mirror of
https://github.com/hwdsl2/setup-ipsec-vpn.git
synced 2024-06-20 04:36:29 +02:00
Update docs
This commit is contained in:
hwdsl2
parent
8a3f22ba65
commit
1c28442211
|
|
@ -145,19 +145,19 @@ sh vpnsetup.sh
|
|||
|
||||
*其他语言版本: [English](README.md#important-notes), [简体中文](README-zh.md#重要提示).*
|
||||
|
||||
**Windows 用户** 在首次连接之前需要<a href="docs/clients-zh.md#windows-错误-809" target="_blank">修改注册表</a>，以解决 VPN 服务器和/或客户端与 NAT（比如家用路由器）的兼容问题。
|
||||
**Windows 用户** 在首次连接之前需要 <a href="docs/clients-zh.md#windows-错误-809" target="_blank">修改注册表</a>，以解决 VPN 服务器或客户端与 NAT（比如家用路由器）的兼容问题。
|
||||
|
||||
**Android 用户** 如果遇到连接问题，请尝试 <a href="docs/clients-zh.md#android-mtumss-问题" target="_blank">这些步骤</a>。
|
||||
|
||||
同一个 VPN 账户可以在你的多个设备上使用。但是由于 IPsec/L2TP 的局限性，如果需要同时连接在同一个 NAT （比如家用路由器）后面的多个设备到 VPN 服务器，你必须仅使用 <a href="docs/clients-xauth-zh.md" target="_blank">IPsec/XAuth 模式</a>。
|
||||
同一个 VPN 账户可以在你的多个设备上使用。但是由于 IPsec/L2TP 的局限性，如果需要同时连接在同一个 NAT（比如家用路由器）后面的多个设备到 VPN 服务器，你必须仅使用 <a href="docs/clients-xauth-zh.md" target="_blank">IPsec/XAuth 模式</a>，或者配置 <a href="docs/ikev2-howto-zh.md" target="_blank">IKEv2</a>。
|
||||
|
||||
如果需要添加，修改或者删除 VPN 用户账户，请参见 <a href="docs/manage-users-zh.md" target="_blank">管理 VPN 用户</a>。该文档包含辅助脚本，以方便管理 VPN 用户。
|
||||
如果需要查看或更改 VPN 用户账户，请参见 <a href="docs/manage-users-zh.md" target="_blank">管理 VPN 用户</a>。该文档包含辅助脚本，以方便管理 VPN 用户。
|
||||
|
||||
对于有外部防火墙的服务器（比如 <a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-security-groups.html" target="_blank">EC2</a>/<a href="https://cloud.google.com/vpc/docs/firewalls" target="_blank">GCE</a>），请为 VPN 打开 UDP 端口 500 和 4500。阿里云用户请参见 <a href="https://github.com/hwdsl2/setup-ipsec-vpn/issues/433" target="_blank">#433</a>。
|
||||
|
||||
在 VPN 已连接时，客户端配置为使用 <a href="https://developers.google.com/speed/public-dns/" target="_blank">Google Public DNS</a>。如果偏好其它的域名解析服务，编辑 `/etc/ppp/options.xl2tpd` 和 `/etc/ipsec.conf` 并替换 `8.8.8.8` 和 `8.8.4.4`，然后重启服务器。高级用户可以在运行 VPN 脚本时定义 `VPN_DNS_SRV1` 和 `VPN_DNS_SRV2`（可选）。
|
||||
|
||||
使用内核支持有助于提高 IPsec/L2TP 性能。它在[所有受支持的系统](#系统要求)上可用。Ubuntu 系统需要安装 `linux-modules-extra-$(uname -r)`（或者 `linux-image-extra`）软件包，然后运行 `service xl2tpd restart`。
|
||||
使用内核支持有助于提高 IPsec/L2TP 性能。它在所有 [受支持的系统](#系统要求) 上可用。Ubuntu 系统需要安装 `linux-modules-extra-$(uname -r)`（或者 `linux-image-extra`）软件包并运行 `service xl2tpd restart`。
|
||||
|
||||
如果需要在安装后更改 IPTables 规则，请编辑 `/etc/iptables.rules` 和/或 `/etc/iptables/rules.v4` (Ubuntu/Debian)，或者 `/etc/sysconfig/iptables` (CentOS/RHEL)。然后重启服务器。
|
||||
|
||||
|
|
|
|||
|
|
@ -145,19 +145,19 @@ Enjoy your very own VPN! :sparkles::tada::rocket::sparkles:
|
|||
|
||||
*Read this in other languages: [English](README.md#important-notes), [简体中文](README-zh.md#重要提示).*
|
||||
|
||||
**Windows users**: This <a href="docs/clients.md#windows-error-809" target="_blank">one-time registry change</a> is required if the VPN server and/or client is behind NAT (e.g. home router).
|
||||
**Windows users**: A <a href="docs/clients.md#windows-error-809" target="_blank">one-time registry change</a> is required if the VPN server or client is behind NAT (e.g. home router).
|
||||
|
||||
**Android users**: If you encounter connection issues, try <a href="docs/clients.md#android-mtumss-issues" target="_blank">these steps</a>.
|
||||
|
||||
The same VPN account can be used by your multiple devices. However, due to an IPsec/L2TP limitation, if you wish to connect multiple devices simultaneously from behind the same NAT (e.g. home router), you must use only <a href="docs/clients-xauth.md" target="_blank">IPsec/XAuth mode</a>.
|
||||
The same VPN account can be used by your multiple devices. However, due to an IPsec/L2TP limitation, if you wish to connect multiple devices simultaneously from behind the same NAT (e.g. home router), you must use only <a href="docs/clients-xauth.md" target="_blank">IPsec/XAuth mode</a>, or set up <a href="docs/ikev2-howto.md" target="_blank">IKEv2</a>.
|
||||
|
||||
If you wish to add, edit or remove VPN user accounts, see <a href="docs/manage-users.md" target="_blank">Manage VPN Users</a>. Helper scripts are included for convenience.
|
||||
If you wish to view or update VPN user accounts, see <a href="docs/manage-users.md" target="_blank">Manage VPN Users</a>. Helper scripts are included for convenience.
|
||||
|
||||
For servers with an external firewall (e.g. <a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-security-groups.html" target="_blank">EC2</a>/<a href="https://cloud.google.com/vpc/docs/firewalls" target="_blank">GCE</a>), open UDP ports 500 and 4500 for the VPN. Aliyun users, see <a href="https://github.com/hwdsl2/setup-ipsec-vpn/issues/433" target="_blank">#433</a>.
|
||||
|
||||
Clients are set to use <a href="https://developers.google.com/speed/public-dns/" target="_blank">Google Public DNS</a> when the VPN is active. If another DNS provider is preferred, replace `8.8.8.8` and `8.8.4.4` in both `/etc/ppp/options.xl2tpd` and `/etc/ipsec.conf`, then reboot your server. Advanced users can define `VPN_DNS_SRV1` and optionally `VPN_DNS_SRV2` when running the VPN setup script.
|
||||
|
||||
Using kernel support could improve IPsec/L2TP performance. It is available on [all supported OS versions](#requirements). Ubuntu users should install the `linux-modules-extra-$(uname -r)` (or `linux-image-extra`) package, then run `service xl2tpd restart`.
|
||||
Using kernel support could improve IPsec/L2TP performance. It is available on [all supported OS](#requirements). Ubuntu users should install the `linux-modules-extra-$(uname -r)` (or `linux-image-extra`) package and run `service xl2tpd restart`.
|
||||
|
||||
To modify the IPTables rules after install, edit `/etc/iptables.rules` and/or `/etc/iptables/rules.v4` (Ubuntu/Debian), or `/etc/sysconfig/iptables` (CentOS/RHEL). Then reboot your server.
|
||||
|
||||
|
|
|
|||
|
|
@ -2,11 +2,47 @@
|
|||
|
||||
*其他语言版本: [English](manage-users.md), [简体中文](manage-users-zh.md).*
|
||||
|
||||
在默认情况下，将只创建一个用于 VPN 登录的用户账户。如果你需要添加，更改或者删除用户，请阅读本文档。
|
||||
在默认情况下，将只创建一个用于 VPN 登录的用户账户。如果你需要查看或管理用户，请阅读本文档。
|
||||
|
||||
## 使用辅助脚本
|
||||
- [查看或更改 IPsec PSK](#查看或更改-ipsec-psk)
|
||||
- [查看 VPN 用户](#查看-vpn-用户)
|
||||
- [使用辅助脚本管理 VPN 用户](#使用辅助脚本管理-vpn-用户)
|
||||
- [手动管理 VPN 用户](#手动管理-vpn-用户)
|
||||
|
||||
你可以使用这些脚本来更方便地管理 VPN 用户：[add_vpn_user.sh](https://github.com/hwdsl2/setup-ipsec-vpn/blob/master/extras/add_vpn_user.sh), [del_vpn_user.sh](https://github.com/hwdsl2/setup-ipsec-vpn/blob/master/extras/del_vpn_user.sh) 和 [update_vpn_users.sh](https://github.com/hwdsl2/setup-ipsec-vpn/blob/master/extras/update_vpn_users.sh)。它们将同时更新 IPsec/L2TP 和 IPsec/XAuth ("Cisco IPsec") 模式的用户。如果你需要更改 IPsec PSK，请阅读下一节。
|
||||
## 查看或更改 IPsec PSK
|
||||
|
||||
IPsec PSK（预共享密钥）保存在文件 `/etc/ipsec.secrets`。所有的 VPN 用户将共享同一个 IPsec PSK。该文件的格式如下：
|
||||
|
||||
```bash
|
||||
%any %any : PSK "你的IPsec预共享密钥"
|
||||
```
|
||||
|
||||
如果要更换一个新的 PSK，可以编辑此文件。**不要**在值中使用这些字符：`\ " '`
|
||||
|
||||
完成后必须重启服务：
|
||||
|
||||
```bash
|
||||
service ipsec restart
|
||||
service xl2tpd restart
|
||||
```
|
||||
|
||||
## 查看 VPN 用户
|
||||
|
||||
在默认情况下，VPN 安装脚本将为 `IPsec/L2TP` 和 `IPsec/XAuth ("Cisco IPsec")` 模式创建相同的用户。
|
||||
|
||||
对于 `IPsec/L2TP`，VPN 用户信息保存在文件 `/etc/ppp/chap-secrets`。该文件的格式如下：
|
||||
|
||||
```bash
|
||||
"用户名1" l2tpd "密码1" *
|
||||
"用户名2" l2tpd "密码2" *
|
||||
... ...
|
||||
```
|
||||
|
||||
对于 `IPsec/XAuth ("Cisco IPsec")`，VPN 用户信息保存在文件 `/etc/ipsec.d/passwd`。这个文件中的密码以加盐哈希值的形式保存。更多详情请见 [手动管理 VPN 用户](#手动管理-vpn-用户)。
|
||||
|
||||
## 使用辅助脚本管理 VPN 用户
|
||||
|
||||
你可以使用这些脚本来更方便地管理 VPN 用户：[add_vpn_user.sh](https://github.com/hwdsl2/setup-ipsec-vpn/blob/master/extras/add_vpn_user.sh), [del_vpn_user.sh](https://github.com/hwdsl2/setup-ipsec-vpn/blob/master/extras/del_vpn_user.sh) 和 [update_vpn_users.sh](https://github.com/hwdsl2/setup-ipsec-vpn/blob/master/extras/update_vpn_users.sh)。它们将同时更新 IPsec/L2TP 和 IPsec/XAuth ("Cisco IPsec") 模式的用户。将下面的命令的参数换成你自己的值。
|
||||
|
||||
**注：** VPN 用户信息保存在文件 `/etc/ppp/chap-secrets` 和 `/etc/ipsec.d/passwd`。脚本在修改这些文件之前会先做备份，使用 `.old-日期-时间` 为后缀。
|
||||
|
||||
|
|
@ -22,7 +58,9 @@ wget -O add_vpn_user.sh https://raw.githubusercontent.com/hwdsl2/setup-ipsec-vpn
|
|||
```bash
|
||||
# 所有变量值必须用 '单引号' 括起来
|
||||
# *不要* 在值中使用这些字符： \ " '
|
||||
sudo sh add_vpn_user.sh 'username_to_add' 'password_to_add'
|
||||
sudo sh add_vpn_user.sh '要添加的用户名' '密码'
|
||||
# 或者
|
||||
sudo sh add_vpn_user.sh '要更新的用户名' '新密码'
|
||||
```
|
||||
|
||||
### 删除一个 VPN 用户
|
||||
|
|
@ -37,7 +75,7 @@ wget -O del_vpn_user.sh https://raw.githubusercontent.com/hwdsl2/setup-ipsec-vpn
|
|||
```bash
|
||||
# 所有变量值必须用 '单引号' 括起来
|
||||
# *不要* 在值中使用这些字符： \ " '
|
||||
sudo sh del_vpn_user.sh 'username_to_delete'
|
||||
sudo sh del_vpn_user.sh '要删除的用户名'
|
||||
```
|
||||
|
||||
### 更新所有的 VPN 用户
|
||||
|
|
@ -73,13 +111,7 @@ VPN_PASSWORDS='密码1 密码2 ...' \
|
|||
sh update_vpn_users.sh
|
||||
```
|
||||
|
||||
## 手动管理 VPN 用户和 PSK
|
||||
|
||||
首先，IPsec PSK （预共享密钥）保存在文件 `/etc/ipsec.secrets`。如果要更换一个新的 PSK，可以编辑此文件。完成后必须重启服务（见下面）。所有的 VPN 用户将共享同一个 IPsec PSK。
|
||||
|
||||
```bash
|
||||
%any %any : PSK "你的IPsec预共享密钥"
|
||||
```
|
||||
## 手动管理 VPN 用户
|
||||
|
||||
对于 `IPsec/L2TP`，VPN 用户信息保存在文件 `/etc/ppp/chap-secrets`。该文件的格式如下：
|
||||
|
||||
|
|
@ -89,7 +121,7 @@ sh update_vpn_users.sh
|
|||
... ...
|
||||
```
|
||||
|
||||
你可以添加更多用户，每个用户对应文件中的一行。**不要**在用户名，密码或 PSK 中使用这些字符：`\ " '`
|
||||
你可以添加更多用户，每个用户对应文件中的一行。**不要**在值中使用这些字符：`\ " '`
|
||||
|
||||
对于 `IPsec/XAuth ("Cisco IPsec")`，VPN 用户信息保存在文件 `/etc/ipsec.d/passwd`。该文件的格式如下：
|
||||
|
||||
|
|
@ -106,10 +138,3 @@ sh update_vpn_users.sh
|
|||
# 将你的密码用 '单引号' 括起来
|
||||
openssl passwd -1 '密码1'
|
||||
```
|
||||
|
||||
最后，如果你更改了 PSK，则必须重启服务。对于添加，更改或者删除 VPN 用户，一般不需重启。
|
||||
|
||||
```bash
|
||||
service ipsec restart
|
||||
service xl2tpd restart
|
||||
```
|
||||
|
|
|
|||
|
|
@ -2,17 +2,53 @@
|
|||
|
||||
*Read this in other languages: [English](manage-users.md), [简体中文](manage-users-zh.md).*
|
||||
|
||||
By default, a single user account for VPN login is created. If you wish to add, edit or remove users, read this document.
|
||||
By default, a single user account for VPN login is created. If you wish to view or manage users, read this document.
|
||||
|
||||
## Using helper scripts
|
||||
- [View or update the IPsec PSK](#view-or-update-the-ipsec-psk)
|
||||
- [View VPN users](#view-vpn-users)
|
||||
- [Manage VPN users using helper scripts](#manage-vpn-users-using-helper-scripts)
|
||||
- [Manually manage VPN users](#manually-manage-vpn-users)
|
||||
|
||||
You may use these scripts to more easily manage VPN users: [add_vpn_user.sh](https://github.com/hwdsl2/setup-ipsec-vpn/blob/master/extras/add_vpn_user.sh), [del_vpn_user.sh](https://github.com/hwdsl2/setup-ipsec-vpn/blob/master/extras/del_vpn_user.sh) and [update_vpn_users.sh](https://github.com/hwdsl2/setup-ipsec-vpn/blob/master/extras/update_vpn_users.sh). They will update users for both IPsec/L2TP and IPsec/XAuth ("Cisco IPsec"). For changing the IPsec PSK, read the next section.
|
||||
## View or update the IPsec PSK
|
||||
|
||||
The IPsec PSK (pre-shared key) is stored in `/etc/ipsec.secrets`. All VPN users will share the same IPsec PSK. The format of this file is:
|
||||
|
||||
```bash
|
||||
%any %any : PSK "your_ipsec_pre_shared_key"
|
||||
```
|
||||
|
||||
To change to a new PSK, just edit this file. DO NOT use these special characters within values: `\ " '`
|
||||
|
||||
You must restart services when finished:
|
||||
|
||||
```bash
|
||||
service ipsec restart
|
||||
service xl2tpd restart
|
||||
```
|
||||
|
||||
## View VPN users
|
||||
|
||||
By default, the VPN setup scripts will create the same VPN user for both `IPsec/L2TP` and `IPsec/XAuth ("Cisco IPsec")` modes.
|
||||
|
||||
For `IPsec/L2TP`, VPN users are specified in `/etc/ppp/chap-secrets`. The format of this file is:
|
||||
|
||||
```bash
|
||||
"username1" l2tpd "password1" *
|
||||
"username2" l2tpd "password2" *
|
||||
... ...
|
||||
```
|
||||
|
||||
For `IPsec/XAuth ("Cisco IPsec")`, VPN users are specified in `/etc/ipsec.d/passwd`. Passwords in this file are salted and hashed. See [Manually manage VPN users](#manually-manage-vpn-users) for more details.
|
||||
|
||||
## Manage VPN users using helper scripts
|
||||
|
||||
You may use these scripts to more easily manage VPN users: [add_vpn_user.sh](https://github.com/hwdsl2/setup-ipsec-vpn/blob/master/extras/add_vpn_user.sh), [del_vpn_user.sh](https://github.com/hwdsl2/setup-ipsec-vpn/blob/master/extras/del_vpn_user.sh) and [update_vpn_users.sh](https://github.com/hwdsl2/setup-ipsec-vpn/blob/master/extras/update_vpn_users.sh). They will update users for both IPsec/L2TP and IPsec/XAuth ("Cisco IPsec"). Replace command parameters below with your own values.
|
||||
|
||||
**Note:** VPN users are stored in `/etc/ppp/chap-secrets` and `/etc/ipsec.d/passwd`. The scripts will backup these files before making changes, with `.old-date-time` suffix.
|
||||
|
||||
### Add or edit a VPN user
|
||||
|
||||
Add a new VPN user or update an existing VPN user with a new password.
|
||||
Add a new VPN user, or update an existing VPN user with a new password.
|
||||
|
||||
```bash
|
||||
# Download the script
|
||||
|
|
@ -22,7 +58,9 @@ wget -O add_vpn_user.sh https://raw.githubusercontent.com/hwdsl2/setup-ipsec-vpn
|
|||
```bash
|
||||
# All values MUST be placed inside 'single quotes'
|
||||
# DO NOT use these special characters within values: \ " '
|
||||
sudo sh add_vpn_user.sh 'username_to_add' 'password_to_add'
|
||||
sudo sh add_vpn_user.sh 'username_to_add' 'password'
|
||||
# OR
|
||||
sudo sh add_vpn_user.sh 'username_to_update' 'new_password'
|
||||
```
|
||||
|
||||
### Delete a VPN user
|
||||
|
|
@ -73,13 +111,7 @@ VPN_PASSWORDS='password1 password2 ...' \
|
|||
sh update_vpn_users.sh
|
||||
```
|
||||
|
||||
## Manually manage VPN users and PSK
|
||||
|
||||
First, the IPsec PSK (pre-shared key) is stored in `/etc/ipsec.secrets`. To change to a new PSK, just edit this file. You must restart services when finished (see below). All VPN users will share the same IPsec PSK.
|
||||
|
||||
```bash
|
||||
%any %any : PSK "your_ipsec_pre_shared_key"
|
||||
```
|
||||
## Manually manage VPN users
|
||||
|
||||
For `IPsec/L2TP`, VPN users are specified in `/etc/ppp/chap-secrets`. The format of this file is:
|
||||
|
||||
|
|
@ -106,10 +138,3 @@ Passwords in this file are salted and hashed. This step can be done using e.g. t
|
|||
# Put your password inside 'single quotes'
|
||||
openssl passwd -1 'password1'
|
||||
```
|
||||
|
||||
Finally, you must restart services if changing the PSK. For add/edit/remove VPN users, this is normally not required.
|
||||
|
||||
```bash
|
||||
service ipsec restart
|
||||
service xl2tpd restart
|
||||
```
|
||||
|
|
|
|||
Loading…
Reference in New Issue
Block a user