背景

iOS 和 OS X 都自带 Cisco IPSec VPN 客户端,使用起来非常方便,安全性也比 PPTP 高。

搭建过程

安装strongswan

apt-get update
apt-get install strongswan strongswan-plugin-xauth-generic

编辑 /etc/ipsec.secrets

替换123.123.123.123为服务器IP

123.123.123.123 %any : PSK "pskkey"

yuki : XAUTH "yukispassword"
mayu : XAUTH "mayuspassword"

编辑 /etc/ipsec.conf

config setup
    cachecrls=yes
    uniqueids=yes

conn ios
    keyexchange=ikev1
    authby=xauthpsk
    xauth=server
    left=%defaultroute
    leftsubnet=0.0.0.0/0
    leftfirewall=yes
    right=%any
    rightsubnet=10.7.0.0/24
    rightsourceip=10.7.0.2/24
    rightdns=4.2.2.1
    auto=add

重启 strongswan

service strongswan restart

打开IPv4转发,设置NAT规则

sysctl net.ipv4.ip_forward=1

iptables -t nat -A POSTROUTING -s 10.0.0.0/8 -o eth0 -j MASQUERADE