使用Strongswan中IPsec协议实现站点到站点
这是IPSec站点到站点连接最后一篇，我们之前已经教导使用libreswan和netbird来搭建，最后补全最后一块版图，使用strongSwan来搭建。
阿里云 - strongSwan配置示例
样例
[!图1]
1
| dnf install epel-release
|
1
| systemctl enable firewalld.service --now
|
1
| firewall-cmd --set-default-zone trusted
|
1
| firewall-cmd --get-active-zones
|
1
| firewall-cmd --add-forward --permanent
|
1
| firewall-cmd --add-masquerade --permanent
|
需要安装strongswan和他需要的sqlite. 否则报错plugin ‘sqlite’: failed to load - sqlite_plugin_create not found and no plugin file available.
其实不需要也可以，但是我都安装上吧。
1
2
3
4
5
6
7
8
| dnf install strongswan strongswan-sqlite -y
```
复制conf到/etc/strongswan/swanctl/conf.d/*.conf
```sh
192.168.0.1/24 -- | 1.1.1.1 | === | 2.2.2.2 | -- 172.22.224.0/20
Shanghai-vpc Shanghai Beijing Beijing-vpc
|
Shanghai侧
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
| connections {
gw-gw {
local_addrs = 192.168.0.99
remote_addrs = 2.2.2.2
version = 2
reauth_time = 10800
dpd_delay = 10
rekey_time = 84600
over_time = 1800
proposals = aes-sha1-modp1024
encap = yes
local {
auth = psk
id = 1.1.1.1
}
remote {
auth = psk
id = 2.2.2.2
}
children {
net-net {
local_ts = 192.168.0.0/24
remote_ts = 172.22.224.0/20
mode = tunnel
rekey_time = 85500
dpd_action = restart
start_action = start
close_action = start
esp_proposals = aes-sha1-modp1024
priority = 1
}
}
}
|
另一台Beijing侧配置如下：
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
| connections {
gw-gw {
local_addrs = 172.22.231.242
remote_addrs = 1.1.1.1
version = 2
reauth_time = 10800
dpd_delay = 10
rekey_time = 84600
over_time = 1800
proposals = aes-sha1-modp1024
encap = yes
local {
auth = psk
id = 2.2.2.2
}
remote {
auth = psk
id = 1.1.1.1
}
children {
net-net {
local_ts = 172.22.224.0/20
remote_ts = 192.168.0.0/24
mode = tunnel
rekey_time = 85500
dpd_action = restart
start_action = start
close_action = start
esp_proposals = aes-sha1-modp1024
priority = 1
}
}
}
|
然后先
之后再
1
| systemctl start strongswan
|
你可以通过以下方式查看配置
1
2
3
| systemctl restart strongswan
swanctl --load-all
watch swanctl --list-sas
|
1
2
3
4
5
6
7
8
9
10
11
12
| [root@gw2 ~]
gw-gw:
local '2.2.2.2' @ 172.22.231.242[4500]
remote '1.1.1.1' @ 1.1.1.1[4500]
AES_CBC-128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024
established 1551s ago, rekeying in 81597s, reauth in 7935s
net-net:
installed 1551s ago, rekeying in 77539s, expires in 92499s
in c021a60b, 0 bytes, 0 packets
out c913ef93, 0 bytes, 0 packets
local 172.22.224.0/20
remote 192.168.0.0/24
|
之后只需要在路由器上的路由表设置哪个IP段、下一跳即可。当然你也可以用ip route设置。请记得如果是ECS，也请确保设置好IP转发和IP伪装。
手动连接方式测试
因为我们都自动连接了，在启动systemctl start strongswan后就会尝试协商。但是你也可以通过以下方式来测试。
我们的connection叫”gw-gw”，所以，当我们启动连接的时候，应该如下：
1
| swanctl --initiate --ike gw-gw
|
1
| swanctl --initiate --child net-net
|
错误排查
查看最近100条日志
1
| sudo journalctl -u strongswan -n 100
|
本次教程结束。
