Ubuntu 16.04 版設置 L2TP Server

sudo apt-get install strongswan xl2tpd

sudo echo "net.ipv4.ip_forward = 1" | sudo tee -a /etc/sysctl.conf
sudo echo "net.ipv4.conf.all.accept_redirects = 0" | sudo tee -a /etc/sysctl.conf
sudo echo "net.ipv4.conf.all.send_redirects = 0" | sudo tee -a /etc/sysctl.conf
sudo echo "net.ipv4.conf.default.rp_filter = 0" | sudo tee -a /etc/sysctl.conf
sudo echo "net.ipv4.conf.default.accept_source_route = 0" | sudo tee -a /etc/sysctl.conf
sudo echo "net.ipv4.conf.default.send_redirects = 0" | sudo tee -a /etc/sysctl.conf
sudo echo "net.ipv4.icmp_ignore_bogus_error_responses = 1" | sudo tee -a /etc/sysctl.conf
sudo sysctl -p

sudo vi /etc/ppp/options.xl2tpd

require-mschap-v2
ms-dns 8.8.8.8
ms-dns 8.8.4.4
auth
mtu 1200
mru 1000
crtscts
hide-password
modem
name l2tpd
proxyarp
lcp-echo-interval 30
lcp-echo-failure 4
logfile /var/log/xl2tpd.log

sudo vi /etc/ipsec.secrets

%any : PSK "password"

sudo vi /etc/ipsec.conf

config setup
conn L2TP

 #shared secret. Use rsasig for certificates.
 authby=secret

 #the ipsec tunnel should be started and routes created when the ipsec daemon itself starts.
 auto=add

 #Only negotiate a conn. 3 times.
 keyingtries=3

 ikelifetime=8h

 ike=aes256-sha1,aes128-sha1,3des-sha1

 #because we use l2tp as tunnel protocol
 type=transport

 #fill in server IP above
 left=10.3.1.37
 leftprotoport=17/1701

 right=%any
 rightprotoport=17/%any

#Dead Peer Dectection (RFC 3706) keepalives delay
 dpddelay=10

#length of time (in seconds) we will idle without hearing either an R_U_THERE poll from our peer, or an R_U_THERE_ACK reply.
 dpdtimeout=20

#When a DPD enabled peer is declared dead, what action should be taken. clear means the eroute and SA with both be cleared.
dpdaction=clear

sudo vi /etc/xl2tpd/xl2tpd.conf

[global]
ipsec saref = yes
saref refinfo = 30

[lns default]
ip range = 10.3.1.221-10.3.1.225
local ip = 10.3.1.37 ;這裡是VPN Server的內部IP
require chap = yes
refuse pap = yes
require authentication = yes
ppp debug = yes
pppoptfile = /etc/ppp/options.xl2tpd
length bit = yes

sudo vi /etc/ppp/chap-secrets

username l2tpd password *

reset

sudo ipsec update
sudo ipsec reload
sudo ipsec restart
sudo service xl2tpd restart