Vizualizare sursă pentru „Stabilească un VPN L2TP/IPSEC”

<span data-link_translate_fr_title="Mettre en place un VPN L2TP/IPSEC"  data-link_translate_fr_url="Mettre en place un VPN L2TP/IPSEC"></span>[[:fr:Mettre en place un VPN L2TP/IPSEC]][[fr:Mettre en place un VPN L2TP/IPSEC]]
<span data-link_translate_en_title="Establish a L2TP/IPSEC VPN"  data-link_translate_en_url="Establish a L2TP/IPSEC VPN"></span>[[:en:Establish a L2TP/IPSEC VPN]][[en:Establish a L2TP/IPSEC VPN]]
<span data-link_translate_es_title="Establecer una VPN de L2TP/IPSEC"  data-link_translate_es_url="Establecer una VPN de L2TP/IPSEC"></span>[[:es:Establecer una VPN de L2TP/IPSEC]][[es:Establecer una VPN de L2TP/IPSEC]]
<span data-link_translate_pt_title="Estabelecer uma VPN L2TP/IPSEC"  data-link_translate_pt_url="Estabelecer uma VPN L2TP/IPSEC"></span>[[:pt:Estabelecer uma VPN L2TP/IPSEC]][[pt:Estabelecer uma VPN L2TP/IPSEC]]
<span data-link_translate_it_title="Stabilire una connessione VPN L2TP/IPSEC"  data-link_translate_it_url="Stabilire una connessione VPN L2TP/IPSEC"></span>[[:it:Stabilire una connessione VPN L2TP/IPSEC]][[it:Stabilire una connessione VPN L2TP/IPSEC]]
<span data-link_translate_nl_title="Stellen een L2TP/IPSEC VPN"  data-link_translate_nl_url="Stellen een L2TP/IPSEC VPN"></span>[[:nl:Stellen een L2TP/IPSEC VPN]][[nl:Stellen een L2TP/IPSEC VPN]]
<span data-link_translate_de_title="Etablieren Sie ein L2TP/IPSEC-VPN"  data-link_translate_de_url="Etablieren Sie ein L2TP/IPSEC-VPN"></span>[[:de:Etablieren Sie ein L2TP/IPSEC-VPN]][[de:Etablieren Sie ein L2TP/IPSEC-VPN]]
<span data-link_translate_zh_title="建立 L2TP/IPSEC VPN"  data-link_translate_zh_url="建立 L2TP/IPSEC VPN"></span>[[:zh:建立 L2TP/IPSEC VPN]][[zh:建立 L2TP/IPSEC VPN]]
<span data-link_translate_ar_title="إنشاء L2TP/IPSEC VPN"  data-link_translate_ar_url="إنشاء L2TP/IPSEC VPN"></span>[[:ar:إنشاء L2TP/IPSEC VPN]][[ar:إنشاء L2TP/IPSEC VPN]]
<span data-link_translate_ja_title="L2TP と IPSEC VPN を確立します。"  data-link_translate_ja_url="L2TP と IPSEC VPN を確立します。"></span>[[:ja:L2TP と IPSEC VPN を確立します。]][[ja:L2TP と IPSEC VPN を確立します。]]
<span data-link_translate_pl_title="Ustanowić połączenie sieci VPN L2TP/IPSEC"  data-link_translate_pl_url="Ustanowić połączenie sieci VPN L2TP/IPSEC"></span>[[:pl:Ustanowić połączenie sieci VPN L2TP/IPSEC]][[pl:Ustanowić połączenie sieci VPN L2TP/IPSEC]]
<span data-link_translate_ru_title="Установить L2TP/IPSEC VPN"  data-link_translate_ru_url="Установить L2TP/IPSEC VPN"></span>[[:ru:Установить L2TP/IPSEC VPN]][[ru:Установить L2TP/IPSEC VPN]]
<span data-link_translate_ro_title="Stabilească un VPN L2TP/IPSEC"  data-link_translate_ro_url="Stabilească un VPN L2TP/IPSEC"></span>[[:ro:Stabilească un VPN L2TP/IPSEC]][[ro:Stabilească un VPN L2TP/IPSEC]]
<span data-link_translate_he_title="הקמת VPN של L2TP/IPSEC"  data-link_translate_he_url="הקמת VPN של L2TP/IPSEC"></span>[[:he:הקמת VPN של L2TP/IPSEC]][[he:הקמת VPN של L2TP/IPSEC]]
<br />Acest articol este rezultatul unei traduceri automate efectuate de către software-ul. Puteți vizualiza sursa articol [[:fr:Mettre en place un VPN L2TP/IPSEC|aici]].<br /><span data-translate="fr"></span><br />
<span data-link_translate="he"></span><span data-link_translate="ro"></span><span data-link_translate="ru"></span><span data-link_translate="pl"></span><span data-link_translate="ja"></span><span data-link_translate="ar"></span><span data-link_translate="zh"></span><span data-link_translate="de"></span><span data-link_translate="nl"></span><span data-link_translate="it"></span><span data-link_translate="pt"></span><span data-link_translate="es"></span><span data-link_translate="he"></span><span data-link_translate="ro"></span><span data-link_translate="ru"></span><span data-link_translate="pl"></span><span data-link_translate="ja"></span><span data-link_translate="ar"></span><span data-link_translate="zh"></span><span data-link_translate="de"></span><span data-link_translate="nl"></span><span data-link_translate="it"></span><span data-link_translate="pt"></span><span data-link_translate="es"></span><span data-link_translate="en"></span><span data-link_translate="he"></span><span data-link_translate="ro"></span><span data-link_translate="ru"></span><span data-link_translate="pl"></span><span data-link_translate="ja"></span><span data-link_translate="ar"></span><span data-link_translate="zh"></span><span data-link_translate="de"></span><span data-link_translate="nl"></span><span data-link_translate="it"></span><span data-link_translate="pt"></span><span data-link_translate="es"></span><span data-link_translate="en"></span><span data-link_translate="he"></span><span data-link_translate="ro"></span><span data-link_translate="ru"></span><span data-link_translate="pl"></span><span data-link_translate="ja"></span><span data-link_translate="ar"></span><span data-link_translate="zh"></span><span data-link_translate="de"></span><span data-link_translate="nl"></span><span data-link_translate="it"></span><span data-link_translate="pt"></span><span data-link_translate="es"></span><span data-link_translate="en"></span><span data-link_translate="he"></span><span data-link_translate="ro"></span><span data-link_translate="ru"></span><span data-link_translate="pl"></span><span data-link_translate="ja"></span><span data-link_translate="ar"></span><span data-link_translate="zh"></span><span data-link_translate="de"></span><span data-link_translate="nl"></span><span data-link_translate="it"></span><span data-link_translate="pt"></span><span data-link_translate="es"></span><span data-link_translate="en"></span><span data-link_translate="he"></span><span data-link_translate="ro"></span><span data-link_translate="ru"></span><span data-link_translate="pl"></span><span data-link_translate="ja"></span><span data-link_translate="ar"></span><span data-link_translate="zh"></span><span data-link_translate="de"></span><span data-link_translate="nl"></span><span data-link_translate="it"></span><span data-link_translate="pt"></span><span data-link_translate="es"></span><span data-link_translate="en"></span><span data-link_translate="he"></span><span data-link_translate="he"></span><span data-link_translate="he"></span><span data-link_translate="he"></span><span data-link_translate="he"></span><span data-link_translate="he"></span><span data-link_translate="ro"></span><span data-link_translate="ru"></span><span data-link_translate="pl"></span><span data-link_translate="ja"></span><span data-link_translate="ar"></span><span data-link_translate="zh"></span><span data-link_translate="ro"></span><span data-link_translate="pl"></span><span data-link_translate="de"></span><span data-link_translate="nl"></span><span data-link_translate="it"></span><span data-link_translate="pt"></span><span data-link_translate="es"></span><span data-link_translate="en"></span><!-- Début de l'article. Placez votre texte ci-après et n'hésitez pas à personnaliser les chapitres selon votre besoin -->

{{#seo:
|title=Stabilească un VPN L2TP/IPSEC
|title_mode=append
|keywords=these,are,your,keywords
|description=Stabilească un VPN L2TP/IPSEC
|image=Uploaded_file.png
|image_alt=Wiki Logo
}}

==Introducere== <!--T:1-->
UN VPN (Virtual Private Network) est un système permettant de créer un lien direct entre des ordinateurs distants. On utilise notamment ce terme dans le milieu de la dématérialisation fiscale et dans le travail à distance, ainsi que pour l'accès à des structures de type {{Template:Cloud computing}}. L'avantage du L2TP (Strat 2 Tunelling Protocol) réside dans l'utilisation d'une clé pré partagée en plus des identifiants de connexion habituels. A cela s'ajoute IPSEC, une technologie d'encapsulation cryptée dans la trame IP.

==Cerinţe preliminare== <!--T:2-->
Să urmeze acest tutorial trebuie sa aveti :<br/>

* O maşină în conformitate cu o distribuție de Linux (Debian 8Fedora, CentOS, Ubuntu, Raspberry Pi...)   ''Nu funcţionează în Debian 8 din cauza repository de OpenSwan care nu mai există''<br/>
* Stii adresa ip publică, în cazul în care nu ştiţi [http://http://www.mon-ip.com/ aici!]<br/>

==Tutorial== <!--T:3-->
În primul rând, conectaţi-vă în rădăcină (sau prin intermediul unui utilizator care are drepturi de superuser). Utilizaţi chit pentru a conecta la o maşină de la distanţă prin SSH sau pur şi simplu deschideţi un terminal în cazul în care aveţi acces la interfaţa grafică de maşini.

===Pachete de actualizare şi instalare===
În primul rând, actualiza computerul şi a instala Depozitul necesar :<br/>
<syntaxhighlight lang="bash">
apt-get update && apt-get upgrade -y
apt-get install openswan xl2tpd ppp lsof
</syntaxhighlight>

''OpenSwan va pune câteva întrebări, răspunsul y cu valorile implicite.'.
<br/><br/>

===Adăugarea regulile de firewall===
Apoi, vom adăuga o regulă pentru iptables să permită trafic VPN (înlocui %SERVERIP% de ip a dvs {{Template:Serveur}}) :
<syntaxhighlight lang="bash">
iptables -t nat -A POSTROUTING -j SNAT --to-source %SERVERIP% -o eth0
</syntaxhighlight>

<br/>
Apoi executaţi următoarele comenzi pentru a permite dirijarea de pachete IP:
<syntaxhighlight lang="bash">
echo "net.ipv4.ip_forward = 1" |  tee -a /etc/sysctl.conf
echo "net.ipv4.conf.all.accept_redirects = 0" |  tee -a /etc/sysctl.conf
echo "net.ipv4.conf.all.send_redirects = 0" |  tee -a /etc/sysctl.conf
echo "net.ipv4.conf.default.rp_filter = 0" |  tee -a /etc/sysctl.conf
echo "net.ipv4.conf.default.accept_source_route = 0" |  tee -a /etc/sysctl.conf
echo "net.ipv4.conf.default.send_redirects = 0" |  tee -a /etc/sysctl.conf
echo "net.ipv4.icmp_ignore_bogus_error_responses = 1" |  tee -a /etc/sysctl.conf
for vpn in /proc/sys/net/ipv4/conf/*; do echo 0 > $vpn/accept_redirects; echo 0 > $vpn/send_redirects; done
sysctl -p
</syntaxhighlight>

Face persistente pentru a reporni maşina :
<syntaxhighlight lang="bash">
nano /etc/rc.local
</syntaxhighlight>

Apoi, se adaugă la sfârşitul chiar înainte '''ieşire 0''' :
<syntaxhighlight lang="bash">
for vpn in /proc/sys/net/ipv4/conf/*; do echo 0 > $vpn/accept_redirects; echo 0 > $vpn/send_redirects; done
iptables -t nat -A POSTROUTING -j SNAT --to-source %SERVERIP% -o eth+
</syntaxhighlight>

<br/>
===Punerea în aplicare aIPSEC===
<br/>

Creaţi un nou fişier de configurare ipsec :
<syntaxhighlight lang="bash">
mv /etc/ipsec.conf /etc/ipsec.conf.bak && nano /etc/ipsec.conf
</syntaxhighlight>
Apoi lipi acest lucru : ''Nu uita să înlocuiască %SERVERIP% de adresa IP {{Template:Serveur}}''
<syntaxhighlight lang="bash">
version 2 # conforms to second version of ipsec.conf specification

config setup
    dumpdir=/var/run/pluto/
    #in what directory should things started by setup (notably the Pluto daemon) be allowed to dump core?

    nat_traversal=yes
    #whether to accept/offer to support NAT (NAPT, also known as "IP Masqurade") workaround for IPsec

    virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v6:fd00::/8,%v6:fe80::/10
    #contains the networks that are allowed as subnet= for the remote client. In other words, the address ranges that may live behind a NAT router through which a client connects.

    protostack=netkey
    #decide which protocol stack is going to be used.

    force_keepalive=yes
    keep_alive=60
    # Send a keep-alive packet every 60 seconds.

conn L2TP-PSK-noNAT
    authby=secret
    #shared secret. Use rsasig for certificates.

    pfs=no
    #Disable pfs

    auto=add
    #the ipsec tunnel should be started and routes created when the ipsec daemon itself starts.

    keyingtries=3
    #Only negotiate a conn. 3 times.

    ikelifetime=8h
    keylife=1h

    ike=aes256-sha1,aes128-sha1,3des-sha1
    phase2alg=aes256-sha1,aes128-sha1,3des-sha1
    # https://lists.openswan.org/pipermail/users/2014-April/022947.html
    # specifies the phase 1 encryption scheme, the hashing algorithm, and the diffie-hellman group. The modp1024 is for Diffie-Hellman 2. Why 'modp' instead of dh? DH2 is a 1028 bit encryption algorithm that modulo's a prime number, e.g. modp1028. See RFC 5114 for details or the wiki page on diffie hellmann, if interested.

    type=transport
    #because we use l2tp as tunnel protocol

    left=%SERVERIP%
    #fill in server IP above

    leftprotoport=17/1701
    right=%any
    rightprotoport=17/%any

    dpddelay=10
    # Dead Peer Dectection (RFC 3706) keepalives delay
    dpdtimeout=20
    #  length of time (in seconds) we will idle without hearing either an R_U_THERE poll from our peer, or an R_U_THERE_ACK reply.
    dpdaction=clear
    # When a DPD enabled peer is declared dead, what action should be taken. clear means the eroute and SA with both be cleared.
</syntaxhighlight>

On crée ensuite le ''preshared secret'' (cheia partajată pre) :
<syntaxhighlight lang="bash">
nano /etc/ipsec.secrets
</syntaxhighlight>
Apoi, introduceţi această linie :
<syntaxhighlight lang="bash">
%SERVERIP%  %any:   PSK "VotreClePlusOuMoinsSecurisee"
</syntaxhighlight>
Luaţi în calcul înlocuirea %SERVERIP% par l'IP de votre {{Template:Serveur}}. Si vous séchez pour la création de votre clé vous pouvez utilisez la commande suivante :
<syntaxhighlight lang="bash">
openssl rand -hex 30
</syntaxhighlight>

<br/>
Verificăm că totul este bine, deci utilizaţi această comandă :
<syntaxhighlight lang="bash">
ipsec verify
</syntaxhighlight>
Şi trebuie să obţineţi :
<syntaxhighlight lang="bash">
Checking your system to see if IPsec got installed and started correctly:
Version check and ipsec on-path                                 [OK]
Linux Openswan U2.6.38/K3.13.0-24-generic (netkey)
Checking for IPsec support in kernel                            [OK]
 SAref kernel support                                           [N/A]
 NETKEY:  Testing XFRM related proc values                      [OK]
    [OK]
    [OK]
Checking that pluto is running                                  [OK]
 Pluto listening for IKE on udp 500                             [OK]
 Pluto listening for NAT-T on udp 4500                          [OK]
Checking for 'ip' command                                       [OK]
Checking /bin/sh is not /bin/dash                               [WARNING]
Checking for 'iptables' command                                 [OK]
Opportunistic Encryption Support                                [DISABLED]
</syntaxhighlight>

===Configuration de xl2tpd===

Să începem prin editarea unui fişier de configurare nou :
<syntaxhighlight lang="bash">
mv /etc/xl2tpd/xl2tpd.conf /etc/xl2tpd/xl2tpd.conf.bak && nano /etc/xl2tpd/xl2tpd.conf
</syntaxhighlight>

Apoi lipi acest lucru :
<syntaxhighlight lang="bash">
[global]
ipsec saref = yes
saref refinfo = 30

;debug avp = yes
;debug network = yes
;debug state = yes
;debug tunnel = yes

[lns default]
ip range = 172.16.1.30-172.16.1.100
local ip = 172.16.1.1
refuse pap = yes
require authentication = yes
;ppp debug = yes
pppoptfile = /etc/ppp/options.xl2tpd
length bit = yes
</syntaxhighlight>

===PPP de configurare===
Pentru această parte, din nou vom crea un nou fişier de configurare ''(prea nou într-o propoziţie :3)'' :

<syntaxhighlight lang="bash">
mv /etc/ppp/options.xl2tpd /etc/ppp/options.xl2tpd.bak && nano /etc/ppp/options.xl2tpd
</syntaxhighlight>

Apoi introduceţi acest lucru :
<syntaxhighlight lang="bash">
require-mschap-v2
ms-dns 8.8.8.8
ms-dns 8.8.4.4
auth
mtu 1200
mru 1000
crtscts
hide-password
modem
name l2tpd
proxyarp
lcp-echo-interval 30
lcp-echo-failure 4
</syntaxhighlight>

Aici, am folosit DNS publice la Google, gratuit pentru tine de a modifica şi de a folosi cele de alegerea ta ! ;)

===Adăugarea de utilizatori===

ÎN CELE DIN URMĂ ! Acest pas crucial vă va permite să setaţi login şi parolele pentru utilizatori vpn, doar edita acest fişier :
<syntaxhighlight lang="bash">
nano /etc/ppp/chap-secrets
</syntaxhighlight>
mai jos o linie tipic:
<syntaxhighlight lang="bash">
jean          l2tpd   0F92E5FC2414101EA            *
</syntaxhighlight>
<br/>
'''ATENŢIA : Acest fişier este cazul sensibile, dacă aţi pus o majusculă, trebuie să păstraţi-l atunci când tastaţi numele de login sau parola. "''
<br/><br/>

===În cele din urmă pauză : ===
<syntaxhighlight lang="bash">
/etc/init.d/ipsec restart && /etc/init.d/xl2tpd restart
</syntaxhighlight>

<!-- Fin de l'article -->
<br /><br />
Acest articol pare util pentru tine ? <vote />

<!--T:5-->

<!-- Commentaire -->
<comments />

<!-- Placez ci-dessous la ou les catégories auxquelles se rapporte votre article. Ex: [[Category:VPN]] [[Category:Linux]] -->
[[Category:VPN]] [[Category:Linux]]