mirror of
https://github.com/hwdsl2/setup-ipsec-vpn.git
synced 2024-06-03 20:45:47 +02:00
Update docs
This commit is contained in:
hwdsl2
parent
7573090022
commit
b43e9759b7
|
|
@ -262,8 +262,12 @@ Libreswan 支持通过使用 RSA 签名算法的 X.509 Machine Certificates 来
|
|||
|
||||
### Android
|
||||
|
||||
#### 使用 strongSwan VPN 客户端
|
||||
|
||||
[[支持者] **屏幕录影：** 使用 Android strongSwan VPN 客户端连接](https://ko-fi.com/post/Support-this-project-and-get-access-to-supporter-o-X8X5FVFZC)
|
||||
|
||||
Android 用户可以使用 strongSwan VPN 客户端连接（推荐）。
|
||||
|
||||
1. 将生成的 `.sswan` 文件安全地传送到你的 Android 设备。
|
||||
1. 从 [**Google Play**](https://play.google.com/store/apps/details?id=org.strongswan.android)，[**F-Droid**](https://f-droid.org/en/packages/org.strongswan.android/) 或 [**strongSwan 下载网站**](https://download.strongswan.org/Android/)下载并安装 strongSwan VPN 客户端。
|
||||
1. 启动 strongSwan VPN 客户端。
|
||||
|
|
@ -275,33 +279,7 @@ Libreswan 支持通过使用 RSA 签名算法的 X.509 Machine Certificates 来
|
|||
1. 单击 **导入**。
|
||||
1. 单击新的 VPN 配置文件以开始连接。
|
||||
|
||||
<details open>
|
||||
<summary>
|
||||
或者，Android 11+ 用户也可以使用系统自带的 IKEv2 客户端连接。
|
||||
</summary>
|
||||
|
||||
[[支持者] **屏幕录影：** 使用 Android 11+ 系统自带的 VPN 客户端连接](https://ko-fi.com/post/Support-this-project-and-get-access-to-supporter-o-X8X5FVFZC)
|
||||
|
||||
1. 将生成的 `.p12` 文件安全地传送到你的 Android 设备。
|
||||
1. 启动 **设置** App。
|
||||
1. 进入 安全 -> 高级 -> 加密与凭据。
|
||||
1. 单击 **安装证书**。
|
||||
1. 单击 **VPN 和应用用户证书**。
|
||||
1. 选择你从服务器传送过来的 `.p12` 文件。
|
||||
**注：** 要查找 `.p12` 文件，单击左上角的抽拉式菜单，然后浏览到你保存文件的目录。
|
||||
1. 为证书输入名称，然后单击 **确定**。
|
||||
1. 进入 设置 -> 网络和互联网 -> VPN，然后单击 "+" 按钮。
|
||||
1. 为 VPN 配置文件输入名称。
|
||||
1. 在 **类型** 下拉菜单选择 **IKEv2/IPSec RSA**。
|
||||
1. 在 **服务器地址** 字段中输入 `你的 VPN 服务器 IP` （或者域名）。
|
||||
**注：** 它必须与 IKEv2 辅助脚本输出中的服务器地址 **完全一致**。
|
||||
1. 在 **IPSec 标识符** 字段中输入任意内容（例如 `empty`）。
|
||||
**注：** 该字段不应该为必填。它是 Android 的一个 bug。
|
||||
1. 在 **IPSec 用户证书** 下拉菜单选择你导入的证书。
|
||||
1. 在 **IPSec CA 证书** 下拉菜单选择你导入的证书。
|
||||
1. 在 **IPSec 服务器证书** 下拉菜单选择 **(来自服务器)**。
|
||||
1. 单击 **保存**。然后单击新的 VPN 连接并单击 **连接**。
|
||||
</details>
|
||||
（可选功能）你可以选择启用 Android 上的 "始终开启的 VPN" 功能。启动 **设置** App，进入 网络和互联网 -> 高级 -> VPN，单击 "strongSwan VPN 客户端" 右边的设置图标，然后启用 **始终开启的 VPN** 以及 **屏蔽未使用 VPN 的所有连接** 选项。
|
||||
|
||||
<details>
|
||||
<summary>
|
||||
|
|
@ -310,9 +288,6 @@ Libreswan 支持通过使用 RSA 签名算法的 X.509 Machine Certificates 来
|
|||
|
||||
如果你的设备运行 Android 6.0 (Marshmallow) 或更早版本，要使用 strongSwan VPN 客户端连接，你必须更改 VPN 服务器上的以下设置：编辑服务器上的 `/etc/ipsec.d/ikev2.conf`。在 `conn ikev2-cp` 小节的末尾添加 `authby=rsa-sha1`，开头必须空两格。保存文件并运行 `service ipsec restart`。
|
||||
</details>
|
||||
|
||||
（可选功能）你可以选择启用 Android 上的 "始终开启的 VPN" 功能。启动 **设置** App，进入 网络和互联网 -> 高级 -> VPN，单击 "strongSwan VPN 客户端" 右边的设置图标，然后启用 **始终开启的 VPN** 以及 **屏蔽未使用 VPN 的所有连接** 选项。
|
||||
|
||||
<details>
|
||||
<summary>
|
||||
如果你手动配置 IKEv2 而不是使用辅助脚本，点这里查看步骤。
|
||||
|
|
@ -355,6 +330,36 @@ Libreswan 支持通过使用 RSA 签名算法的 X.509 Machine Certificates 来
|
|||
|
||||
如果在连接过程中遇到错误，请参见 [故障排除](#ikev2-故障排除)。
|
||||
|
||||
#### 使用系统自带的 IKEv2 客户端
|
||||
|
||||
[[支持者] **屏幕录影：** 使用 Android 11+ 系统自带的 VPN 客户端连接](https://ko-fi.com/post/Support-this-project-and-get-access-to-supporter-o-X8X5FVFZC)
|
||||
|
||||
Android 11+ 用户也可以使用系统自带的 IKEv2 客户端连接。
|
||||
|
||||
1. 将生成的 `.p12` 文件安全地传送到你的 Android 设备。
|
||||
1. 启动 **设置** App。
|
||||
1. 进入 安全 -> 高级 -> 加密与凭据。
|
||||
1. 单击 **安装证书**。
|
||||
1. 单击 **VPN 和应用用户证书**。
|
||||
1. 选择你从服务器传送过来的 `.p12` 文件。
|
||||
**注：** 要查找 `.p12` 文件，单击左上角的抽拉式菜单，然后浏览到你保存文件的目录。
|
||||
1. 为证书输入名称，然后单击 **确定**。
|
||||
1. 进入 设置 -> 网络和互联网 -> VPN，然后单击 "+" 按钮。
|
||||
1. 为 VPN 配置文件输入名称。
|
||||
1. 在 **类型** 下拉菜单选择 **IKEv2/IPSec RSA**。
|
||||
1. 在 **服务器地址** 字段中输入 `你的 VPN 服务器 IP` （或者域名）。
|
||||
**注：** 它必须与 IKEv2 辅助脚本输出中的服务器地址 **完全一致**。
|
||||
1. 在 **IPSec 标识符** 字段中输入任意内容（例如 `empty`）。
|
||||
**注：** 该字段不应该为必填。它是 Android 的一个 bug。
|
||||
1. 在 **IPSec 用户证书** 下拉菜单选择你导入的证书。
|
||||
1. 在 **IPSec CA 证书** 下拉菜单选择你导入的证书。
|
||||
1. 在 **IPSec 服务器证书** 下拉菜单选择 **(来自服务器)**。
|
||||
1. 单击 **保存**。然后单击新的 VPN 连接并单击 **连接**。
|
||||
|
||||
连接成功后，你可以到 [这里](https://www.ipchicken.com) 检测你的 IP 地址，应该显示为`你的 VPN 服务器 IP`。
|
||||
|
||||
如果在连接过程中遇到错误，请参见 [故障排除](#ikev2-故障排除)。
|
||||
|
||||
### Chrome OS
|
||||
|
||||
首先，在 VPN 服务器上导出 CA 证书到 `ca.cer`：
|
||||
|
|
|
|||
|
|
@ -262,8 +262,12 @@ To remove the IKEv2 VPN connection, open Settings -> General -> VPN & Device Man
|
|||
|
||||
### Android
|
||||
|
||||
#### Using strongSwan VPN client
|
||||
|
||||
[[Supporters] **Screencast:** Connect using Android strongSwan VPN Client](https://ko-fi.com/post/Support-this-project-and-get-access-to-supporter-o-O5O7FVF8J)
|
||||
|
||||
Android users can connect using strongSwan VPN client (recommended).
|
||||
|
||||
1. Securely transfer the generated `.sswan` file to your Android device.
|
||||
1. Install strongSwan VPN Client from [**Google Play**](https://play.google.com/store/apps/details?id=org.strongswan.android), [**F-Droid**](https://f-droid.org/en/packages/org.strongswan.android/) or [**strongSwan download server**](https://download.strongswan.org/Android/).
|
||||
1. Launch the strongSwan VPN client.
|
||||
|
|
@ -275,33 +279,7 @@ To remove the IKEv2 VPN connection, open Settings -> General -> VPN & Device Man
|
|||
1. Tap **IMPORT**.
|
||||
1. Tap the new VPN profile to connect.
|
||||
|
||||
<details open>
|
||||
<summary>
|
||||
Alternatively, Android 11+ users can also connect using the native IKEv2 client.
|
||||
</summary>
|
||||
|
||||
[[Supporters] **Screencast:** Connect using Native VPN Client on Android 11+](https://ko-fi.com/post/Support-this-project-and-get-access-to-supporter-o-O5O7FVF8J)
|
||||
|
||||
1. Securely transfer the generated `.p12` file to your Android device.
|
||||
1. Launch the **Settings** application.
|
||||
1. Go to Security -> Advanced -> Encryption & credentials.
|
||||
1. Tap **Install a certificate**.
|
||||
1. Tap **VPN & app user certificate**.
|
||||
1. Choose the `.p12` file you transferred from the VPN server.
|
||||
**Note:** To find the `.p12` file, tap the three-line menu button, then browse to the location you saved the file.
|
||||
1. Enter a name for the certificate, then tap **OK**.
|
||||
1. Go to Settings -> Network & internet -> VPN, then tap the "+" button.
|
||||
1. Enter a name for the VPN profile.
|
||||
1. Select **IKEv2/IPSec RSA** from the **Type** drop-down menu.
|
||||
1. Enter `Your VPN Server IP` (or DNS name) in the **Server address** field.
|
||||
**Note:** This must **exactly match** the server address in the output of the IKEv2 helper script.
|
||||
1. Enter anything (e.g. `empty`) in the **IPSec identifier** field.
|
||||
**Note:** This field should not be required. It is a bug in Android.
|
||||
1. Select the certificate you imported from the **IPSec user certificate** drop-down menu.
|
||||
1. Select the certificate you imported from the **IPSec CA certificate** drop-down menu.
|
||||
1. Select **(receive from server)** from the **IPSec server certificate** drop-down menu.
|
||||
1. Tap **Save**. Then tap the new VPN connection and tap **Connect**.
|
||||
</details>
|
||||
(Optional feature) You can choose to enable the "Always-on VPN" feature on Android. Launch the **Settings** app, go to Network & internet -> Advanced -> VPN, click the gear icon on the right of "strongSwan VPN Client", then enable the **Always-on VPN** and **Block connections without VPN** options.
|
||||
|
||||
<details>
|
||||
<summary>
|
||||
|
|
@ -310,9 +288,6 @@ If your device runs Android 6.0 or older, click here for additional instructions
|
|||
|
||||
If your device runs Android 6.0 (Marshmallow) or older, in order to connect using the strongSwan VPN client, you must make the following change on the VPN server: Edit `/etc/ipsec.d/ikev2.conf` on the server. Append `authby=rsa-sha1` to the end of the `conn ikev2-cp` section, indented by two spaces. Save the file and run `service ipsec restart`.
|
||||
</details>
|
||||
|
||||
(Optional feature) You can choose to enable the "Always-on VPN" feature on Android. Launch the **Settings** app, go to Network & internet -> Advanced -> VPN, click the gear icon on the right of "strongSwan VPN Client", then enable the **Always-on VPN** and **Block connections without VPN** options.
|
||||
|
||||
<details>
|
||||
<summary>
|
||||
If you manually set up IKEv2 without using the helper script, click here for instructions.
|
||||
|
|
@ -355,6 +330,36 @@ Once connected, you can verify that your traffic is being routed properly by [lo
|
|||
|
||||
If you get an error when trying to connect, see [Troubleshooting](#ikev2-troubleshooting).
|
||||
|
||||
#### Using native IKEv2 client
|
||||
|
||||
[[Supporters] **Screencast:** Connect using Native VPN Client on Android 11+](https://ko-fi.com/post/Support-this-project-and-get-access-to-supporter-o-O5O7FVF8J)
|
||||
|
||||
Android 11+ users can also connect using the native IKEv2 client.
|
||||
|
||||
1. Securely transfer the generated `.p12` file to your Android device.
|
||||
1. Launch the **Settings** application.
|
||||
1. Go to Security -> Advanced -> Encryption & credentials.
|
||||
1. Tap **Install a certificate**.
|
||||
1. Tap **VPN & app user certificate**.
|
||||
1. Choose the `.p12` file you transferred from the VPN server.
|
||||
**Note:** To find the `.p12` file, tap the three-line menu button, then browse to the location you saved the file.
|
||||
1. Enter a name for the certificate, then tap **OK**.
|
||||
1. Go to Settings -> Network & internet -> VPN, then tap the "+" button.
|
||||
1. Enter a name for the VPN profile.
|
||||
1. Select **IKEv2/IPSec RSA** from the **Type** drop-down menu.
|
||||
1. Enter `Your VPN Server IP` (or DNS name) in the **Server address** field.
|
||||
**Note:** This must **exactly match** the server address in the output of the IKEv2 helper script.
|
||||
1. Enter anything (e.g. `empty`) in the **IPSec identifier** field.
|
||||
**Note:** This field should not be required. It is a bug in Android.
|
||||
1. Select the certificate you imported from the **IPSec user certificate** drop-down menu.
|
||||
1. Select the certificate you imported from the **IPSec CA certificate** drop-down menu.
|
||||
1. Select **(receive from server)** from the **IPSec server certificate** drop-down menu.
|
||||
1. Tap **Save**. Then tap the new VPN connection and tap **Connect**.
|
||||
|
||||
Once connected, you can verify that your traffic is being routed properly by [looking up your IP address on Google](https://www.google.com/search?q=my+ip). It should say "Your public IP address is `Your VPN Server IP`".
|
||||
|
||||
If you get an error when trying to connect, see [Troubleshooting](#ikev2-troubleshooting).
|
||||
|
||||
### Chrome OS
|
||||
|
||||
First, on your VPN server, export the CA certificate as `ca.cer`:
|
||||
|
|
|
|||
Loading…
Reference in New Issue
Block a user