一、环境介绍

Server IP:192.168.30.133
System: CentOS 6.5

Client:Winodows 7

二、编译安装StrongSwan

  1.下载StrongSwan

wget http://download.strongswan.org/strongswan.tar.gz

  2.安装相关库

yum install pam-devel openssl-devel make gcc gmp-devel

  3.编译安装

复制代码
tar zxvf strongswan.tar.gz  
cd strongswan-*  
./configure --prefix=/usr --sysconfdir=/etc  --enable-openssl --enable-nat-transport --disable-mysql \
--disable-ldap --disable-static --enable-shared --enable-md4 --enable-eap-mschapv2 --enable-eap-aka \
--enable-eap-aka-3gpp2 --enable-eap-gtc --enable-eap-identity --enable-eap-md5 --enable-eap-peap \
--enable-eap-radius --enable-eap-sim --enable-eap-sim-file --enable-eap-simaka-pseudonym \
--enable-eap-simaka-reauth --enable-eap-simaka-sql --enable-eap-tls --enable-eap-tnc --enable-eap-ttls make && make install && echo OK
复制代码

  注:如果出现错误:

复制代码
configure: WARNING: unrecognized options: --enable-nat-transport
checking for a BSD-compatible install... /usr/bin/install -c
checking whether build environment is sane... configure: error: newly created file is older than distributed files!
Check your system clock

解决方法:(原因:时间不对)

cp -Rf /usr/share/zoneinfo/Asia/Shanghai /etc/localtime
cat /etc/sysconfig/clock
ntpdate 133.100.11.8(或 s2m.time.edu.cn)
 sed -i 's#ZONE="America/New_York"#ZONE="Asia/Shanghai"#g' /etc/sysconfig/clock
 hwclock -w
date -R
复制代码

  4、生成证书

复制代码
ipsec pki --gen --outform pem > ca.pem  
ipsec pki --self --in ca.pem --dn "C=com, O=myvpn, CN=VPN CA" --ca --outform pem >ca.cert.pem  
ipsec pki --gen --outform pem > server.pem  
ipsec pki --pub --in server.pem | ipsec pki --issue --cacert ca.cert.pem --cakey ca.pem \
--dn "C=com, O=myvpn, CN=192.168.30.133" --san="192.168.30.133" --flag serverAuth --flag ikeIntermediate --outform pem > server.cert.pem ipsec pki --gen --outform pem > client.pem ipsec pki --pub --in client.pem | ipsec pki --issue --cacert ca.cert.pem --cakey ca.pem --dn "C=com, O=myvpn, CN=VPN Client" --outform pem > client.cert.pem openssl pkcs12 -export -inkey client.pem -in client.cert.pem -name "client" -certfile ca.cert.pem -caname "VPN CA" -out client.cert.p12

注意:CN=192.168.30.133为你的VPS外网地址
复制代码

  5、安装证书

cp -rf ca.cert.pem /etc/ipsec.d/cacerts/  
cp -rf server.cert.pem /etc/ipsec.d/certs/  
cp -rf server.pem /etc/ipsec.d/private/  
cp -rf client.cert.pem /etc/ipsec.d/certs/  
cp -rf client.pem  /etc/ipsec.d/private/ 
【卸载证书:非第一次安装时需要此步操作,如果第一次安装不用此步骤】
    rm -rf /etc/ipsec.d/cacerts/ca.cert.pem  
    rm -rf /etc/ipsec.d/certs/server.cert.pem  
    rm -rf /etc/ipsec.d/private/server.pem  
    rm -rf /etc/ipsec.d/certs/client.cert.pem  
    rm -rf /etc/ipsec.d/private/client.pem 

  6、配置strongswan

  a、修改/etc/ipsec.conf;如下:

复制代码
# vim /etc/ipsec.conf
    
config setup  
    strictcrlpolicy=no  
    uniqueids=no #多台设备同时在线      
conn iOS_cert
    keyexchange=ikev1
    # strongswan version >= 5.0.2, compatible with iOS 6.0,6.0.1
    fragmentation=yes
    left=%defaultroute
    leftauth=pubkey
    leftsubnet=0.0.0.0/0
    leftcert=server.cert.pem
    right=%any
    rightauth=pubkey
    rightauth2=xauth
    rightsourceip=10.10.0.0/24
    rightcert=client.cert.pem
    auto=add

#also supports iOS PSK and Shrew on Windows
conn android_xauth_psk
    keyexchange=ikev1
    left=%defaultroute
    leftauth=psk
    leftsubnet=0.0.0.0/0
    right=%any
    rightauth=psk
    rightauth2=xauth
    rightsourceip=10.11.0.0/24
    auto=add

# compatible with "strongSwan VPN Client" for Android 4.0+
# and Windows 7 cert mode.
conn networkmanager-strongswan
    keyexchange=ikev2
    left=%defaultroute
    leftauth=pubkey
    leftsubnet=0.0.0.0/0
    leftcert=server.cert.pem
    right=%any
    rightauth=pubkey
    rightsourceip=10.12.0.0/24
    rightcert=client.cert.pem
    auto=add

conn windows7
    keyexchange=ikev2
    ike=aes256-sha1-modp1024! 
    rekey=no
    left=%defaultroute
    leftauth=pubkey
    leftsubnet=0.0.0.0/0
    leftcert=server.cert.pem
    right=%any
    rightauth=eap-mschapv2
    rightsourceip=10.13.0.0/24
    rightsendcert=never
    eap_identity=%any
    auto=add

[该配置文件详解请参考:https://zh.opensuse.org/SDB:Setup_Ipsec_VPN_with_Strongswan]
复制代码

  b、修改/etc/strongswan.conf 将内容替换成如下:

复制代码
vim /etc/strongswan.conf
charon {  
        load_modular = yes  
        duplicheck.enable = no  
        compress = yes  
        plugins {  
                include strongswan.d/charon/*.conf  
        }  
        dns1 = 8.8.8.8  
        dns2 = 8.8.4.4  
        nbns1 = 8.8.8.8  
        nbns2 = 8.8.4.4  
}  
include strongswan.d/*.conf 
复制代码

  c、修改/etc/ipsec.secrets(没有此文件请自行创建)

复制代码
vim /etc/ipsec.secrets
    
: RSA server.pem    
: PSK "myPSKkey"    
: XAUTH "myXAUTHPass"    
[用户名] %any : EAP "[密码]"


【解:】
将上面的myPSKkey单词更改为你需要的PSK认证方式的密钥;
将上面的myXAUTHPass单词更改为你需要的XAUTH认证方式的密码,该认证方式的用户名是随意的;
将上面的[用户名]改为自己想要的登录名,[密码]改为自己想要的密码([]符号去掉),可以添加多行,得到多个用户,这即是使用IKEv2的用户名+密码认证方式的登录凭据.
复制代码

  7、配置网络转发规则转发

  a、设置iptables规则

复制代码
    iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
    iptables -A FORWARD -s 10.10.0.0/24  -j ACCEPT
    iptables -A FORWARD -s 10.11.0.0/24  -j ACCEPT
    iptables -A FORWARD -s 10.12.0.0/24  -j ACCEPT
    iptables -A FORWARD -s 10.13.0.0/24  -j ACCEPT
    iptables -A INPUT -p esp -j ACCEPT
    iptables -A INPUT -p udp --dport 500 -j ACCEPT  
    iptables -A INPUT -p tcp --dport 500 -j ACCEPT  
    iptables -A INPUT -p udp --dport 4500 -j ACCEPT  
    iptables -A INPUT -p udp --dport 1701 -j ACCEPT  
    iptables -A INPUT -p tcp --dport 1723 -j ACCEPT
    iptables -A FORWARD -j REJECT
    iptables -t nat -A POSTROUTING -s 10.10.0.0/24 -j MASQUERADE  
    iptables -t nat -A POSTROUTING -s 10.11.0.0/24 -j MASQUERADE
    iptables -t nat -A POSTROUTING -s 10.12.0.0/24 -j MASQUERADE
    iptables -t nat -A POSTROUTING -s 10.13.0.0/24 -j MASQUERADE      

注意iptables规则的顺序。以下做为参考:
# Generated by iptables-save v1.4.7 on Thu Dec 8 12:51:52 2016
*nat
:PREROUTING ACCEPT [2:156]
:POSTROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A POSTROUTING -s 10.10.0.0/24 -j MASQUERADE 
-A POSTROUTING -s 10.11.0.0/24 -j MASQUERADE 
-A POSTROUTING -s 10.12.0.0/24 -j MASQUERADE 
-A POSTROUTING -s 10.13.0.0/24 -j MASQUERADE 
COMMIT
# Completed on Thu Dec 8 12:51:52 2016
# Generated by iptables-save v1.4.7 on Thu Dec 8 12:51:52 2016
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [39:3992]
-A INPUT -m state –state RELATED,ESTABLISHED -j ACCEPT 
-A INPUT -p icmp -j ACCEPT 
-A INPUT -i lo -j ACCEPT 
-A INPUT -p tcp -m state –state NEW -m tcp –dport 22 -j ACCEPT 
-A INPUT -p esp -j ACCEPT 
-A INPUT -p udp -m udp –dport 500 -j ACCEPT 
-A INPUT -p tcp -m tcp –dport 500 -j ACCEPT 
-A INPUT -p udp -m udp –dport 4500 -j ACCEPT 
-A INPUT -p udp -m udp –dport 1701 -j ACCEPT 
-A INPUT -p tcp -m tcp –dport 1723 -j ACCEPT 
-A INPUT -j REJECT –reject-with icmp-host-prohibited
-A FORWARD -m state –state RELATED,ESTABLISHED -j ACCEPT 
-A FORWARD -s 10.10.0.0/24 -j ACCEPT 
-A FORWARD -s 10.11.0.0/24 -j ACCEPT 
-A FORWARD -s 10.12.0.0/24 -j ACCEPT 
-A FORWARD -s 10.13.0.0/24 -j ACCEPT 
-A FORWARD -j REJECT –reject-with icmp-port-unreachable 
COMMIT
# Completed on Thu Dec 8 12:51:52 2016

复制代码
service iptables restart

   b、设置ip_forward转发

复制代码
vim /etc/sysctl.conf

    net.ipv4.ip_forward = 0
    改为:
    net.ipv4.ip_forward = 1

    sysctl -p
复制代码

至此,strongswan就已经配置完成了,以下来测试

Windows 7测试拨号:http://zlyang.blog.51cto.com/1196234/1881212

二、部署Freeradius+mysql+daloradius

  1、安装Freeradius和Mysql

yum -y install freeradius freeradius-mysql freeradius-utils mysql-server

  2、启动Mysql及设置密码

  service mysqld start
    chkconfig mysqld on
    mysql_secure_installation

  3、导入Freeradius库数据

复制代码
  mysql -uroot -p 
    mysql> CREATE DATABASE radius;
    mysql> GRANT ALL PRIVILEGES ON radius.* TO radius@'localhost' IDENTIFIED BY "radpass";
    mysql> GRANT ALL PRIVILEGES ON radius.* TO radius@'%' IDENTIFIED BY "radpass";
    mysql> flush privileges;
    mysql> use radius;
    mysql> SOURCE /etc/raddb/sql/mysql/schema.sql
    mysql> SOURCE /etc/raddb/sql/mysql/cui.sql
    mysql> SOURCE /etc/raddb/sql/mysql/ippool.sql
    mysql> SOURCE /etc/raddb/sql/mysql/nas.sql
    mysql> SOURCE /etc/raddb/sql/mysql/wimax.sql
复制代码

  4、配置Freeradius连接Mysql

复制代码
vim /etc/raddb/sql.conf
    # Connection info:
        server = "localhost"
        #port = 3306
        login = "radius"
        password = "radpass"

        # Database table configuration for everything except Oracle
        radius_db = "radius"
     #第108行
        readclients = yes
 
复制代码

  5、使用sql数据库里的nas表读取客户端信息

复制代码
vim /etc/raddb/radiusd.conf
    
    #$INCLUDE sql.conf

    修改后:
    $INCLUDE sql.conf
  
复制代码
复制代码
vim /etc/raddb/sites-available/default
    需要修改的行数及修改后的结果:例:#001行 line001
    #170行    #files
    #177    sql
    #396    #radutmp
    #397    sradutmp
    #406    sql
    #450    #radutmp
    #454    sql
    #475    sql
    #577    sql
复制代码
复制代码
vim /etc/raddb/sites-available/inner-tunnel
    #125    #file
    #132    sql
    #252    #radutmp
    #256    sql
    #278    sql
    #302    sql
复制代码

  修改密钥:

vim /etc/raddb/clients.conf
    secret = testing123

  6、添加测试用户:

mysql -uroot -p
    mysql> use radius;
    mysql> insert into radcheck (username,attribute,op,value) values ('test','User-Password',':=','test');
    mysql> flush privileges;
    mysql> exit;

  测试Freeradius+Mysql

  以Debug模式启动Freeradius:

radiusd -X

  另启一个窗口测试下:

复制代码
radtest test test 127.0.0.1 0 testing123

Sending Access-Request of id 71 to 127.0.0.1 port 1812
User-Name = “yzl”
User-Password = “yzl”
NAS-IP-Address = 127.0.0.1
NAS-Port = 0
Message-Authenticator = 0x00000000000000000000000000000000
rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=71, length=55
Reply-Message = “Hello yzl !”
Reply-Message = “Regexp match for PAP”

看到”Access-Accept“说明成功。

复制代码

  7、部署Daloradius

  a、安装LAMP环境:

yum -y install php-mysql php php-gd php-pear-DB httpd

  b、下载Daloradius

复制代码
  下载地址:http://jaist.dl.sourceforge.net/project/daloradius/daloradius/daloradius0.9-9/daloradius-0.9-9.tar.gz
    汉化版地址:http://pan.baidu.com/s/1c2h2h2K
    
    wget http://jaist.dl.sourceforge.net/project/daloradius/daloradius/daloradius0.9-9/daloradius-0.9-9.tar.gz
    tar xf daloradius-0.9-9.tar.gz
复制代码

  c、导入daloradius库文件

  mysql -uroot -p
    mysql> use radius;
    mysql> SOURCE /soft/daloradius-0.9-9/contrib/db/fr2-mysql-daloradius-and-freeradius.sql

  d、修改daloradius连接库文件:

复制代码
vi /soft/daloradius-0.9-9/library/daloradius.conf.php
    
    $configValues['DALORADIUS_VERSION'] = '0.9-9';
    $configValues['FREERADIUS_VERSION'] = '2';
    $configValues['CONFIG_DB_ENGINE'] = 'mysql';
    $configValues['CONFIG_DB_HOST'] = 'localhost';
    $configValues['CONFIG_DB_USER'] = 'radius';
    $configValues['CONFIG_DB_PASS'] = 'radpass';
    $configValues['CONFIG_DB_NAME'] = 'radius';
    $configValues['CONFIG_FILE_RADIUS_PROXY'] = '/etc/raddb/proxy.conf';
    $configValues['CONFIG_PATH_RADIUS_DICT'] = '/etc/raddb';
    $configValues['CONFIG_PATH_DALO_VARIABLE_DATA'] = '/var/www/html/daloradius/var';
    $configValues['CONFIG_LOG_FILE'] = '/var/www/html/daloradius/var/daloradius.log';
复制代码

  e、拷备文件至apache工作目录:/var/www/html

mv /tmp/daloradius-0.9-9 /var/www/html/daloradius

  f、创建日志文件:

touch /var/www/html/daloradius/var/daloradius.log

  g、赋权给apache:

chown -R apache:apache /var/www/html/daloradius

  h、修改redius日志文件:

vim /etc/raddb/radiusd.conf
    
    #file = ${logdir}/radius.log
    file = /var/log/radius.log

chmod 644 /var/log/messages
vim /var/www/html/daloradius/library/exten-radius_log.php
    $logfile_loc = array();
    $logfile_loc[1] = '/var/log/freeradius/radius.log';
    $logfile_loc[2] = '/usr/local/var/log/radius/radius.log';
    $logfile_loc[3] = '/var/log/radius/radius.log';
    $logfile_loc[4] = '/var/log/radius.log';

  i、将用户的同步会话限制为只有一个,新用户必须添加到用户组

vim /etc/raddb/sql/mysql/dialup.conf
    查找simul_count_query将290-293行注释去掉
mysql -uroot -p
    mysql> use radius;
    mysql> INSERT INTO radgroupcheck ( id , GroupName , Attribute , op , Value ) VALUES (NULL , 'users', 'Simultaneous-Use', ':=', '1');

  j、修改apache配置文件

vi /etc/httpd/conf/httpd.conf
ServerName x.x.x.x:80
注:x.x.x.x为你的本机ip或域名

  k、启动apache

复制代码
  service httpd start
    chkconfig httpd on
    service radiusd start
    chkconfig radiusd on
    iptables -I INPUT 5 -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
    /etc/init.d/iptables save
    /etc/init.d/iptables restart
    chmod 644 /var/log/radius.log
复制代码

可以使用web登录:

http://ip-address-or-hostname/daloradius
Username: administrator
Password: radius

三、StrongSwan和Freeradius整合:

  a、修改:/etc/strongswan.d/charon/eap-radius.conf

复制代码
vim /etc/strongswan.d/charon/eap-radius.conf
#开启在线人数查询
#第4行
accounting = yes
#第8行
accounting_close_on_timeout = yes
#查找server{}在这里添加以下内容
    #93行
    vpnserver {
        secret = testing123
        address = 127.0.0.1
    }
复制代码

  b、修改/etc/ipsec.conf

  #把所有的rightauth=
    rightauth=eap-radius

  c、重启服务

   ipsec stop
    ipsec start --nofork
    测试下看是否成功拨号;

四、Daloradius优化及设置计费

  1、Web汉化

  下载Daloradius汉化版:http://pan.baidu.com/s/1c2h2h2K 
将其中的main.conf、config-lang.conf做相应的替换;把zh-cn.conf上传到/var/www/html/daloradius/lang/ service httpd restart 然后在daloradius的管理页面中选择:config--language settings----Chinese---apply

  2、限制用户的每日总使用时间和登录时间:

vim /etc/raddb/radiusd.conf
    #将747行取消注释
    $INCLUDE sql/mysql/counter.conf
复制代码
vim /etc/raddb/sql/mysql/counter.conf
    #将60-63行加注释,然后添加以下
    
60 #       query = "SELECT SUM(acctsessiontime - \
61 #                 GREATEST((%b - UNIX_TIMESTAMP(acctstarttime)), 0)) \
62 #                 FROM radacct WHERE username = '%{%k}' AND \
63 #                 UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '%b'"
64         
65         query = "SELECT IFNULL(SUM(acctsessiontime - \
66                 GREATEST((%b - UNIX_TIMESTAMP(acctstarttime)), 0)),0) \
67                 FROM radacct WHERE username = '%{%k}' AND \
68                 UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '%b'"
复制代码
复制代码
vim /etc/raddb/sites-available/default
authorize {
    ...
#修改192,加上#
#daily
#在193行添加
dailycounter
#在462之后添加
post-auth {
    if(control:Auth-Type =~ /.*AP/){ 
        update reply { 
            Reply-Message := "Hello %{User-Name} !" 
            Reply-Message := "Regexp match for %{0}"
        } 
    } 
复制代码
vim /etc/raddb/dictionary
    #在最后添加以下:
    ATTRIBUTE       Daily-Session-Time      3000    integer
    ATTRIBUTE       Max-Daily-Session       3001    integer

  在mysql库创建相应的字段:

复制代码
mysql -uradius -p
    mysql> use radius;
    mysql> delete from radacct;
    mysql> INSERT INTO radgroupcheck ( id , GroupName , Attribute , op , Value ) VALUES (NULL , 'users', 'Max-Daily-Session', ':=', '28800'); # 28800 is seconds = 8h
    mysql> INSERT INTO radgroupcheck ( id , GroupName , Attribute , op , Value ) VALUES (NULL , 'users', 'Login-Time', ':=', 'Al0001-2359');
复制代码

  3、限制用户的每日和每月的数据使用和帐户到期

复制代码
vim /etc/raddb/sql/mysql/counter.conf
    #在最后添加以下:
    sqlcounter dailytrafficcounter {
        counter-name = Daily-Traffic
        check-name = Max-Daily-Traffic
        reply-name = Daily-Traffic-Limit
        sqlmod-inst = sql
        key = User-Name
        reset = daily
        query = "SELECT (SUM(AcctInputOctets + AcctOutputOctets)) FROM radacct WHERE UserName='%{%k}' AND UNIX_TIMESTAMP(AcctStartTime) > '%b'"
    }

    sqlcounter monthlytrafficcounter {
        counter-name = Monthly-Traffic
        check-name = Max-Monthly-Traffic
        reply-name = Monthly-Traffic-Limit
        sqlmod-inst = sql
        key = User-Name
        reset = monthly
        query = "SELECT (SUM(AcctInputOctets + AcctOutputOctets)) FROM radacct WHERE UserName='%{%k}' AND UNIX_TIMESTAMP(AcctStartTime) > '%b'"
    }
复制代码
vim /etc/raddb/dictionary
    #在最后添加以下:
    ATTRIBUTE       Max-Daily-Traffic       3002    integer
    ATTRIBUTE       Daily-Traffic-Limit     3003    integer
    ATTRIBUTE       Max-Monthly-Traffic     3004    integer
    ATTRIBUTE       Monthly-Traffic-Limit   3005    integer
vim /etc/raddb/sites-available/default
    #在193行之后添加
    dailytrafficcounter
    monthlytrafficcounter

  在mysql库创建相应的字段:

复制代码
mysql -uroot -p
    mysql> use radius;
    mysql> delete from radacct;
    mysql> INSERT INTO radgroupcheck ( id , GroupName , Attribute , op , Value ) VALUES (NULL , 'users', 'Max-Monthly-Traffic', ':=', '1073741824'); # 1073741824 bytes=1024*1024*1024 bytes=1 Gbyte, 填写时以byte为单位 每月最大流量1G
    mysql> INSERT INTO radgroupcheck ( id , GroupName , Attribute , op , Value ) VALUES (NULL , 'users', 'Max-Daily-Traffic', ':=', '104857600'); # 104857600 bytes=100*1024*1024=100 Mbyte 每天最大流量为100M
    mysql> INSERT INTO radgroupcheck ( id , GroupName , Attribute , op , Value ) VALUES (NULL , 'users', 'Expiration', ':=', '1 Oct 2017'); # 设定账号过期
    
    service radiusd restart
复制代码

到此,所有的都已经部署完毕了!祝你成功!

如有问题可在下方回复!

发表评论

电子邮件地址不会被公开。 必填项已用*标注