操作系統爲：Centos 5.7
拓撲如下：
局域網A---Linux防火牆A-----公網------Linux防火牆B----局域網B
局域網A的網段：192.168.2.0/24
Linux防火牆A 內網接口eth1：192.168.2.1/24
外網接口eth0: 192.168.1.1/24
局域網B的網段：192.168.3.0/24
Linux防火牆B 內網接口eth1：192.168.3.1/24
外網接口eth0: 192.168.1.2/24
下面對Linux防火牆B進行操作 A配置大概一致
1 安裝ipsec ***所需要的openswan
[root@gw ~]#yum install openswan
2 打開路由轉發
[root@gw ~]#vim /etc/sysctl.conf
net/ipv4/ip_forward = 1
net.ipv4.conf.default.rp_filter = 0
使其生效
[root@gw ~]#sysctl -p
3 禁止icmp重定向
[root@gw ~]# vim disableimcp.txt
for each in /proc/sys/net/ipv4/conf/*
do
echo0 > $each/accept_redirects
echo0 > $each/send_redirects
done
[root@gw ~]# chmod 755 disableimcp.txt
[root@gw ~]# sh disableimcp.txt
4 定義ipsec的預共享密鑰
[root@gw ~]# cat /etc/ipsec.secrets
#include /etc/ipsec.d/*.secrets
#本端地址 對端地址 共享密鑰
192.168.1.2 192.168.1.1 : PSK 'my***'
#假如中心爲固定IP，對端爲ADSL動態地址 則使用以下，讓客戶端主動發起就行了
192.168.1.2 %any : PSK 'my***'
5 編輯ipsec.conf文檔
[root@gw ~]# cat /etc/ipsec.conf
# /etc/ipsec.conf - Openswan IPsecconfiguration file
#
# Manual: ipsec.conf.5
#
# Please place your own config files in/etc/ipsec.d/ ending in .conf
version 2.0 # conforms to second version of ipsec.confspecification
# basic configuration
config setup
# Debug-logging controls: "none" for (almost) none, "all" for lots.
# klipsdebug=none
# plutodebug="control parsing"
# For Red Hat Enterprise Linux and Fedora, leave protostack=netkey
protostack=netkey
nat_traversal=yes
virtual_private=
oe=off
# Enable this if you see "failed to find any available worker"
# nhelpers=0
#You may put your configuration (.conf)file in the "/etc/ipsec.d/" and uncomment this.
#include /etc/ipsec.d/*.conf
#在後面增加以下內容
conn haiwang
left=192.168.1.2
leftsubnet=192.168.3.0/255.255.255.0
right=192.168.1.1
rightsubnet=192.168.2.0/255.255.255.0
ike=3des-md5-modp1024!
esp=3des-md5!
ikelifetime=1h
keylife=8h
dpddelay=30
dpdtimeout=120
dpdaction=restart
pfs=no
authby=secret
auto=start
5 iptables防火牆設定
[root@gw ~]#iptables -t nat -A POSTROUTING -s 192.168.3.0/24 -d ! 192.168.2.0/24 -j SNAT --to 192.168.1.2 ##注意：到×××對端的流量不要走NAT出防火牆
[root@gw ~]#iptables -A FORWARD -s 192.168.3.0/24 -j ACCEPT
[root@gw ~]#iptables -A FORWARD -d 192.168.3.0/24 -j ACCEPT
[root@gw ~]#iptables -A INPUT -p udp --dport 500 -j ACCEPT
[root@gw ~]#iptables -A INPUT -p udp --dport 4500 -j ACCEPT
6 驗證一下
[root@gw ~]# ipsec verify
Checking your system to see if IPsec gotinstalled and started correctly:
Version check and ipsec on-path [OK]
Linux Openswan U2.6.32/K2.6.18-274.el5(netkey)
Checking for IPsec support in kernel [OK]
SAref kernel support [N/A]
NETKEY: Testing for disabled ICMP send_redirects [OK]
NETKEY detected, testing for disabled ICMPaccept_redirects [OK]
Checking that pluto is running [OK]
Pluto listening for IKE on udp 500 [OK]
Pluto listening for NAT-T on udp 4500 [OK]
Two or more interfaces found, checking IPforwarding [OK]
Checking NAT and MASQUERADEing [OK]
Checking for 'ip' command [OK]
Checking /bin/sh is not /bin/dash [OK]
Checking for 'iptables' command [OK]
Opportunistic Encryption Support [DISABLED]
看下×××的路由表咋走的
[root@gw ~]# ipsec look
gw.haiwang.com Sun Aug 26 18:21:38 CST 2012
IPSEC TABLE
iptables: No chain/target/match by that name
ROUTING TABLE
192.168.1.0/24 dev eth0 proto kernel scope link src 192.168.1.2
default via 192.168.1.254 dev eth0
從B局域網的一個機器ping局域網A的一個機器
Ping通就對了