0/16 -o eth0 -j SNAT --to 172.18.0.1
    发起端NAT：
    iptables -t nat -A POSTROUTING -s 172.18.0.0/16 -o eth0 -j SNAT --to 172.16.0.1

CentOS下实现GRE over IPsec相关推荐

H3C GRE over IPsec实验
GRE over IPsec VPN实验一.拓扑图二.组网需求三.配置步骤 1.配置各设备IP地址 2.配置默认路由 3.配置DHCP 4.配置 GRE over IPsec VPN (1)在 ...
HUAWEI篇 NGFW与AR网关建立GRE over IPSec隧道
组网需求如图1-1所示,企业希望总部和分支的内网可以安全互访,且分支和总部间要能够传送组播数据(例如企业内网部部署了动态路由,动态路由交互过程中存在组播报文交互).由于单纯的IPSec隧道不能传送组 ...
华三（H3C）GRE OVER IPsec实验
实验拓扑目录实验需求 1. 某企业北京总部.上海分支.武汉分支分别通过 R1,R3,R4 接入互联网,配置默认路由连通公网 2. 按照图示配置 IP 地址,R1,R3,R4 分别配置 Loopba ...
GRE和IPsec搭配使用，到底是谁over谁？先看GRE over IPsec
关于相同的二层子网跨广域网进行互通,目前我们测试了VXLAN.IPsec和GRE三种方式,分别是(VXLAN小实验:VXLAN头端复制配置).(为什么IPsec两端内网的网段能不能重复?分明可以实现! ...
IPSec over GRE 和 GRE over IPSec学习总结
GRE可以与IPSec配合使用,通过建立GRE over IPSec隧道,对路由协议.语音.视频等数据先进性GRE封装,再对封装后的报文进行IPsec处理. 二者配合使用的有点: 提高数据在隧道中的传 ...
查看linux系统版本centos,CentOS下查看系统版本的4种方法
Linux有很多的发行版,不同的版本会有一些细微区别,所以经常需要查看服务器系统的版本号. 下面来看下CentOS下如何查看CentOS版本. 方法1:cat /etc/issue 执行命令:[www ...
华为IPsce以及GRE over IPSec配置练习
华为IPsce以及GRE over IPSec配置练习一.拓扑以及需求二.配置思路 (1)打通核心层 (2)利用GRE将PC1.PC2逻辑上连接起来 (3)需求加密1:加密PC3与PC4的通信数据 ...
基于HCL的GRE over IPSec(野蛮模式多分支通信) 企业组网
目录组网拓扑: 组网需求组网步骤 1. 配置默认路由部分略 2. 配置 IP 地址部分略 3. 配置 DHCP 部分略 4. 北京总部.上海分支.济南分支配置 GRE over IPsec VPN ...
centos下将vim配置为强大的源码阅读器
每日杂事缠身,让自己在不断得烦扰之后终于有了自己的清静时光来熟悉一下我的工具,每次熟悉源码都需要先在windows端改好,拖到linux端,再编译.出现问题,还得重新回到windows端,这个过程太耗 ...

CentOS下实现GRE over IPsec

CentOS下实现GRE over IPsec相关推荐

最新文章

热门文章