5154

CentOS StrongSwan 配置指南

环境准备

在开始配置StrongSwan之前,请确保您的CentOS系统已安装以下软件包：

1. 安装OpenVPN软件包

   sudo yum install openvpn

2. 安装EAP-TLS软件包

   sudo yum install openvpn-eap-tls

3. 安装IPsec软件包

   sudo yum install strongswan

生成CA证书

1. 创建CA目录

   sudo mkdir -p /etc/openvpn/eap-tls/keys

2. 创建CA私钥

   

   sudo openssl genpkey -algorithm RSA -out /etc/openvpn/eap-tls/keys/ca.key -pkeyopt rsa_keygen_bits:2048

3. 创建CA证书

   sudo openssl req -x509 -new -nodes -key /etc/openvpn/eap-tls/keys/ca.key -days 3650 -out /etc/openvpn/eap-tls/keys/ca.crt

4. 设置证书权限

   sudo chmod 600 /etc/openvpn/eap-tls/keys/ca.crt
   sudo chmod 600 /etc/openvpn/eap-tls/keys/ca.key

生成客户端证书

1. 创建客户端目录

   sudo mkdir -p /etc/openvpn/eap-tls/keys/client

2. 创建客户端私钥

   sudo openssl genpkey -algorithm RSA -out /etc/openvpn/eap-tls/keys/client/client.key -pkeyopt rsa_keygen_bits:2048

3. 创建客户端证书请求

   sudo openssl req -new -key /etc/openvpn/eap-tls/keys/client/client.key -out /etc/openvpn/eap-tls/keys/client/client.csr

4. 设置证书请求内容

   Country Name (2 letter code) [XX]:CN
   State or Province Name (full name) [Some-State]:Beijing
   Locality Name (city) [Default City]:Beijing
   Organization Name (e.g., company) [Default Company Ltd]:Your Company
   Organizational Unit Name (e.g., section) [Default Unit]:IT Department
   Common Name (e.g., your name or your server's hostname) []:Client
   Email Address []:your_email@example.com

5. 签发客户端证书

   

   sudo openssl ca -in /etc/openvpn/eap-tls/keys/client/client.csr -out /etc/openvpn/eap-tls/keys/client/client.crt -config /etc/openvpn/eap-tls/keys/ca.cnf

配置StrongSwan

1. 创建强Swan配置文件

   sudo vi /etc/strongswan/strongswan.conf

2. 编辑配置文件,添加以下内容：

charon {
    charondebug="ike 2 knl 2 cfg 2 net 2 pluto 2";
    # ...
    ikelifetime=60m
    keylife=20m
    rekeymargin=3m
    keyingtries=1
    authby=secret
    # ...
    plugins {
        # ...
        include /etc/strongswan/ipsec.conf
    }
}
# IPsec配置
config setup {
    charondebug="ike 2 knl 2 cfg 2 net 2 pluto 2";
    # ...
    ikelifetime=60m
    keylife=20m
    rekeymargin=3m
    keyingtries=1
    authby=secret
    # ...
    conn %default {
        ikelifetime=60m
        keylife=20m
        rekeymargin=3m
        keyingtries=1
        authby=secret
        # ...
        conn %openvpn {
            left=%defaultroute
            leftsubnet=0.0.0.0/0
            leftauth=psk
            right=%any
            rightdns=%any
            rightauth=eap-tls
            rightsourceip=%config
            # ...
        }
    }
}

3. 设置强Swan配置文件权限

   sudo chmod 600 /etc/strongswan/strongswan.conf

启动强Swan服务

sudo systemctl start strongswan
sudo systemctl enable strongswan

FAQs：

为什么我的客户端无法连接到服务器？ 答：请检查以下问题：

• 确保服务器和客户端之间的网络连接正常。
• 检查客户端证书是否正确导入到客户端的OpenVPN配置文件中。
• 确保服务器上的CA证书已正确导入到客户端的OpenVPN配置文件中。

2. 如何查看强Swan日志？ 答：可以使用以下命令查看强Swan日志：

   sudo tail -f /var/log/strongswan.log