手机IKEv2 VPN拨号访问内网资源

参考文档:

一、网络及服务器环境:

  • 公网IP,可以是固定IP或DDNS
  • OS: Debian 12 Kernel: 6.1.0-17-amd64 

二、网络配置:

  • 网关映射udp:500、udp:4500这些端口和协议给内网Debian12
  • 如果需要访问的内部资源IP与Debian12不在同一个网段,需要做静态路由把rightsourceip指向Debian12

三、安装strongSwan

apt安装:sudo apt install strongswan-starter

或者编译安装,两种安装方式默认的etc配置路径有所不同,注意区分。

wget https://download.strongswan.org/strongswan-5.9.14.tar.bz2
tar xjf strongswan-5.9.14.tar.bz2
cd strongswan-5.9.14
./configure --enable-ikev2 --enable-openssl --enable-systemd --with-systemdsystemunitdir=/lib/systemd/system --enable-charon --enable-random --enable-nonce --enable-aes --enable-sha1 --enable-sha2 --enable-pem --enable-pkcs1 --enable-curve25519 --enable-gmp --enable-x509 --enable-curl --enable-revocation --enable-hmac --enable-kdf --enable-stroke --enable-kernel-netlink --enable-socket-default --enable-fips-prf --enable-eap-mschapv2 --enable-eap-identity --enable-updown --disable-defaults
make
sudo make install

四、acme申请证书

acme.sh --issue -d lotro.cc -k 3072 --cert-file /usr/local/etc/ipsec.d/certs/lotro.cc.cer --key-file /usr/local/etc/ipsec.d/private/lotro.cc.key --ca-file /usr/local/etc/ipsec.d/cacerts/ca.cer --reloadcmd "sudo ipsec reload"

五、配置 ipsec.conf

sudo nano /usr/local/etc/ipsec.conf
config setup
	uniqueids = never
conn %default
	keyexchange=ike
conn rw
	leftsubnet=192.168.55.0/24      # 需要访问的内网资源
	leftcert=lotro.cc.cer           # acme申请的签名ssl证书
	leftid=lotro.cc                 # 必须等于ssl证书的主机名
	leftsendcert=yes
	rightauth=eap-mschapv2          # 采用用户名密码验证
	rightsourceip=192.168.100.128/25  # 分配给手机端的虚拟IP段
	auto=add

认证密钥key

sudo nano /usr/local/etc/ipsec.secrets
# /usr/local/etc/ipsec.secrets - strongSwan IPsec secrets file
admin : EAP "admin"   # 用户名和密码

重启 sudo ipsec reload

六、移动端配置

  • 类型:IKEv2
  • 服务器地址:lotro.cc
  • 远程ID「服务器ID」:lotro.cc
  • 本地ID「IPSec标识符」:(可不填,服务端默认%any,服务端根据不同用户匹配资源)
  • 用户名:admin
  • 密码:admin
  • 代理:关闭


PS:以下是swanctl.conf方式配置strongSwan具体配置,效果同上

sudo apt install build-essential pkg-config libsystemd-dev libssl-dev
或者sudo yum install -y gcc gcc-c++ make pkgconfig gmp-devel openssl-devel libcurl-devel systemd-devel iptables iproute
wget https://download.strongswan.org/strongswan.tar.gz
tar zxf strongswan.tar.gz
cd strongswan-6.1.0

./configure --prefix=/usr --sysconfdir=/etc --disable-defaults --disable-charon --disable-stroke --enable-systemd --with-systemdsystemunitdir=/lib/systemd/system --enable-ikev2 --enable-swanctl --enable-openssl --enable-gmp --enable-aes --enable-des --enable-md4 --enable-md5 --enable-sha1 --enable-sha2 --enable-hmac --enable-curve25519 --enable-nonce --enable-random --enable-pem --enable-pkcs1 --enable-pkcs8 --enable-pubkey --enable-x509 --enable-revocation --enable-constraints --enable-curl --enable-kernel-netlink --enable-socket-default --enable-eap-identity --enable-eap-mschapv2 --enable-updown

make
sudo make install

acme.sh --issue -d lotro.cc -k 2048 --cert-file /etc/swanctl/x509/lotro.cc.cer --key-file /etc/swanctl/private/lotro.cc.key --ca-file /etc/swanctl/x509ca/ca.cer --reloadcmd "sudo swanctl -q"

/etc/swanctl/x509ca/ca.cer
/etc/swanctl/x509/lotro.cc.cer
/etc/swanctl/private/lotro.cc.key

/etc/swanctl/conf.d/v.conf
connections {
  conn-eap {
    pools = ipv4
    send_cert = always
    local {
      auth = pubkey
      certs = lotro.cc.cer
      id = lotro.cc
    }
    remote {
      auth = eap-mschapv2
      eap_id = %any
    }
    children {
      eap {
        local_ts = 192.168.55.0/24
      }
    }
  }
}

pools {
  ipv4 {
    addrs = 192.168.100.128/25
  }
}

secrets {
  eap-admin {
    id = admin
    secret = admin
  }
}

免费申请Google SSL证书

参考:
https://github.com/acmesh-official/acme.sh
https://github.com/acmesh-official/acme.sh/wiki/Google-Trust-Services-CA
https://cloud.google.com/public-certificate-authority/docs/quickstart

1、申请Google的EAB key and EAB id:

登录云平台Shell Cloud Shell

请求 EAB 密钥 ID 和 HMAC,请运行以下命令:

gcloud publicca external-account-keys create

此命令会返回在公共 CA 的生产环境中有效的 EAB 密钥。在响应正文中,keyId 字段包含 EAB 密钥 ID,b64MacKey 字段包含 EAB HMAC。

您必须在获取 EAB 密钥后的 7 天内使用它。如果您不在 7 天内使用 EAB 密钥,则该密钥会失效。使用 EAB Secret 注册的 ACME 帐号没有有效期。

2、安装acme.sh

curl https://get.acme.sh | sh -s email=my@example.com

3、申请证书

acme.sh  --register-account  -m  myemail@example.com --server google \
    --eab-kid xxxxxxx \
    --eab-hmac-key xxxxxxx

acme.sh --issue  --server google \
   -d example.com  -d '*.example.com'  --dns dns_googledomains \
   --keylength ec-256

4、安装证书到nginx

acme.sh --install-cert -d example.com \
--key-file       /path/to/keyfile/in/nginx/key.pem  \
--fullchain-file /path/to/fullchain/nginx/cert.pem \
--reloadcmd     "service nginx force-reload"

Windows下的 win-acme

安装https://www.win-acme.com

使用阿里云DNS的API注册example.com和其泛域名证书,并把证书安装进IIS10的第二个站点,同时保存pem和pfx证书到D:\CentralSSL里

 wacs.exe --source manual --host example.com,*.example.com --validation aliyun --aliyunserver dns.aliyuncs.com --aliyunapiid ******* --aliyunapisecret ******* --store certificatestore,pemfiles,pfxfile --certificatestore My --pemfilespath D:\CentralSSL --pfxfilepath D:\CentralSSL --pfxpassword ******* --installation iis --installationsiteid 2

使用腾讯dns的API申请ecc证书并保存到D:\CentralSSL

 wacs.exe --source manual --host example.com,*.example.com --validation tencent --tencentapiid ******* --tencentapikey ******* --csr ec --store pemfiles,pfxfile --pemfilespath D:\CentralSSL --pfxfilepath D:\CentralSSL --pfxpassword *******

程序被损坏了macOS

如果macOS在程序中检测到问题——例如,存在恶意内容或验证后进行的修改——当您尝试打开应用程序并要求您将其移至垃圾桶时,您将收到通知。

方法一:对于特定程序,在终端中运行:

sudo xattr -r -c /Applications/LockedApp.app

一定有一个损坏的应用程序,而不是“LockedApp.app”。

方法二:要全局禁用检查,请在终端中运行:

对于macOS 10.12 – 10.15.7

sudo spctl --master-disable

对于macOS 11及更高版本

sudo spctl --global-disable

要启用门禁,请将“禁用”替换为“启用”。

为什么我在尝试在Ubuntu上安装时会遇到bind: address already in use错误?

https://adguard-dns.io/kb/zh-CN/adguard-home/faq/#bindinuse

This happens because the port 53 on localhost, which is used for DNS, is already taken by another program. Ubuntu comes with a local DNS called systemd-resolved, which uses the address 127.0.0.53:53, thus preventing AdGuard Home from binding to 127.0.0.1:53. You can see this by running:

sudo lsof -i :53

The output should be similar to:

COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
systemd-r 14542 systemd-resolve 13u IPv4 86178 0t0 UDP 127.0.0.53:domain
systemd-r 14542 systemd-resolve 14u IPv4 86179 0t0 TCP 127.0.0.53:domain

To fix this, you must either disable the systemd-resolved daemon or choose a different network interface and bind your AdGuard Home to an accessible IP address on it, such as the IP address of your router inside your network. But if you do need to listen on localhost, there are several solutions.

Firstly, AdGuard Home can detect such configurations and disable systemd-resolved for you if you press the Fix button located next to the address already in use message on the installation screen.

Secondly, if that doesn’t work, follow the instructions below. Note that if you’re using AdGuard Home with docker or snap, you’ll have to do this yourself.

  • Create the /etc/systemd/resolved.conf.d directory, if necessary:
sudo mkdir -p /etc/systemd/resolved.conf.d
  • Deactivate DNSStubListener and update DNS server address. To do that, create a new file, /etc/systemd/resolved.conf.d/adguardhome.conf, with the following content:
[Resolve]
DNS=127.0.0.1
DNSStubListener=no

Specifying 127.0.0.1 as the DNS server address is necessary. Otherwise the nameserver will be 127.0.0.53 which won’t work without DNSStubListener.

  • Activate another resolv.conf file:
sudo mv /etc/resolv.conf /etc/resolv.conf.backup
sudo ln -s /run/systemd/resolve/resolv.conf /etc/resolv.conf
  • Restart DNSStubListener:sudo systemctl reload-or-restart systemd-resolved
sudo systemctl reload-or-restart systemd-resolved

After that, systemd-resolved shouldn’t be shown in the output of lsof, and AdGuard Home should be able to bind to 127.0.0.1:53.

pxe网络安装debian、Ubuntu、openEuler

一、tftp服务搭建

服务器选用Debian12,安装tftpd-hpa服务,配置文件如下:

sudo apt install tftpd-hpa

user@DNS$ cat /etc/default/tftpd-hpa

# /etc/default/tftpd-hpa

TFTP_USERNAME="tftp"
TFTP_DIRECTORY="/home/tftp"
TFTP_ADDRESS=":69"
TFTP_OPTIONS="--secure"

二、配置uefi模式的pxe启动文件

选择合适的netboot程序,这里选用Debian的netboot

wget https://mirrors.ustc.edu.cn/debian/dists/stable/main/installer-amd64/current/images/netboot/netboot.tar.gz

解压到tftp的根目录内,然后修改tftp目录下的配置文件,下面直接贴出各系统的自动安装配置

uefi模式添加默认本地硬盘启动,以下配置需手动添加到tftp目录下的debian-installer/amd64/grub/grub.cfg 中

set timeout=5
set default=0
menuentry 'Boot from next volume' {
        exit 1
}

添加Debian12网络启动,并添加了自动化安装脚本:

menuentry 'Install Debian' {
	linux    debian-installer/amd64/linux auto=true priority=critical vga=788 auto locale=zh_CN url=http://dns.a.v/preseed.cfg
        initrd   debian-installer/amd64/initrd.gz
}

openEuler的网络安装配置,同样添加了ks.cfg自动安装脚本:

menuentry 'openEuler 24.03 LTS SP2' --class openEuler --class gnu-linux --class gnu --class os {
        linuxefi openEuler/vmlinuz ip=dhcp inst.ks=http://dns.a.v/ks.cfg inst.repo=http://mirrors.tuna.tsinghua.edu.cn/openeuler/openEuler-24.03-LTS-SP2/OS/x86_64
        initrdefi openEuler/initrd.img
}
menuentry 'Kylin Server V10 SP3' --class red --class gnulinux --class gnu --class os {
    linux Kylin/vmlinuz ro inst.geoloc=0 console=ttyAMA0 console=tty0 rd.iscsi.waitnet=0 ip=dhcp inst.repo=http://dns.a.v/Kylin-V10-SP3 inst.ks=http://dns.a.v/ksKylin.cfg
    initrd Kylin/initrd.img
}
menuentry 'UOS Server v20 1070a' {
        linuxefi uos/vmlinuz ip=dhcp inst.ks=http://dns.a.v/ksuos.cfg
        initrdefi uos/initrd.img
}

Ubuntu的网络安装配置,并配置了自动安装脚本:

menuentry 'ubuntu server 26.04.1 lts' {
        linux   ubuntu/vmlinuz root=/dev/ram0 ramdisk_size=1500000 ip=dhcp iso-url=http://dns.a.v/ubuntu-26.04.1-live-server-amd64.iso autoinstall ds=nocloud-net\;s=http://dns.a.v/autoinstall ---
        initrd  ubuntu/initrd
}

三、添加传统bios模式的启动配置

以下这个参数添加入tftp目录的/home/tftp/menu.cfg

menu hshift 4
menu width 70

menu title GNU/Linux installer menu (BIOS mode)
include debian-installer/amd64/boot-screens/stdmenu.cfg

label Alpine
	menu label ^Alpine Linux
        linux alpine/vmlinuz-lts ip=dhcp modloop=http://dns.a.v/modloop-lts alpine_repo=http://mirrors.ustc.edu.cn/alpine/latest-stable/main
        initrd alpine/initramfs-lts

label Debian Server
	menu label ^Debian Server 
        linux    debian-installer/amd64/linux preseed/url=http://dns.a.v/preseed.cfg auto=true priority=critical vga=788 locale=zh_CN interface=auto hostname=DB2026 domain=
        initrd   debian-installer/amd64/initrd.gz

label Ubuntu Server
	menu label ^Ubuntu Server 26.04.1 lts
	kernel ubuntu/vmlinuz
	initrd ubuntu/initrd
#	append url=http://dns.a.v/ubuntu/ ip=dhcp root=/dev/ram0 ramdisk_size=2500000 iso-url=http://dns.a.v/ubuntu-24.04.4-live-server-amd64.iso autoinstall ds=nocloud-net;s=http://dns.a.v/autoinstall/ ---
	append iso-url=http://dns.a.v/ubuntu-26.04.1-live-server-amd64.iso ip=dhcp root=/dev/ram0 ramdisk_size=2500000 autoinstall ds=nocloud-net;s=http://dns.a.v/autoinstall/ ---

#label Kylin Server
#        menu label ^Kylin Server V10 SP3
#        linux Kylin/vmlinuz ro inst.geoloc=0 console=ttyAMA0 console=tty0 rd.iscsi.waitnet=0 ip=dhcp inst.repo=http://dns.a.v/Kylin-V10-SP3 inst.ks=http://dns.a.v/ksKylin.cfg
#        initrd Kylin/initrd.img

#label openEuler Server
#        menu label ^openEuler-24.03-LTS-SP2
#        linuxefi openEuler/vmlinuz ip=dhcp inst.ks=http://dns.a.v/ks.cfg inst.repo=http://mirrors.tuna.tsinghua.edu.cn/openeuler/openEuler-24.03-LTS-SP2/OS/x86_64
#        initrdefi openEuler/initrd.img

#label UOS Server
#        menu label UOS Server v20 1070a
#        linuxefi uos/vmlinuz ip=dhcp inst.ks=http://dns.a.v/ksuos.cfg
#        initrdefi uos/initrd.img

timeout 100

label local
	menu label ^Boot from local drive
	localboot 0
	menu default

四,相关快速启动附件

Ubuntu的user-data

dns:~# cat /home/share/autoinstall/user-data 
#cloud-config
autoinstall:
  apt:
    mirror-selection:
      primary:
      - uri: http://mirrors.ustc.edu.cn/ubuntu
  identity:
    hostname: UB2026
    password: $1$9I0jUZ36$TBye48EkhMYYDWkqrCMtt0
    realname: 为人民服务
    username: user
  keyboard:
    layout: cn
  locale: zh_CN.UTF-8
  packages:
  - neofetch
  - net-tools
#  - network-manager
  - fonts-unifont
#  - network-manager-gnome
  - build-essential
#  - gnome-shell
  - language-pack-zh-hans
#  - ubuntu-desktop-minimal
#  - language-pack-gnome-zh-hans
#  snaps:
#  - name: snap-store
#  - name: chromium
  ssh:
    allow-pw: true
    authorized-keys:
    - ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAxfUbjiwcpV1G5vt78dpXWbgyZNZ44X5SUckKqDzSNKZDxzFwDZiKm/yt2aVJ3c7uSz0Wz3Y7oEuwOb4gLoRLXJ3OKGSkLXtnRfTOuddV1h/daWDgYr0f4dSvy/5+8Jdz5e39Lv2T4Ggaeh7EuXBhZoRezk7LRaeXZT0IcykwayK36aD5HpUqpwoV2FsCv0EC2kdmrbS7uelpxqjgM2mRZivEoGAodIDwu3hFF94kPw9+BtVKk9cty+DS+68q1tCb6C4TlcBpA3MdpSCuUuzr4y7DOCcgTgwzBxp7zlApxj/3iyI4EOyzjef1Oh01YcP9+zQ//zQL3l8VYLnjoncyZQ== lotro@live.cn
    install-server: true
  interactive-sections:
   - storage
#  storage:
#    layout:
#      name: direct
#      match:
#        size: smallest
  user-data:
#    package_upgrade: true
    timezone: Asia/Shanghai
  late-commands:
#    - sed -i '$a\*.warning  @180.167.245.xxx\' /target/etc/rsyslog.conf
    - echo '*.warning @180.167.245.xxx' >> /target/etc/rsyslog.conf
  version: 1

其他ks.cfg

# Generated by Anaconda 36.16.5
# Generated by pykickstart v3.47
#version=DEVEL
# Use graphical install
graphical
# Reboot after installation
reboot

%post
sed -i '$a\*.notice  @180.167.245.xxx\' /etc/rsyslog.conf
cp /etc/yum.repos.d/openEuler.repo /etc/yum.repos.d/openEuler.repo.backup
sed -i s#repo.openeuler.org/#mirrors.zju.edu.cn/openeuler/#g /etc/yum.repos.d/openEuler.repo
%end

# Keyboard layouts
keyboard --vckeymap=cn --xlayouts='cn'
# System language
lang zh_CN.UTF-8

# Firewall configuration
firewall --disabled
# Network information
network  --bootproto=dhcp --device=link --hostname=openEuler --ipv6=auto --activate

# Use network installation
url --url="http://mirrors.zju.edu.cn/openeuler/openEuler-22.03-LTS-SP3/OS/x86_64/"

%packages
@standard
net-tools
telnet
vim-enhanced

%end

# SELinux configuration
selinux --disabled

# Generated using Blivet version 3.4.2
#ignoredisk --only-use=sda
# Partition clearing information
clearpart --all --initlabel
# Disk partitioning information
part swap --fstype="swap" --size=4096
part /boot/efi --fstype="efi" --size=1024
part / --fstype="ext4" --size=40960
part /home --fstype="ext4" --grow

# System timezone
timezone Asia/Shanghai --utc

#Root password
rootpw --lock
sshkey --username=user "ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAxfUbjiwcpV1G5vt78dpXWbgyZNZ44X5SUckKqDzSNKZDxzFwDZiKm/yt2aVJ3c7uSz0Wz3Y7oEuwOb4gLoRLXJ3OKGSkLXtnRfTOuddV1h/daWDgYr0f4dSvy/5+8Jdz5e39Lv2T4Ggaeh7EuXBhZoRezk7LRaeXZT0IcykwayK36aD5HpUqpwoV2FsCv0EC2kdmrbS7uelpxqjgM2mRZivEoGAodIDwu3hFF94kPw9+BtVKk9cty+DS+68q1tCb6C4TlcBpA3MdpSCuUuzr4y7DOCcgTgwzBxp7zlApxj/3iyI4EOyzjef1Oh01YcP9+zQ//zQL3l8VYLnjoncyZQ== lotro@live.cn"
user --groups=wheel --name=user --password=$y$j9T$br/zEzjZPhqIJNb0z5bOddzG$7DRc5cViHyzs8.rWb1w.6UdoTo.2ZZpGhutwhrUZ5k5 --iscrypted --gecos="user"

五、dhcp配置

如果是跨vlan的不同网段网络启动安装Linux需要做如下设置,以华为网络设备为例

uefi启动模式:

 dhcp server next-server 192.168.50.5
 dhcp server bootfile debian-installer/amd64/bootnetx64.efi

bios启动模式

 dhcp server next-server 192.168.50.5
 dhcp server bootfile pxelinux.0

六、更新操作

dns:~# cat /home/tftp/new.sh 
curl -L http://mirrors.nyist.edu.cn/debian/dists/stable/main/installer-amd64/current/images/netboot/netboot.tar.gz -o /home/tftp/netboot.tar.gz
curl -L https://mirrors.ustc.edu.cn/alpine/latest-stable/releases/x86_64/netboot/initramfs-lts -o /home/tftp/alpine/initramfs-lts
curl -L https://mirrors.ustc.edu.cn/alpine/latest-stable/releases/x86_64/netboot/vmlinuz-lts -o /home/tftp/alpine/vmlinuz-lts
curl -L https://mirrors.ustc.edu.cn/alpine/latest-stable/releases/x86_64/netboot/modloop-lts -o /home/share/modloop-lts
chown nobody -R /home/tftp
tar zxf /home/tftp/netboot.tar.gz -C /home/tftp
cd /home/tftp/debian-installer/amd64/boot-screens/
ln -sfn ../../../menu.cfg ./
cd /home/tftp/debian-installer/amd64/grub/
ln -sfn ../../../grub.cfg ./