mirror of
https://github.com/hwdsl2/setup-ipsec-vpn.git
synced 2024-06-16 02:44:33 +02:00
Update docs
This commit is contained in:
hwdsl2
parent
be02488fcd
commit
bf320ccd45
|
|
@ -223,9 +223,9 @@ wget https://git.io/vpnupgrade -qO vpnup.sh && sudo sh vpnup.sh
|
|||
|
||||
请参见 [管理 VPN 用户](docs/manage-users-zh.md)。
|
||||
|
||||
- [查看或更改 IPsec PSK](docs/manage-users-zh.md#查看或更改-ipsec-psk)
|
||||
- [查看 VPN 用户](docs/manage-users-zh.md#查看-vpn-用户)
|
||||
- [使用辅助脚本管理 VPN 用户](docs/manage-users-zh.md#使用辅助脚本管理-vpn-用户)
|
||||
- [查看 VPN 用户](docs/manage-users-zh.md#查看-vpn-用户)
|
||||
- [查看或更改 IPsec PSK](docs/manage-users-zh.md#查看或更改-ipsec-psk)
|
||||
- [手动管理 VPN 用户](docs/manage-users-zh.md#手动管理-vpn-用户)
|
||||
|
||||
## 高级用法
|
||||
|
|
@ -240,7 +240,7 @@ wget https://git.io/vpnupgrade -qO vpnup.sh && sudo sh vpnup.sh
|
|||
- [VPN 分流](docs/advanced-usage-zh.md#vpn-分流)
|
||||
- [访问 VPN 服务器的网段](docs/advanced-usage-zh.md#访问-vpn-服务器的网段)
|
||||
- [更改 IPTables 规则](docs/advanced-usage-zh.md#更改-iptables-规则)
|
||||
- [部署 Google BBR 拥塞控制算法](docs/advanced-usage-zh.md#部署-google-bbr-拥塞控制算法)
|
||||
- [部署 Google BBR 拥塞控制](docs/advanced-usage-zh.md#部署-google-bbr-拥塞控制)
|
||||
|
||||
## 卸载说明
|
||||
|
||||
|
|
|
|||
12
README.md
12
README.md
|
|
@ -221,16 +221,16 @@ The latest supported Libreswan version is `4.6`. Check installed version: `ipsec
|
|||
|
||||
## Manage VPN users
|
||||
|
||||
See [Manage VPN users](docs/manage-users.md). 请参见 [管理 VPN 用户](docs/manage-users-zh.md)。
|
||||
See [Manage VPN users](docs/manage-users.md).
|
||||
|
||||
- [View or update the IPsec PSK](docs/manage-users.md#view-or-update-the-ipsec-psk)
|
||||
- [View VPN users](docs/manage-users.md#view-vpn-users)
|
||||
- [Manage VPN users using helper scripts](docs/manage-users.md#manage-vpn-users-using-helper-scripts)
|
||||
- [View VPN users](docs/manage-users.md#view-vpn-users)
|
||||
- [View or update the IPsec PSK](docs/manage-users.md#view-or-update-the-ipsec-psk)
|
||||
- [Manually manage VPN users](docs/manage-users.md#manually-manage-vpn-users)
|
||||
|
||||
## Advanced usage
|
||||
|
||||
See [Advanced usage](docs/advanced-usage.md). 请参见 [高级用法](docs/advanced-usage-zh.md)。
|
||||
See [Advanced usage](docs/advanced-usage.md).
|
||||
|
||||
- [Use alternative DNS servers](docs/advanced-usage.md#use-alternative-dns-servers)
|
||||
- [DNS name and server IP changes](docs/advanced-usage.md#dns-name-and-server-ip-changes)
|
||||
|
|
@ -240,11 +240,11 @@ See [Advanced usage](docs/advanced-usage.md). 请参见 [高级用法](docs/adva
|
|||
- [Split tunneling](docs/advanced-usage.md#split-tunneling)
|
||||
- [Access VPN server's subnet](docs/advanced-usage.md#access-vpn-servers-subnet)
|
||||
- [Modify IPTables rules](docs/advanced-usage.md#modify-iptables-rules)
|
||||
- [Deploy Google BBR congestion control algorithm](docs/advanced-usage.md#deploy-google-bbr-congestion-control-algorithm)
|
||||
- [Deploy Google BBR congestion control](docs/advanced-usage.md#deploy-google-bbr-congestion-control)
|
||||
|
||||
## Uninstallation
|
||||
|
||||
See [Uninstall the VPN](docs/uninstall.md). 请参见 [卸载 VPN](docs/uninstall-zh.md)。
|
||||
See [Uninstall the VPN](docs/uninstall.md).
|
||||
|
||||
- [Uninstall using helper script](docs/uninstall.md#uninstall-using-helper-script)
|
||||
- [Manually uninstall the VPN](docs/uninstall.md#manually-uninstall-the-vpn)
|
||||
|
|
|
|||
|
|
@ -10,7 +10,7 @@
|
|||
* [VPN 分流](#vpn-分流)
|
||||
* [访问 VPN 服务器的网段](#访问-vpn-服务器的网段)
|
||||
* [更改 IPTables 规则](#更改-iptables-规则)
|
||||
* [部署 Google BBR 拥塞控制算法](#部署-google-bbr-拥塞控制算法)
|
||||
* [部署 Google BBR 拥塞控制](#部署-google-bbr-拥塞控制)
|
||||
|
||||
## 使用其他的 DNS 服务器
|
||||
|
||||
|
|
@ -279,7 +279,7 @@ iptables -t nat -I POSTROUTING -s 192.168.42.0/24 -o "$netif" -j MASQUERADE
|
|||
|
||||
**注：** 如果使用 Rocky Linux, AlmaLinux 或者 CentOS/RHEL 8 并且在安装 VPN 时 firewalld 正在运行，则可能已配置 nftables。在这种情况下，编辑 `/etc/sysconfig/nftables.conf` 而不是 `/etc/sysconfig/iptables`。
|
||||
|
||||
## 部署 Google BBR 拥塞控制算法
|
||||
## 部署 Google BBR 拥塞控制
|
||||
|
||||
VPN 服务器搭建完成后，可以通过部署 Google BBR 拥塞控制算法提升性能。
|
||||
|
||||
|
|
|
|||
|
|
@ -10,7 +10,7 @@
|
|||
* [Split tunneling](#split-tunneling)
|
||||
* [Access VPN server's subnet](#access-vpn-servers-subnet)
|
||||
* [Modify IPTables rules](#modify-iptables-rules)
|
||||
* [Deploy Google BBR congestion control algorithm](#deploy-google-bbr-congestion-control-algorithm)
|
||||
* [Deploy Google BBR congestion control](#deploy-google-bbr-congestion-control)
|
||||
|
||||
## Use alternative DNS servers
|
||||
|
||||
|
|
@ -280,7 +280,7 @@ If you want to modify the IPTables rules after install, edit `/etc/iptables.rule
|
|||
|
||||
**Note:** If using Rocky Linux, AlmaLinux or CentOS/RHEL 8 and firewalld was active during VPN setup, nftables may be configured. In this case, edit `/etc/sysconfig/nftables.conf` instead of `/etc/sysconfig/iptables`.
|
||||
|
||||
## Deploy Google BBR congestion control algorithm
|
||||
## Deploy Google BBR congestion control
|
||||
|
||||
After the VPN server is set up, the performance can be improved by deploying the Google BBR congestion control algorithm.
|
||||
|
||||
|
|
|
|||
|
|
@ -4,44 +4,15 @@
|
|||
|
||||
在默认情况下，将只创建一个用于 VPN 登录的用户账户。如果你需要查看或管理 IPsec/L2TP 和 IPsec/XAuth ("Cisco IPsec") 模式的用户，请阅读本文档。对于 IKEv2，参见 [管理客户端证书](ikev2-howto-zh.md#管理客户端证书)。
|
||||
|
||||
* [查看或更改 IPsec PSK](#查看或更改-ipsec-psk)
|
||||
* [查看 VPN 用户](#查看-vpn-用户)
|
||||
* [使用辅助脚本管理 VPN 用户](#使用辅助脚本管理-vpn-用户)
|
||||
* [查看 VPN 用户](#查看-vpn-用户)
|
||||
* [查看或更改 IPsec PSK](#查看或更改-ipsec-psk)
|
||||
* [手动管理 VPN 用户](#手动管理-vpn-用户)
|
||||
|
||||
## 查看或更改 IPsec PSK
|
||||
|
||||
IPsec PSK（预共享密钥）保存在文件 `/etc/ipsec.secrets`。所有的 VPN 用户将共享同一个 IPsec PSK。该文件的格式如下：
|
||||
|
||||
```bash
|
||||
%any %any : PSK "你的IPsec预共享密钥"
|
||||
```
|
||||
|
||||
如果要更换一个新的 PSK，可以编辑此文件。**不要**在值中使用这些字符：`\ " '`
|
||||
|
||||
完成后必须重启服务：
|
||||
|
||||
```bash
|
||||
service ipsec restart
|
||||
service xl2tpd restart
|
||||
```
|
||||
|
||||
## 查看 VPN 用户
|
||||
|
||||
在默认情况下，VPN 安装脚本将为 IPsec/L2TP 和 IPsec/XAuth ("Cisco IPsec") 模式创建相同的用户。
|
||||
|
||||
对于 IPsec/L2TP，VPN 用户信息保存在文件 `/etc/ppp/chap-secrets`。该文件的格式如下：
|
||||
|
||||
```bash
|
||||
"用户名1" l2tpd "密码1" *
|
||||
"用户名2" l2tpd "密码2" *
|
||||
... ...
|
||||
```
|
||||
|
||||
对于 IPsec/XAuth ("Cisco IPsec")，VPN 用户信息保存在文件 `/etc/ipsec.d/passwd`。这个文件中的密码以加盐哈希值的形式保存。更多详情请见 [手动管理 VPN 用户](#手动管理-vpn-用户)。
|
||||
|
||||
## 使用辅助脚本管理 VPN 用户
|
||||
|
||||
*其他语言版本: [English](manage-users.md#manage-vpn-users-using-helper-scripts), [简体中文](manage-users-zh.md#使用辅助脚本管理-vpn-用户)。*
|
||||
|
||||
你可以使用辅助脚本 [添加](../extras/add_vpn_user.sh), [删除](../extras/del_vpn_user.sh) 或者 [更新所有的](../extras/update_vpn_users.sh) VPN 用户。它们将同时更新 IPsec/L2TP 和 IPsec/XAuth ("Cisco IPsec") 模式的用户。对于 IKEv2 模式，请另外参见 [管理客户端证书](ikev2-howto-zh.md#管理客户端证书)。
|
||||
|
||||
**注：** 将下面的命令的参数换成你自己的值。VPN 用户信息保存在文件 `/etc/ppp/chap-secrets` 和 `/etc/ipsec.d/passwd`。脚本在修改这些文件之前会先做备份，使用 `.old-日期-时间` 为后缀。
|
||||
|
|
@ -148,6 +119,37 @@ VPN_PASSWORDS='密码1 密码2 ...' \
|
|||
bash updatevpnusers.sh
|
||||
```
|
||||
|
||||
## 查看 VPN 用户
|
||||
|
||||
在默认情况下，VPN 安装脚本将为 IPsec/L2TP 和 IPsec/XAuth ("Cisco IPsec") 模式创建相同的用户。
|
||||
|
||||
对于 IPsec/L2TP，VPN 用户信息保存在文件 `/etc/ppp/chap-secrets`。该文件的格式如下：
|
||||
|
||||
```bash
|
||||
"用户名1" l2tpd "密码1" *
|
||||
"用户名2" l2tpd "密码2" *
|
||||
... ...
|
||||
```
|
||||
|
||||
对于 IPsec/XAuth ("Cisco IPsec")，VPN 用户信息保存在文件 `/etc/ipsec.d/passwd`。这个文件中的密码以加盐哈希值的形式保存。更多详情请见 [手动管理 VPN 用户](#手动管理-vpn-用户)。
|
||||
|
||||
## 查看或更改 IPsec PSK
|
||||
|
||||
IPsec PSK（预共享密钥）保存在文件 `/etc/ipsec.secrets`。所有的 VPN 用户将共享同一个 IPsec PSK。该文件的格式如下：
|
||||
|
||||
```bash
|
||||
%any %any : PSK "你的IPsec预共享密钥"
|
||||
```
|
||||
|
||||
如果要更换一个新的 PSK，可以编辑此文件。**不要**在值中使用这些字符：`\ " '`
|
||||
|
||||
完成后必须重启服务：
|
||||
|
||||
```bash
|
||||
service ipsec restart
|
||||
service xl2tpd restart
|
||||
```
|
||||
|
||||
## 手动管理 VPN 用户
|
||||
|
||||
对于 IPsec/L2TP，VPN 用户信息保存在文件 `/etc/ppp/chap-secrets`。该文件的格式如下：
|
||||
|
|
|
|||
|
|
@ -4,44 +4,15 @@
|
|||
|
||||
By default, a single user account for VPN login is created. If you wish to view or manage users for the IPsec/L2TP and IPsec/XAuth ("Cisco IPsec") modes, read this document. For IKEv2, see [Manage client certificates](ikev2-howto.md#manage-client-certificates).
|
||||
|
||||
* [View or update the IPsec PSK](#view-or-update-the-ipsec-psk)
|
||||
* [View VPN users](#view-vpn-users)
|
||||
* [Manage VPN users using helper scripts](#manage-vpn-users-using-helper-scripts)
|
||||
* [View VPN users](#view-vpn-users)
|
||||
* [View or update the IPsec PSK](#view-or-update-the-ipsec-psk)
|
||||
* [Manually manage VPN users](#manually-manage-vpn-users)
|
||||
|
||||
## View or update the IPsec PSK
|
||||
|
||||
The IPsec PSK (pre-shared key) is stored in `/etc/ipsec.secrets`. All VPN users will share the same IPsec PSK. The format of this file is:
|
||||
|
||||
```bash
|
||||
%any %any : PSK "your_ipsec_pre_shared_key"
|
||||
```
|
||||
|
||||
To change to a new PSK, just edit this file. DO NOT use these special characters within values: `\ " '`
|
||||
|
||||
You must restart services when finished:
|
||||
|
||||
```bash
|
||||
service ipsec restart
|
||||
service xl2tpd restart
|
||||
```
|
||||
|
||||
## View VPN users
|
||||
|
||||
By default, the VPN setup scripts will create the same VPN user for both IPsec/L2TP and IPsec/XAuth ("Cisco IPsec") modes.
|
||||
|
||||
For IPsec/L2TP, VPN users are specified in `/etc/ppp/chap-secrets`. The format of this file is:
|
||||
|
||||
```bash
|
||||
"username1" l2tpd "password1" *
|
||||
"username2" l2tpd "password2" *
|
||||
... ...
|
||||
```
|
||||
|
||||
For IPsec/XAuth ("Cisco IPsec"), VPN users are specified in `/etc/ipsec.d/passwd`. Passwords in this file are salted and hashed. See [Manually manage VPN users](#manually-manage-vpn-users) for more details.
|
||||
|
||||
## Manage VPN users using helper scripts
|
||||
|
||||
*Read this in other languages: [English](manage-users.md#manage-vpn-users-using-helper-scripts), [简体中文](manage-users-zh.md#使用辅助脚本管理-vpn-用户).*
|
||||
|
||||
You may use helper scripts to [add](../extras/add_vpn_user.sh), [delete](../extras/del_vpn_user.sh) or [update all](../extras/update_vpn_users.sh) VPN users for both IPsec/L2TP and IPsec/XAuth ("Cisco IPsec") modes. For IKEv2 mode, please instead see [Manage client certificates](ikev2-howto.md#manage-client-certificates).
|
||||
|
||||
**Note:** Replace command arguments below with your own values. VPN users are stored in `/etc/ppp/chap-secrets` and `/etc/ipsec.d/passwd`. The scripts will backup these files before making changes, with `.old-date-time` suffix.
|
||||
|
|
@ -148,6 +119,37 @@ VPN_PASSWORDS='password1 password2 ...' \
|
|||
bash updatevpnusers.sh
|
||||
```
|
||||
|
||||
## View VPN users
|
||||
|
||||
By default, the VPN setup scripts will create the same VPN user for both IPsec/L2TP and IPsec/XAuth ("Cisco IPsec") modes.
|
||||
|
||||
For IPsec/L2TP, VPN users are specified in `/etc/ppp/chap-secrets`. The format of this file is:
|
||||
|
||||
```bash
|
||||
"username1" l2tpd "password1" *
|
||||
"username2" l2tpd "password2" *
|
||||
... ...
|
||||
```
|
||||
|
||||
For IPsec/XAuth ("Cisco IPsec"), VPN users are specified in `/etc/ipsec.d/passwd`. Passwords in this file are salted and hashed. See [Manually manage VPN users](#manually-manage-vpn-users) for more details.
|
||||
|
||||
## View or update the IPsec PSK
|
||||
|
||||
The IPsec PSK (pre-shared key) is stored in `/etc/ipsec.secrets`. All VPN users will share the same IPsec PSK. The format of this file is:
|
||||
|
||||
```bash
|
||||
%any %any : PSK "your_ipsec_pre_shared_key"
|
||||
```
|
||||
|
||||
To change to a new PSK, just edit this file. DO NOT use these special characters within values: `\ " '`
|
||||
|
||||
You must restart services when finished:
|
||||
|
||||
```bash
|
||||
service ipsec restart
|
||||
service xl2tpd restart
|
||||
```
|
||||
|
||||
## Manually manage VPN users
|
||||
|
||||
For IPsec/L2TP, VPN users are specified in `/etc/ppp/chap-secrets`. The format of this file is:
|
||||
|
|
|
|||
Loading…
Reference in New Issue
Block a user