转眼一年就这么过去了，补下之前说到的手动搭建strongswan，免得拖到明年。

准备工作

一台linux服务器，这里以Debian10为例
strognswan安装包，官网下载，我用的是5.9.1
域名，这里以api.exmaple.com为例

一.安装strongswan

1）更新，添加依赖：

apt update -y
apt install libpam0g-dev libssl-dev make gcc curl tcpdump -y

2）解压：
将strongswan安装包上传到linux服务器，解压后进入安装目录

tar -zxvf strongswan-5.9.1.tar.gz
cd strongswan-5.9.1

3）配置安装：
把相关的配置参数都加上，运行

./configure  --enable-eap-identity --enable-eap-md5 \
--enable-eap-mschapv2 --enable-eap-tls --enable-eap-ttls --enable-eap-peap \
--enable-eap-tnc --enable-eap-dynamic --enable-eap-radius --enable-xauth-eap \
--enable-xauth-pam  --enable-dhcp  --enable-openssl  --enable-addrblock --enable-unity \
--enable-certexpire --enable-radattr --enable-swanctl --enable-openssl --disable-gmp

最后安装

make && make install

安装完毕后会在/usr/local/etc/下生成strongswan文件

二.配置SSL证书

这里依旧用certbot申请免费证书，具体步骤可以参考这篇文章：
Certbot免费证书的安装·使用·自动续期_B★R★S的博客-CSDN博客_certbot renew
证书申请完后，生成strongswan对应的软链接：

ln -s /etc/letsencrypt/live/api.example.com/cert.pem /usr/local/etc/swanctl/x509/
ln -s /etc/letsencrypt/live/api.example.com/chain.pem /usr/local/etc/swanctl/x509ca/
ln -s /etc/letsencrypt/live/api.example.com/privkey.pem /usr/local/etc/swanctl/private/

三.配置strongswan

1）新建配置文件并编辑，名称随意：

vim /usr/local/etc/swanctl/conf.d/api.example.com.conf

内容如下，有中文注释的地方需要根据自身情况修改，其他不变：

connections {ikev2-eap-mschapv2 {version = 2unique = never# proposals = aes256-sha1-modp1024, aes128-sha1-modp1024, 3des-sha1-modp1024proposals = aes256-sha256-prfsha256-modp2048, aes256gcm16-prfsha384-modp1024, defaultrekey_time = 0spools = primary-pool-ipv4, primary-pool-ipv6fragmentation = yesdpd_delay = 30ssend_cert = alwayslocal_addrs = %anylocal {certs = cert.pem# 配置SSL证书的域名id = api.example.com}remote {auth = eap-mschapv2eap_id = %any}children {ikev2-eap-mschapv2 {local_ts = 0.0.0.0/0,::/0rekey_time = 0sdpd_action = clear# esp_proposals = aes256-sha1, aes128-sha1, 3des-sha1esp_proposals = aes256-sha256, aes128-sha1, default}}}
}pools {primary-pool-ipv4 {# 防火墙虚拟ip段addrs = 10.11.1.0/24dns = 8.8.8.8,8.8.4.4}primary-pool-ipv6 {addrs = fec1::0/16dns = 2001:4860:4860::8888,2606:4700:4700::1111}
}secrets {private-www {file = privkey.pem}# id为用户名，secret为密码eap-test {id = testsecret = "123321" }
}

2）启用日志功能
编辑/usr/local/etc/strongswan.d/charon-logging.conf文件

filelog {charon-debug-log {# this setting is required with 5.7.0 and newer if the path contains dots# path是生成日志文件的目录path = /tmp/charon_debug.logtime_format = %a, %Y-%m-%d, %H:%M:%Sdefault = 2mgr = 0net = 1enc = 1asn = 1job = 1ike_name = yesappend = noflush_line = yes}......
)

四.配置防火墙

1）新建并编辑防火墙文件：

vim /etc/iptables-swan

# Generated by xtables-save v1.8.2 on Tue Dec 21 09:25:40 2021
*nat
:PREROUTING ACCEPT [440:29130]
:INPUT ACCEPT [3:2180]
:POSTROUTING ACCEPT [1:68]
:OUTPUT ACCEPT [1:68]
-A POSTROUTING -s 10.11.1.0/24 -o eth0 -m policy --dir out --pol ipsec -j ACCEPT
-A POSTROUTING -s 10.11.1.0/24 -o eth0 -j MASQUERADE
COMMIT
# Completed on Tue Dec 21 09:25:40 2021
# Generated by xtables-save v1.8.2 on Tue Dec 21 09:25:40 2021
*mangle
:PREROUTING ACCEPT [14133:8077083]
:INPUT ACCEPT [5360:1107198]
:FORWARD ACCEPT [8773:6969885]
:OUTPUT ACCEPT [6322:6935214]
:POSTROUTING ACCEPT [15070:13891608]
COMMIT
# Completed on Tue Dec 21 09:25:40 2021
# Generated by xtables-save v1.8.2 on Tue Dec 21 09:25:40 2021
*raw
:PREROUTING ACCEPT [14133:8077083]
:OUTPUT ACCEPT [6322:6935214]
COMMIT
# Completed on Tue Dec 21 09:25:40 2021
# Generated by xtables-save v1.8.2 on Tue Dec 21 09:25:40 2021
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [6322:6935214]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -i eth0 -p ah -j ACCEPT
-A INPUT -i eth0 -p esp -j ACCEPT
-A INPUT -i eth0 -p udp -m udp --dport 500 -j ACCEPT
-A INPUT -i eth0 -p udp -m udp --dport 4500 -j ACCEPT
-A INPUT -p udp -m udp --dport 1812 -j ACCEPT
-A INPUT -p udp -m udp --dport 1813 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 8080 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -i eth0 -m policy --dir in --pol ipsec -j ACCEPT
-A FORWARD -d 10.11.1.0/24 -o eth0 -m policy --dir out --pol ipsec -j ACCEPT
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT

2）使配置生效

/usr/sbin/iptables-restore < /etc/iptables-swan

3）查看是否生效

/usr/sbin/iptables --list

Chain INPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED
ACCEPT     icmp --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere
ACCEPT     tcp  --  anywhere             anywhere             state NEW tcp dpt:ssh
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:http
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:https
ACCEPT     ah   --  anywhere             anywhere
ACCEPT     esp  --  anywhere             anywhere
ACCEPT     udp  --  anywhere             anywhere             udp dpt:isakmp
ACCEPT     udp  --  anywhere             anywhere             udp dpt:ipsec-nat-t
ACCEPT     udp  --  anywhere             anywhere             udp dpt:radius
ACCEPT     udp  --  anywhere             anywhere             udp dpt:radius-acct
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:http-alt
REJECT     all  --  anywhere             anywhere             reject-with icmp-host-prohibitedChain FORWARD (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere             policy match dir in pol ipsec
ACCEPT     all  --  anywhere             10.11.1.0/24         policy match dir out pol ipsec
REJECT     all  --  anywhere             anywhere             reject-with icmp-host-prohibitedChain OUTPUT (policy ACCEPT)
target     prot opt source               destination

五.配置转发和开机自启

1）开启转发
编辑/etc/sysctl.conf文件，在末尾添加以下内容

#开启内核ipv4转发
net.ipv4.ip_forward = 1
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0#开启内核ipv6转发
net.ipv6.conf.all.forwarding = 1

使配置生效

/sbin/sysctl -p

2）配置防火墙开机自启

vim /etc/network/if-pre-up.d/iptables

#!/bin/sh
/usr/sbin/iptables-restore < /etc/iptables-swan

修改可执行权限

chmod +x /etc/network/if-pre-up.d/iptables

3）配置strongswan开机自启

vim /etc/init.d/strongswan

#!/bin/bash
/usr/local/sbin/ipsec restart && sleep 5 && /usr/local/sbin/swanctl --load-all

修改可执行权限

chmod +x /etc/init.d/strongswan

六.启动测试

1）启动strongswan

/etc/init.d/strongswan

2）下载strongswan手机客户端
apk地址：Index of /Android
添加VPN配置如下图，此处密码对应上方配置为123321

连接成功后查看ip是否变化，尝试访问其他网站，若能正常访问则大功告成

从零开始搭建strongswan相关推荐

ssm radis mysql_从零开始搭建框架SSM+Redis+Mysql（一）之摘要
从零开始搭建框架SSM+Redis+Mysql(一)之摘要本文章为本人实际的操作后的回忆笔记,如果有步骤错漏,希望来信307793969@qq.com或者评论指出. 本文章只体现过程,仅体现操作流程 ...
从零开始搭建一个vue项目 -- vue-cli/cooking-cli（一）
从零开始搭建一个vue项目 -- vue-cli/cooking-cli(一) 1.vue-cli搭建一个可靠成熟的项目 1.介绍 vue-cli 我是去年六月份接触的vue1.0,当时还是个菜逼,当 ...
python ai应用开发_AI应用开发实战 - 从零开始搭建macOS开发环境
AI应用开发实战 - 从零开始搭建macOS开发环境联系我们 OpenmindChina@microsoft.com 零.前提条件一台能联网的电脑,使用macOS操作系统请确保鼠标.键盘.显示器 ...
从零开始搭建创业公司后台技术栈！
原文 : http://ju.outofmemory.cn/entry/351897 前言说到后台技术栈,脑海中是不是浮现的是这样一幅图? 图 1 有点眼晕,以下只是我们会用到的一些语言的合集,而且 ...
在阿里云服务器（ECS）上从零开始搭建nginx服务器
本文介绍了如何在阿里云服务器上从零开始搭建nginx服务器.阿里云服务器(ECS)相信大家都不陌生,感兴趣的同学可以到http://www.aliyun.com/product/ecs去购买,或到体验 ...
Silverlight游戏设计(Game Design)：(四)从零开始搭建游戏主体框架
思路已俨然清晰,接下来要做的是从零开始搭建游戏的主体框架.Silverlight作为RIA界的新宠儿,不仅在游戏开发方面性能优越,在企业开发领域的优异表现同样日益显著.像我们这些长期从事.NET开发的 ...
从零开始搭建Android框架系列
原文链接:http://www.jianshu.com/nb/3767449 开篇介绍和工程目录结构[从零开始搭建android框架系列(1)] 不容错过,最全的安卓架构合集[从零开始搭建androi ...
vue + element ui 的后台管理系统框架_从零开始搭建 VUE + Element UI后台管理系统框架...
点击右上方红色按钮关注"web秀",让你真正秀起来前言后台管理系统前端框架,现在很流行的形式都是,上方和左侧都是导航菜单,中间是具体的内容.比如阿里云.七牛云.头条号.百家号等 ...
乐视秒杀架构解读：从零开始搭建百万每秒订单系统
http://dbaplus.cn/news-21-475-1.html 在各种秒杀活动大行其道的今天,订单系统的性能与稳定日益重要.乐视集团作为这一技术的佼佼者,在多次的电商狂欢节中都能抢占商机.拔 ...

从零开始搭建strongswan