mirror of
https://github.com/hwdsl2/setup-ipsec-vpn.git
synced 2024-09-22 00:00:42 +02:00
Update docs
This commit is contained in:
hwdsl2
parent
e9b38c8a65
commit
baccd5adbf
|
|
@ -240,7 +240,7 @@ iptables -t nat -A PREROUTING -p udp --dport 123 -j DNAT --to 192.168.43.10
|
|||
|
||||
## VPN 分流
|
||||
|
||||
在启用 [VPN 分流 (split tunneling)](https://wiki.strongswan.org/projects/strongswan/wiki/ForwardingAndSplitTunneling#Split-Tunneling) 时，VPN 客户端将仅通过 VPN 隧道发送特定目标子网的流量。其他流量 **不会** 通过 VPN 隧道。VPN 分流 [有一些局限性](https://wiki.strongswan.org/projects/strongswan/wiki/ForwardingAndSplitTunneling#Split-Tunneling)，而且并非所有的 VPN 客户端都支持。
|
||||
在启用 VPN 分流 (split tunneling) 时，VPN 客户端将仅通过 VPN 隧道发送特定目标子网的流量。其他流量 **不会** 通过 VPN 隧道。VPN 分流有一些局限性，而且并非所有的 VPN 客户端都支持。
|
||||
|
||||
高级用户可以为 [IPsec/XAuth ("Cisco IPsec")](clients-xauth-zh.md) 和/或 [IKEv2](ikev2-howto-zh.md) 模式启用 VPN 分流。这是可选的。IPsec/L2TP 模式 **不支持** 此功能。
|
||||
|
||||
|
|
|
|||
|
|
@ -240,7 +240,7 @@ If you want the rules to persist after reboot, you may add these commands to `/e
|
|||
|
||||
## Split tunneling
|
||||
|
||||
With [split tunneling](https://wiki.strongswan.org/projects/strongswan/wiki/ForwardingAndSplitTunneling#Split-Tunneling), VPN clients will only send traffic for specific destination subnet(s) through the VPN tunnel. Other traffic will NOT go through the VPN tunnel. Split tunneling has [some limitations](https://wiki.strongswan.org/projects/strongswan/wiki/ForwardingAndSplitTunneling#Split-Tunneling), and is not supported by all VPN clients.
|
||||
With split tunneling, VPN clients will only send traffic for specific destination subnet(s) through the VPN tunnel. Other traffic will NOT go through the VPN tunnel. Split tunneling has some limitations, and is not supported by all VPN clients.
|
||||
|
||||
Advanced users can optionally enable split tunneling for the [IPsec/XAuth ("Cisco IPsec")](clients-xauth.md) and/or [IKEv2](ikev2-howto.md) modes. Expand for details. IPsec/L2TP mode does NOT support this feature.
|
||||
|
||||
|
|
|
|||
|
|
@ -357,7 +357,7 @@ echo 1 > /proc/sys/net/ipv4/ip_no_pmtu_disc
|
|||
|
||||
**Docker 用户：** 要修复这个问题，不需要运行以上命令。你可以在[你的 env 文件](https://github.com/hwdsl2/docker-ipsec-vpn-server/blob/master/README-zh.md#如何使用本镜像)中添加 `VPN_ANDROID_MTU_FIX=yes`，然后重新创建 Docker 容器。
|
||||
|
||||
参考链接：[[1]](https://wiki.strongswan.org/projects/strongswan/wiki/ForwardingAndSplitTunneling#MTUMSS-issues) [[2]](https://www.zeitgeist.se/2013/11/26/mtu-woes-in-ipsec-tunnels-how-to-fix/)。
|
||||
参考链接：[[1]](https://www.zeitgeist.se/2013/11/26/mtu-woes-in-ipsec-tunnels-how-to-fix/)。
|
||||
|
||||
### Android 6 和 7
|
||||
|
||||
|
|
|
|||
|
|
@ -356,7 +356,7 @@ echo 1 > /proc/sys/net/ipv4/ip_no_pmtu_disc
|
|||
|
||||
**Docker users:** Instead of running the commands above, you may apply this fix by adding `VPN_ANDROID_MTU_FIX=yes` to [your env file](https://github.com/hwdsl2/docker-ipsec-vpn-server#how-to-use-this-image), then re-create the Docker container.
|
||||
|
||||
References: [[1]](https://wiki.strongswan.org/projects/strongswan/wiki/ForwardingAndSplitTunneling#MTUMSS-issues) [[2]](https://www.zeitgeist.se/2013/11/26/mtu-woes-in-ipsec-tunnels-how-to-fix/).
|
||||
Reference: [[1]](https://www.zeitgeist.se/2013/11/26/mtu-woes-in-ipsec-tunnels-how-to-fix/).
|
||||
|
||||
### Android 6 and 7
|
||||
|
||||
|
|
|
|||
|
|
@ -77,7 +77,7 @@ Libreswan 支持通过使用 RSA 签名算法的 X.509 Machine Certificates 来
|
|||
|
||||
**注：** 如果客户端配置文件没有密码，请按回车键继续，或者在手动导入 `.p12` 文件时保持密码字段空白。
|
||||
|
||||
或者，你也可以 [手动导入 .p12 文件](https://wiki.strongswan.org/projects/strongswan/wiki/Win7Certs)。在导入证书后，确保将客户端证书放在 "个人 -> 证书" 目录中，并且将 CA 证书放在 "受信任的根证书颁发机构 -> 证书" 目录中。
|
||||
或者，你也可以 [手动导入 .p12 文件](https://wiki.strongswan.org/projects/strongswan/wiki/Win7Certs/9)。在导入证书后，确保将客户端证书放在 "个人 -> 证书" 目录中，并且将 CA 证书放在 "受信任的根证书颁发机构 -> 证书" 目录中。
|
||||
|
||||
1. 在 Windows 计算机上添加一个新的 IKEv2 VPN 连接。
|
||||
|
||||
|
|
@ -95,13 +95,13 @@ Libreswan 支持通过使用 RSA 签名算法的 X.509 Machine Certificates 来
|
|||
-DHGroup Group14 -PassThru -Force^"
|
||||
```
|
||||
|
||||
**Windows 7** 不支持这些命令，你可以 [手动创建 VPN 连接](https://wiki.strongswan.org/projects/strongswan/wiki/Win7Config)。
|
||||
**Windows 7** 不支持这些命令，你可以 [手动创建 VPN 连接](https://wiki.strongswan.org/projects/strongswan/wiki/Win7Config/8)。
|
||||
|
||||
**注：** 你输入的服务器地址必须与 IKEv2 辅助脚本输出中的服务器地址 **完全一致**。例如，如果你在配置 IKEv2 时指定了服务器的域名，则必须在 **Internet地址** 字段中输入该域名。
|
||||
|
||||
1. **此步骤为必须，如果你手动创建了 VPN 连接。**
|
||||
|
||||
为 IKEv2 启用更强的加密算法，通过修改一次注册表来实现。请下载并导入下面的 `.reg` 文件，或者打开提升权限命令提示符并运行以下命令。更多信息请看 [这里](https://wiki.strongswan.org/projects/strongswan/wiki/WindowsClients#AES-256-CBC-and-MODP2048)。
|
||||
为 IKEv2 启用更强的加密算法，通过修改一次注册表来实现。请下载并导入下面的 `.reg` 文件，或者打开提升权限命令提示符并运行以下命令。更多信息请看 [这里](https://docs.strongswan.org/docs/5.9/interop/windowsClients.html)。
|
||||
|
||||
- 适用于 Windows 7, 8, 10 和 11 ([下载 .reg 文件](https://github.com/hwdsl2/vpn-extras/releases/download/v1.0.0/Enable_Stronger_Ciphers_for_IKEv2_on_Windows.reg))
|
||||
|
||||
|
|
@ -684,7 +684,7 @@ sudo ikev2.sh --revokeclient [client name]
|
|||
CRL Extensions:
|
||||
```
|
||||
|
||||
**注：** 如果需要从 CRL 删除一个证书，可以将上面的 `addcert 3446275956 20200606220100Z` 替换为 `rmcert 3446275956`。关于 `crlutil` 的其它用法参见 [这里](https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/tools/NSS_Tools_crlutil)。
|
||||
**注：** 如果需要从 CRL 删除一个证书，可以将上面的 `addcert 3446275956 20200606220100Z` 替换为 `rmcert 3446275956`。关于 `crlutil` 的其它用法参见 [这里](https://firefox-source-docs.mozilla.org/security/nss/legacy/tools/nss_tools_crlutil/index.html)。
|
||||
|
||||
1. 最后，让 Libreswan 重新读取已更新的 CRL。
|
||||
|
||||
|
|
@ -886,7 +886,7 @@ To customize IKEv2 or client options, run this script without arguments.
|
|||
EOF
|
||||
```
|
||||
|
||||
**注：** [MOBIKE](https://wiki.strongswan.org/projects/strongswan/wiki/MobIke) IKEv2 协议扩展允许 VPN 客户端更改网络连接点，例如在移动数据和 Wi-Fi 之间切换，并使 VPN 保持连接。如果你的服务器（或者 Docker 主机）的操作系统 **不是** Ubuntu Linux，并且你想要启用 MOBIKE 支持，可以将上面命令中的 `mobike=no` 换成 `mobike=yes`。**不要** 在 Ubuntu 系统或者 Raspberry Pi 上启用该选项。
|
||||
**注：** MOBIKE IKEv2 协议扩展允许 VPN 客户端更改网络连接点，例如在移动数据和 Wi-Fi 之间切换，并使 VPN 保持连接。如果你的服务器（或者 Docker 主机）的操作系统 **不是** Ubuntu Linux，并且你想要启用 MOBIKE 支持，可以将上面命令中的 `mobike=no` 换成 `mobike=yes`。**不要** 在 Ubuntu 系统或者 Raspberry Pi 上启用该选项。
|
||||
|
||||
如果是 Libreswan 3.19-3.22：
|
||||
|
||||
|
|
@ -1006,7 +1006,7 @@ To customize IKEv2 or client options, run this script without arguments.
|
|||
vpnclient u,u,u
|
||||
```
|
||||
|
||||
**注：** 如需显示证书内容，可使用 `certutil -L -d sql:/etc/ipsec.d -n "Nickname"`。要吊销客户端证书，请转到[这一节](#吊销客户端证书)。关于 `certutil` 的其它用法参见 [这里](https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/tools/NSS_Tools_certutil)。
|
||||
**注：** 如需显示证书内容，可使用 `certutil -L -d sql:/etc/ipsec.d -n "Nickname"`。要吊销客户端证书，请转到[这一节](#吊销客户端证书)。关于 `certutil` 的其它用法参见 [这里](https://firefox-source-docs.mozilla.org/security/nss/legacy/tools/nss_tools_certutil/index.html)。
|
||||
|
||||
1. **（重要）重启 IPsec 服务**：
|
||||
|
||||
|
|
@ -1086,10 +1086,10 @@ sudo ikev2.sh --removeikev2
|
|||
* https://libreswan.org/wiki/VPN_server_for_remote_clients_using_IKEv2
|
||||
* https://libreswan.org/wiki/HOWTO:_Using_NSS_with_libreswan
|
||||
* https://libreswan.org/man/ipsec.conf.5.html
|
||||
* https://wiki.strongswan.org/projects/strongswan/wiki/WindowsClients
|
||||
* https://wiki.strongswan.org/projects/strongswan/wiki/AndroidVpnClient
|
||||
* https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/tools/NSS_Tools_certutil
|
||||
* https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/tools/NSS_Tools_crlutil
|
||||
* https://docs.strongswan.org/docs/5.9/interop/windowsClients.html
|
||||
* https://docs.strongswan.org/docs/5.9/os/androidVpnClient.html
|
||||
* https://firefox-source-docs.mozilla.org/security/nss/legacy/tools/nss_tools_certutil/index.html
|
||||
* https://firefox-source-docs.mozilla.org/security/nss/legacy/tools/nss_tools_crlutil/index.html
|
||||
|
||||
## 授权协议
|
||||
|
||||
|
|
|
|||
|
|
@ -77,7 +77,7 @@ Alternatively, **Windows 7, 8, 10 and 11** users can manually import IKEv2 confi
|
|||
|
||||
**Note:** If there is no password for client config files, press Enter to continue, or if manually importing the `.p12` file, leave the password field blank.
|
||||
|
||||
Alternatively, you can [manually import the .p12 file](https://wiki.strongswan.org/projects/strongswan/wiki/Win7Certs). Make sure that the client cert is placed in "Personal -> Certificates", and the CA cert is placed in "Trusted Root Certification Authorities -> Certificates".
|
||||
Alternatively, you can [manually import the .p12 file](https://wiki.strongswan.org/projects/strongswan/wiki/Win7Certs/9). Make sure that the client cert is placed in "Personal -> Certificates", and the CA cert is placed in "Trusted Root Certification Authorities -> Certificates".
|
||||
|
||||
1. On the Windows computer, add a new IKEv2 VPN connection.
|
||||
|
||||
|
|
@ -95,13 +95,13 @@ Alternatively, **Windows 7, 8, 10 and 11** users can manually import IKEv2 confi
|
|||
-DHGroup Group14 -PassThru -Force^"
|
||||
```
|
||||
|
||||
**Windows 7** does not support these commands, you can [manually create the VPN connection](https://wiki.strongswan.org/projects/strongswan/wiki/Win7Config).
|
||||
**Windows 7** does not support these commands, you can [manually create the VPN connection](https://wiki.strongswan.org/projects/strongswan/wiki/Win7Config/8).
|
||||
|
||||
**Note:** The server address you specify must **exactly match** the server address in the output of the IKEv2 helper script. For example, if you specified the server's DNS name during IKEv2 setup, you must enter the DNS name in the **Internet address** field.
|
||||
|
||||
1. **This step is required if you manually created the VPN connection.**
|
||||
|
||||
Enable stronger ciphers for IKEv2 with a one-time registry change. Download and import the `.reg` file below, or run the following from an elevated command prompt. Read more [here](https://wiki.strongswan.org/projects/strongswan/wiki/WindowsClients#AES-256-CBC-and-MODP2048).
|
||||
Enable stronger ciphers for IKEv2 with a one-time registry change. Download and import the `.reg` file below, or run the following from an elevated command prompt. Read more [here](https://docs.strongswan.org/docs/5.9/interop/windowsClients.html).
|
||||
|
||||
- For Windows 7, 8, 10 and 11 ([download .reg file](https://github.com/hwdsl2/vpn-extras/releases/download/v1.0.0/Enable_Stronger_Ciphers_for_IKEv2_on_Windows.reg))
|
||||
|
||||
|
|
@ -686,7 +686,7 @@ Alternatively, you can manually revoke a client certificate. This can be done us
|
|||
CRL Extensions:
|
||||
```
|
||||
|
||||
**Note:** If you want to remove a certificate from the CRL, replace `addcert 3446275956 20200606220100Z` above with `rmcert 3446275956`. For other `crlutil` usage, read [here](https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/tools/NSS_Tools_crlutil).
|
||||
**Note:** If you want to remove a certificate from the CRL, replace `addcert 3446275956 20200606220100Z` above with `rmcert 3446275956`. For other `crlutil` usage, read [here](https://firefox-source-docs.mozilla.org/security/nss/legacy/tools/nss_tools_crlutil/index.html).
|
||||
|
||||
1. Finally, let Libreswan re-read the updated CRL.
|
||||
|
||||
|
|
@ -888,7 +888,7 @@ View example steps for manually configuring IKEv2 with Libreswan.
|
|||
EOF
|
||||
```
|
||||
|
||||
**Note:** The [MOBIKE](https://wiki.strongswan.org/projects/strongswan/wiki/MobIke) IKEv2 extension allows VPN clients to change network attachment points, e.g. switch between mobile data and Wi-Fi and keep the IPsec tunnel up on the new IP. If your server (or Docker host) is **NOT** running Ubuntu Linux, and you wish to enable MOBIKE support, replace `mobike=no` with `mobike=yes` in the command above. **DO NOT** enable this option on Ubuntu systems or Raspberry Pis.
|
||||
**Note:** The MOBIKE IKEv2 extension allows VPN clients to change network attachment points, e.g. switch between mobile data and Wi-Fi and keep the IPsec tunnel up on the new IP. If your server (or Docker host) is **NOT** running Ubuntu Linux, and you wish to enable MOBIKE support, replace `mobike=no` with `mobike=yes` in the command above. **DO NOT** enable this option on Ubuntu systems or Raspberry Pis.
|
||||
|
||||
For Libreswan 3.19-3.22:
|
||||
|
||||
|
|
@ -1008,7 +1008,7 @@ View example steps for manually configuring IKEv2 with Libreswan.
|
|||
vpnclient u,u,u
|
||||
```
|
||||
|
||||
**Note:** To display a certificate, use `certutil -L -d sql:/etc/ipsec.d -n "Nickname"`. To revoke a client certificate, follow [these steps](#revoke-a-client-certificate). For other `certutil` usage, read [here](https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/tools/NSS_Tools_certutil).
|
||||
**Note:** To display a certificate, use `certutil -L -d sql:/etc/ipsec.d -n "Nickname"`. To revoke a client certificate, follow [these steps](#revoke-a-client-certificate). For other `certutil` usage, read [here](https://firefox-source-docs.mozilla.org/security/nss/legacy/tools/nss_tools_certutil/index.html).
|
||||
|
||||
1. **(Important) Restart the IPsec service**:
|
||||
|
||||
|
|
@ -1088,10 +1088,10 @@ To manually remove IKEv2 from the VPN server, but keep the [IPsec/L2TP](clients.
|
|||
* https://libreswan.org/wiki/VPN_server_for_remote_clients_using_IKEv2
|
||||
* https://libreswan.org/wiki/HOWTO:_Using_NSS_with_libreswan
|
||||
* https://libreswan.org/man/ipsec.conf.5.html
|
||||
* https://wiki.strongswan.org/projects/strongswan/wiki/WindowsClients
|
||||
* https://wiki.strongswan.org/projects/strongswan/wiki/AndroidVpnClient
|
||||
* https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/tools/NSS_Tools_certutil
|
||||
* https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/tools/NSS_Tools_crlutil
|
||||
* https://docs.strongswan.org/docs/5.9/interop/windowsClients.html
|
||||
* https://docs.strongswan.org/docs/5.9/os/androidVpnClient.html
|
||||
* https://firefox-source-docs.mozilla.org/security/nss/legacy/tools/nss_tools_certutil/index.html
|
||||
* https://firefox-source-docs.mozilla.org/security/nss/legacy/tools/nss_tools_crlutil/index.html
|
||||
|
||||
## License
|
||||
|
||||
|
|
|
|||
Loading…
Reference in New Issue
Block a user