{"id":457,"date":"2012-12-24T16:09:32","date_gmt":"2012-12-24T14:09:32","guid":{"rendered":"http:\/\/bos-info.com\/?p=457"},"modified":"2012-12-24T16:22:05","modified_gmt":"2012-12-24T14:22:05","slug":"vpn-%d1%87%d0%b0%d1%81%d1%82%d1%8c-1-ipsecl2tp-%d1%81%d0%b5%d1%80%d1%82%d0%b8%d1%84%d0%b8%d0%ba%d0%b0%d1%82%d1%8b-%d0%bc%d0%b5%d0%b6%d0%b4%d1%83-%d0%b4%d0%b2%d1%83%d0%bc%d1%8f-freebsd-9-0","status":"publish","type":"post","link":"https:\/\/bos-info.com\/?p=457","title":{"rendered":"VPN \u0447\u0430\u0441\u0442\u044c 1: IPSec\/L2TP + \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u044b \u043c\u0435\u0436\u0434\u0443 \u0434\u0432\u0443\u043c\u044f FreeBSD 9.0"},"content":{"rendered":"

\u0417\u0430\u0434\u0430\u0447\u0430: 2 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 FreeBSD 9.0 RELEASE, \u043c\u0435\u0436\u0434\u0443 \u043d\u0438\u043c\u0438 \u043d\u0443\u0436\u043d\u043e \u043f\u043e\u0434\u043d\u044f\u0442\u044c \u0442\u0443\u043d\u043d\u0435\u043b\u044c IPSec\/L2TP
\n\u0418\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b: \/usr\/ports\/security\/ipsec-tools (racoon)
\n\/usr\/ports\/net\/mpd5<\/code>
\n
\n\u0414\u043b\u044f \u043d\u0430\u0447\u0430\u043b\u0430 \u043d\u0443\u0436\u043d\u043e \u0441\u043e\u0431\u0440\u0430\u0442\u044c \u044f\u0434\u0440\u043e \u0441 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u043e\u0439 IPSEC. \u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0441\u0431\u043e\u0440\u043a\u0438 \u044f\u0434\u0440\u0430 \u0435\u0441\u0442\u044c \u0432 \u0434\u0440\u0443\u0433\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u043d\u0430 \u044d\u0442\u043e\u043c \u0441\u0430\u0439\u0442\u0435, \u043f\u0435\u0440\u0435\u0447\u0438\u0441\u043b\u044e \u0442\u043e\u043b\u044c\u043a\u043e, \u0447\u0442\u043e \u043d\u0443\u0436\u043d\u043e \u0434\u043e\u0431\u0430\u0432\u0438\u0442\u044c:
\n
\noptions IPSEC #IP security
\noptions IPSEC_NAT_T
\ndevice crypto
\ndevice enc
\noptions IPSEC_DEBUG #debug for IP security
\n<\/code>
\n\u0423 \u043c\u0435\u043d\u044f \u0447\u0435\u0440\u0435\u0437 \u043d\u0430\u0442 \u043d\u0435 \u0437\u0430\u0432\u0435\u043b\u043e\u0441\u044c, \u0447\u0435\u043a\u0441\u0443\u043c\u043c\u044b \u0431\u0431\u044e\u0442\u0441\u044f, \u043c\u043e\u0436\u0435\u0442 \u043a\u043e\u0433\u0434\u0430 \u0435\u0449\u0435 \u0431\u0443\u0434\u0443 \u044d\u0442\u043e \u0434\u0435\u043b\u043e \u0438\u0437\u0443\u0447\u0430\u0442\u044c. \u0410 \u043c\u043e\u0436\u0435\u0442 \u0438 \u043d\u0435 \u0431\u0443\u0434\u0443 \ud83d\ude42 \u041d\u043e \u0432 \u044f\u0434\u0440\u043e \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u044e \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0443 \u0432\u043a\u043e\u043c\u043f\u0438\u043b\u0438\u0442\u044c, \u043d\u0430 \u0432\u0441\u044f\u043a\u0438\u0439 \u043f\u043e\u0436\u0430\u0440\u043d\u044b\u0439.
\n\u0414\u0430\u043b\u0435\u0435 \u043e\u0431\u0438\u0440\u0430\u0435\u043c \u0438\u0437 \u043f\u043e\u0440\u0442\u043e\u0432 \u0440\u0430\u043a\u0443\u043d\u0430 \u0438 \u043c\u043f\u0434.
\n\u0415\u0441\u043b\u0438 \u0445\u043e\u0447\u0435\u0442\u0441\u044f, \u0447\u0442\u043e\u0431\u044b \u043f\u0440\u0435\u0448\u0430\u0440\u0435\u0434-\u043a\u0435\u0439 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u043c\u043e\u0436\u043d\u043e \u0431\u044b\u043b\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u043b\u044f \u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u0441 \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u0438\u043c \u0438\u043f\u043e\u043c, \u043d\u0430\u0445\u043e\u0434\u0438\u043c \u0432 \u0441\u043e\u0440\u0446\u0430\u0445 \u0440\u0430\u043a\u0443\u043d\u0430 \u0444\u0430\u0439\u043b .\/src\/racoon\/localconf.c, \u043e\u043a\u043e\u043b\u043e 210 \u0441\u0442\u0440\u043e\u043a\u0438 \u0438\u0449\u0435\u043c
\n if (strncmp(buf, str, len) == 0 && buf[len] == '') {<\/code>,
\n\u043a\u043e\u043c\u043c\u0435\u043d\u0442\u0438\u0440\u0443\u0435\u043c \u0438 \u0437\u0430\u043c\u0435\u043d\u044f\u0435\u043c \u043d\u0430:
\n if (strcmp(buf, \"*\") == 0 || (strncmp(buf, str, len) == 0 && buf[len] == '')) {<\/code>
\n\u041f\u043e\u0441\u043b\u0435 \u0432 \u0444\u0430\u0439\u043b\u0435 psk.txt \u043c\u043e\u0436\u043d\u043e \u0443\u043a\u0430\u0437\u0430\u0442\u044c \u0442\u0430\u043a:
\n* my_secret_key<\/code>
\n\u0414\u0430\u043b\u0435\u0435 \u0443\u0433\u043b\u0443\u0431\u043b\u044f\u0442\u044c\u0441\u044f \u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 PSK \u043d\u0435 \u0431\u0443\u0434\u0435\u043c, \u0442.\u043a. \u043e\u0442 \u043b\u0443\u043a\u0430\u0432\u043e\u0433\u043e \u044d\u0442\u043e. \u041d\u0435\u0445\u043e\u0440\u043e\u0448\u043e \u0432\u0441\u0435\u0445 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 \u043e\u0434\u043d\u0438\u043c \u043a\u043b\u044e\u0447\u0435\u043c \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u043e\u0432\u0430\u0442\u044c, \u0430 \u0441\u0442\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u0430\u0434\u0440\u0435\u0441\u0430 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 \u0432 \u043c\u043e\u0438\u0445 \u043a\u0440\u0430\u044f\u0445 \u0440\u0435\u0434\u043a\u043e\u0441\u0442\u044c. (\u043f\u0440\u0438\u043c. \u0411\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e \u0441\u0442\u0430\u0442\u0435\u0439 \u0432 \u0433\u0443\u0433\u043b\u0435 \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u044b\u0432\u0430\u044e\u0442 \u0438\u043c\u0438\u043d\u043d\u043e \u043e \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0435 \u0440\u0430\u043a\u0443\u043d\u0430 \u0441 PSK, \u0438\u0431\u043e \u044d\u0442\u043e \u043f\u0440\u043e\u0449\u0435)
\n\u0414\u0430\u043b\u0435\u0435 \u0432 \u043c\u043f\u0434 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u0435\u043c \u0442\u0430\u043a\u043e\u0435:
\ndefault:
\n\tload l2tp_server
\nl2tp_server:
\n\tset ippool add pool-l2tp 10.10.17.10 10.10.17.20
\n\tcreate bundle template L2TP-B
\n\tset iface idle 0
\n\tset iface enable tcpmssfix
\n\tset ipcp ranges 10.10.17.254\/24 ippool pool-l2tp
\n\tcreate link template L2TP-L l2tp
\n\tset link action bundle L2TP-B
\n\tset link enable multilink
\n\tset link yes acfcomp protocomp
\n\tset link no pap chap eap
\n\tset link enable chap
\n\tset link keep-alive 10 60
\n\tload radius
\n\tset link mtu 1460
\n\tset l2tp self 0.0.0.0
\n\tset link enable incoming
\n<\/code>
\n\u0422\u0443\u0442 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u044f \u043f\u043e \u0440\u0430\u0434\u0438\u0443\u0441\u0443, \u0435\u0441\u043b\u0438 \u043d\u0435\u0442\u0443, \u0443\u0431\u0438\u0440\u0430\u0435\u043c \u0441\u0442\u0440\u043e\u0447\u043a\u0443.
\n\u041a\u043b\u0438\u0435\u043d\u0442\u0430 \u043f\u0440\u043e\u0441\u0438\u043c \u043b\u043e\u043c\u0438\u0442\u044c\u0441\u044f \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440, \u043d\u0430 \u043f\u043e\u0440\u0442 1701 (L2TP):
\ndefault:
\n\tload pptp_server
\n\tload l2tp_client
\nl2tp_client:
\n\tcreate bundle static L2TPB
\n\tcreate link static L2TPL l2tp
\n\tset link action bundle L2TPB
\n\tset auth authname user
\n\tset auth password password
\n\tset link max-redial 0
\n\tset link mtu 1460
\n\tset link keep-alive 20 75
\n\tset l2tp peer 192.168.55.1 \/\/\u0430\u0434\u0440\u0435\u0441 \u0441\u0435\u0440\u0432\u0435\u0440\u0430
\n\topen
\n<\/code>
\n\u041c\u043e\u0436\u043d\u043e \u043d\u0430 \u044d\u0442\u043e\u043c \u044d\u0442\u0430\u043f\u0435 \u043f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c, \u0447\u0442\u043e\u0431\u044b MPD \u0434\u0440\u0443\u0433 \u043d\u0430 \u0434\u0440\u0443\u0433\u0430 \u043a\u043e\u043d\u043d\u0435\u043a\u0442\u0438\u043b\u0438\u0441\u044c, \u043f\u043e\u0442\u043e\u043c \u043c\u0435\u043d\u044c\u0448\u0435 \u0431\u0443\u0434\u0435\u0442 \u043d\u0435\u043f\u043e\u043d\u044f\u0442\u043e\u043a.
\n\u041a\u043e\u0433\u0434\u0430 \u044d\u0442\u043e \u0441\u0434\u0435\u043b\u0430\u043d\u043e, \u043d\u0430\u0447\u0438\u043d\u0430\u0435\u043c \u043d\u0430\u0441\u0442\u0440\u0430\u0438\u0432\u0430\u0442\u044c IPSEC.
\n\/etc\/rc.conf (\u043d\u0430 \u043e\u0431\u043e\u0438\u0445 \u043c\u0430\u0448\u0438\u043d\u0430\u0445):
\nmpd_enable=\"YES\"
\nmpd_flags=\"-b\"<\/p>\n

ipsec_enable=\"YES\" # \u0434\u0430, \u044d\u0442\u043e \u043d\u0430\u0434\u043e, \u0445\u043e\u0442\u044f \u0432 rc.d \u043d\u0435\u0442 \u0442\u0430\u043a\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430
\nipsec_program=\"\/usr\/local\/sbin\/setkey\"
\nipsec_file=\"\/usr\/local\/etc\/racoon\/setkey.conf\" # \u043a\u043e\u043d\u0444\u0438\u0433 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u044f\u0435\u0442, \u043a\u0430\u043a\u043e\u0439 \u0442\u0440\u0430\u0444\u0438\u043a \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u0442\u044c
\nracoon_enable=\"yes\" #\u0432\u043a\u043b\u044e\u0447\u0430\u0435\u043c \u0442\u0430\u043a\u0436\u0435 \u0435\u043d\u043e\u0442\u0430
\n<\/code>
\n\u0414\u0430\u043b\u0435\u0435 \u043a\u043e\u043d\u0444\u0438\u0433\u0438 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u0432 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0435 \u0435\u043d\u043e\u0442\u0430 \/usr\/local\/etc\/racoon (\u0441\u043e\u0437\u0434\u0430\u0435\u043c)
\n\u0414\u0435\u043b\u0430\u0435\u043c \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0438
\n\/usr\/local\/etc\/racoon\/cert
\n\/usr\/local\/etc\/racoon\/cert\/ca
\n\/usr\/local\/etc\/racoon\/cert\/client <- \u0442\u0443\u0442 \u043a\u043b\u044e\u0447\u0438 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432
\n\/usr\/local\/etc\/racoon\/cert\/server <- \u0442\u0443\u0442 \u043a\u043b\u044e\u0447\u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430<\/p>\n

\u0444\u0430\u0439\u043b \/usr\/local\/etc\/racoon\/setkey.conf:
\nflush;
\nspdflush;
\n# L2TP in
\nspdadd 192.168.55.1\/0[1701] 0.0.0.0\/0 any -P out ipsec esp\/transport\/\/use;
\nspdadd 0.0.0.0\/0 192.168.55.1\/0[1701] any -P in ipsec esp\/transport\/\/use;
\n<\/code>
\n\u041d\u0435\u043c\u043d\u043e\u0433\u043e \u043f\u043e\u044f\u0441\u043d\u0435\u043d\u0438\u0439:
\n1) \u043e\u0447\u0438\u0449\u0430\u0435\u043c \u0432\u0441\u0435, \u0434\u0430\u043b\u0435\u0435 \u0447\u0442\u043e \u0448\u0438\u0444\u0440\u0443\u0435\u043c:
\n2) \u0441 \u043d\u0430\u0448\u0435\u0433\u043e \u0430\u0434\u0440\u0435\u0441\u0430, \u043f\u043e\u0440\u0442\u0430 1701, \u043d\u0430 \u043b\u044e\u0431\u043e\u0439 \u0430\u0434\u0440\u0435\u0441, \u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0438\u0441\u0445\u043e\u0434\u044f\u0449\u0435\u0435 (out), \u0440\u0435\u0436\u0438\u043c \u0442\u0440\u0430\u043d\u0441\u043f\u043e\u0440\u0442\u0430
\n2) \u0441 \u043b\u044e\u0431\u043e\u0433\u043e \u0430\u0434\u0440\u0435\u0441\u0430 \u043d\u0430 \u043d\u0430\u0448 \u0430\u0434\u0440\u0435\u0441, \u043f\u043e\u0440\u0442 1701, \u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0432\u0445\u043e\u0434\u044f\u0449\u0435\u0435 (in), \u0440\u0435\u0436\u0438\u043c \u0442\u0440\u0430\u043d\u0441\u043f\u043e\u0440\u0442\u0430
\n\u041f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f \u0444\u0430\u0439\u043b \u043f\u0440\u0438 \u043f\u0435\u0440\u0435\u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0435 \u043b\u0438\u0431\u043e, \u0447\u0442\u043e \u0443\u0434\u043e\u0431\u043d\u0435\u0435, \u043a\u043e\u043c\u0430\u043d\u0434\u043e\u0439:
\nsetkey -f \/usr\/local\/etc\/racoon\/setkey.conf<\/code>
\n\u041d\u0430 \u043a\u043b\u0438\u0435\u043d\u0442\u0435 \u0434\u0435\u043b\u0430\u0435\u043c \u043d\u0430\u043e\u0431\u043e\u0440\u043e\u0442 \u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0435 \u0438 \u0438\u0441\u0445\u043e\u0434\u044f\u0449\u0438\u0435:
\n
\nflush;
\nspdflush;
\nspdadd 0.0.0.0\/0[0] 192.168.55.1\/32[1701] udp -P out ipsec esp\/transport\/\/require;
\nspdadd 192.168.55.1\/32[1701] 0.0.0.0\/0[0] udp -P in ipsec esp\/transport\/\/require;
\n<\/code>
\nL2TP\/IPSec \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0447\u0435\u0440\u0435\u0437 \u0440\u0435\u0436\u0438\u043c \u0442\u0440\u0430\u043d\u0441\u043f\u043e\u0440\u0442\u0430, \u0435\u0441\u043b\u0438 \u0447\u0442\u043e.
\n\u0412\u0442\u043e\u0440\u043e\u0439 \u0444\u0430\u0439\u043b \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 racoon.conf:
\n
\n# \"path\" affects \"include\" directives. \"path\" must be specified before any
\n# \"include\" directive with relative file path.
\n# you can overwrite \"path\" directive afterwards, however, doing so may add
\n# more confusion.
\npath include \"\/usr\/local\/etc\/racoon\";<\/p>\n

# the file should contain key ID\/key pairs, for pre-shared key authentication.
\npath pre_shared_key \"\/usr\/local\/etc\/racoon\/psk.txt\";<\/p>\n

# racoon will look for certificate file in the directory,
\n# if the certificate\/certificate request payload is received.
\n# !!!! \u0443\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u043c, \u043e\u0442\u043a\u0443\u0434\u0430 \u0431\u0440\u0430\u0442\u044c \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u044b
\npath certificate \"\/usr\/local\/etc\/racoon\/cert\";<\/p>\n

# \"log\" specifies logging level. It is followed by either \"notify\", \"debug\"
\n# or \"debug2\".
\n# \u0434\u043b\u044f \u043e\u0442\u043b\u0430\u0434\u043a\u0438, \u043f\u043e\u0442\u043e\u043c \u0436\u0435\u043b\u0430\u0442\u0435\u043b\u044c\u043d\u043e \u0443\u0431\u0440\u0430\u0442\u044c
\nlog debug2;<\/p>\n

# \"padding\" defines some padding parameters. You should not touch these.
\npadding
\n{
\n\tmaximum_length 20;\t# maximum padding length.
\n\trandomize off;\t\t# enable randomize length.
\n\tstrict_check off;\t# enable strict check.
\n\texclusive_tail off;\t# extract last one octet.
\n}<\/p>\n

# if no listen directive is specified, racoon will listen on all
\n# available interface addresses.
\nlisten
\n{
\n\t#isakmp ::1 [7000];
\n # \u0430\u0434\u0440\u0435\u0441, \u043d\u0430 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0441\u043b\u0443\u0448\u0430\u0435\u0442 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b ISAKMP (\u0441\u043e\u0433\u043b\u0430\u0441\u043e\u0432\u0430\u043d\u0438\u0435 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043e\u0432 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f)
\n\tisakmp 192.168.55.1 [500];
\n # \u044d\u0442\u043e \u043f\u043e\u043d\u0430\u0434\u043e\u0431\u0438\u0442\u0441\u044f \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b NAT-T
\n\tisakmp_natt 192.168.55.1 [4500];
\n}<\/p>\n

# Specify various default timers.
\ntimer
\n{
\n\t# These value can be changed per remote node.
\n\tcounter 5;\t\t# maximum trying count to send.
\n\tinterval 20 sec;\t# maximum interval to resend.
\n\tpersend 1;\t\t# the number of packets per send.<\/p>\n

\t# maximum time to wait for completing each phase.
\n\tphase1 30 sec;
\n\tphase2 15 sec;
\n}<\/p>\n

# \u0441\u0435\u043a\u0446\u0438\u044f \u043f\u0440\u0438\u0435\u043c\u0430 \u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0445 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439 \u0441 \u043b\u044e\u0431\u043e\u0433\u043e \u0430\u0434\u0440\u0435\u0441\u0430
\nremote anonymous
\n{
\n\texchange_mode main,aggressive;
\n\tlifetime time 24 hour;
\n\tdoi ipsec_doi;
\n\tsituation identity_only;
\n generate_policy on;
\n # \u043f\u043e\u0441\u044b\u043b\u0430\u0435\u043c \u043a\u0438\u043f\u044d\u043b\u0430\u0439\u0432\u044b
\n\tdpd_delay 10;
\n\tdpd_retry 5;
\n\tdpd_maxfail 5;<\/p>\n

# !!! \u044d\u0442\u043e \u0432\u0430\u0436\u043d\u043e \u0434\u043b\u044f \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432, \u0441 \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u043e\u043c \"\u0430\u0434\u0440\u0435\u0441\" \u0440\u0430\u0431\u043e\u0442\u0430\u0442\u044c \u043d\u0435 \u0431\u0443\u0434\u0435\u0442
\n\tmy_identifier asn1dn ;
\n peers_identifier asn1dn ;<\/p>\n

# \u0443\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u043c \u043d\u0430\u0448\u0438 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u044b
\n\tcertificate_type x509 \"server\/server.crt\" \"server\/server.key\";
\n\tca_type x509 \"ca\/ca.crt\";<\/p>\n

\tnonce_size 16;
\n\tinitial_contact on;
\n\tproposal_check strict;\t# obey, strict, or claim<\/p>\n

# \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u044b \u0444\u0430\u0437\u044b 1 (ISAKMP SA)
\n\tproposal {
\n\t\tencryption_algorithm aes;
\n\t\thash_algorithm sha1;
\n\t\tauthentication_method rsasig;
\n\t\tdh_group 2;
\n\t}
\n}<\/p>\n

# \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u044b \u0444\u0430\u0437\u044b 2 (IPSec SA)
\nsainfo anonymous
\n{
\n\tpfs_group 2;
\n\tencryption_algorithm aes 256, aes, 3des;
\n\tauthentication_algorithm hmac_sha1;
\n\tcompression_algorithm deflate;
\n\tlifetime time 24 hour;
\n}<\/p>\n

<\/code>
\n\u041d\u0430 \u043a\u043b\u0438\u0435\u043d\u0442\u0435 \u043e\u0442\u0432\u0435\u0442\u043d\u0430\u044f \u0447\u0430\u0441\u0442\u044c \u0442\u0430\u043a\u0430\u044f:
\npath certificate \"\/usr\/local\/etc\/racoon\/cert\";
\npath pre_shared_key \"\/usr\/local\/etc\/racoon\/psk.txt\"; <\/p>\n

log debug;<\/p>\n

padding {
\n\tmaximum_length 20;
\n randomize off;
\n strict_check off;
\n exclusive_tail off;
\n }<\/p>\n

listen {
\n adminsock \"\/var\/db\/racoon\/racoon.sock\";
\n\t}<\/p>\n

timer {
\n counter 5;
\n interval 20 sec;
\n persend 1;
\n phase1 30 sec;
\n phase2 15 sec;
\n }<\/p>\n

remote 192.168.55.1 {
\n exchange_mode main,aggressive;
\n lifetime time 24 hour;
\n # \u043d\u0435 \u0437\u0430\u0431\u044b\u0432\u0430\u0435\u043c
\n\tmy_identifier asn1dn ;
\n\tpeers_identifier asn1dn ;
\n passive off;
\n generate_policy off;
\n # \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u0442\u044c \u0441\u0435\u0440\u0432\u0435\u0440 \u043d\u0430 \u0432\u0448\u0438\u0432\u043e\u0441\u0442\u044c \u043d\u0435 \u0431\u0443\u0434\u0435\u043c
\n verify_cert off;
\n send_cert on;
\n send_cr on;
\n # \u0443\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u043c \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u044b \u043a\u043b\u0438\u0435\u043d\u0442\u0430, \u043f\u043e\u0434\u043f\u0438\u0441\u0430\u043d\u043d\u044b\u0435 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435
\n certificate_type x509 \"user.crt\" \"user.key\";
\n proposal {
\n encryption_algorithm aes;
\n hash_algorithm sha1;
\n authentication_method rsasig;
\n dh_group 2;
\n }
\n }<\/p>\n

sainfo anonymous {
\n\tpfs_group 2;
\n encryption_algorithm aes 256, aes, 3des;
\n authentication_algorithm hmac_sha1, hmac_md5;
\n lifetime time 1 hour ;
\n compression_algorithm deflate;
\n }
\n<\/code>
\n\u0422\u0435\u043f\u0435\u0440\u044c \u043f\u043e\u0440\u0430 \u043f\u0435\u0440\u0435\u0439\u0442\u0438 \u0441\u043e\u0431\u0441\u0442\u0432\u0435\u043d\u043d\u043e \u043a \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430\u043c. \u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0441\u044f \u044d\u0442\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0435\u0439:
\nhttp:\/\/www.lissyara.su\/articles\/freebsd\/security\/ipsec2\/
\n\u0412 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0435 \/usr\/local\/etc\/racoon\/cert \u0441\u043e\u0437\u0434\u0430\u0435\u043c \u0444\u0430\u0439\u043b
\nopenssl.cnf
\n
\n# Establish working directory.
\ndir = . <\/p>\n

HOME = .
\nRANDFILE = $ENV::HOME\/.rnd<\/p>\n

[ ca ]
\ndefault_ca = CA_default<\/p>\n

[ CA_default ]
\nserial = $dir\/ca\/serial
\ndatabase = $dir\/ca\/index.txt
\n# for crl
\n# the current crl number
\ncrlnumber = $dir\/ca\/crlnumber
\ncrl = $dir\/ca\/crl.pem # The current CRL
\ndefault_md = sha1 # which md to use.
\ndefault_crl_days = 1095 # how long before next CRL.
\nprivate_key = $dir\/ca\/ca.key # The private key
\ncertificate = $dir\/ca\/ca.crt<\/p>\n

[ req ]
\ndistinguished_name = req_distinguished_name<\/p>\n

[ req_distinguished_name ]
\ncountryName = Country Name (2 letter code)
\ncountryName_default = UA
\ncountryName_min = 2
\ncountryName_max = 2<\/p>\n

stateOrProvinceName = State or Province Name (full name)
\nstateOrProvinceName_default = Oblast<\/p>\n

localityName = Locality Name (eg, city)
\nlocalityName_default = Gorod<\/p>\n

0.organizationName = Organization Name (eg, company)
\n0.organizationName_default = Firma<\/p>\n

# we can do this but it is not needed normally :-)
\n#1.organizationName = Second Organization Name (eg, company)
\n#1.organizationName_default = World Wide Web Pty Ltd<\/p>\n

organizationalUnitName = Organizational Unit Name (eg, section)
\norganizationalUnitName_default = IT<\/p>\n

commonName = Common Name (eg, YOUR name)
\ncommonName_max = 64
\ncommonName_default = Admin<\/p>\n

emailAddress = Email Address
\nemailAddress_max = 64
\nemailAddress_default = e@mail.ru<\/p>\n

# include a prompt for alternative names\u0432\u00a6
\nsubjectAltName = Alternative DNS names (comma seperated list)
\nsubjectAltName_default = DNS:domain.com
\n<\/code>
\n\u0417\u0430\u043f\u043e\u043b\u043d\u044f\u0435\u043c \u0432 \u044d\u0442\u043e\u043c \u0444\u0430\u0439\u043b\u0435 _default, \u0447\u0442\u043e\u0431\u044b \u043d\u0435 \u0432\u0432\u043e\u0434\u0438\u0442\u044c \u043a\u0430\u0436\u0434\u044b\u0439 \u0440\u0430\u0437.
\n\u0414\u0430\u043b\u044c\u0448\u0435 \u0434\u0435\u043b\u0430\u0435\u043c 2 \u0441\u043a\u0440\u0438\u043f\u0442\u0430. \u041f\u0435\u0440\u0432\u044b\u0439
\ngenerate-server.sh
\n
\n#!\/bin\/sh
\nopenssl genrsa -aes256 -out ca\/ca.key 2048 -config openssl.cnf
\nopenssl req -new -x509 -days 1095 -key ca\/ca.key -out ca\/ca.crt -config openssl.cnf
\nopenssl genrsa -out server\/server.key 2048 -config openssl.cnf
\nopenssl req -new -key server\/server.key -out server\/server.csr -config openssl.cnf
\nopenssl x509 -req -days 365 -in server\/server.csr -CA ca\/ca.crt -CAkey ca\/ca.key -CAcreateserial -out server\/server.crt
\n<\/code>
\n\u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u043c \u0431\u0435\u0437 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043e\u0432, \u043e\u0442\u0432\u0435\u0447\u0430\u0435\u043c \u043d\u0430 \u0432\u043e\u043f\u0440\u043e\u0441\u044b, \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u043c \u043a\u043b\u044e\u0447\u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430. \u041f\u043e\u0441\u043b\u0435 \u044d\u0442\u043e\u0433\u043e, \u0435\u0441\u043b\u0438 \u0431\u044b\u043b\u0438 \u0441\u0433\u0435\u043d\u0435\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u043a\u043b\u0438\u0435\u043d\u0442\u0441\u043a\u0438\u0435 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u044b, \u0438\u0445 \u043f\u0440\u0438\u0434\u0435\u0442\u0441\u044f \u043f\u0435\u0440\u0435\u0433\u0435\u043d\u0435\u0440\u0438\u0440\u043e\u0432\u0430\u0442\u044c!!!
\n\u0412\u0442\u043e\u0440\u043e\u0439 \u0441\u043a\u0440\u0438\u043f\u0442:
\ngenerate-client.sh
\n
\n#!\/bin\/sh
\nopenssl genrsa -out client\/$1.key 2048 -config .\/openssl.cnf
\nopenssl req -new -key client\/$1.key -out client\/$1.csr -config .\/openssl.cnf
\nopenssl x509 -req -days 365 -in client\/$1.csr -CA ca\/ca.crt -CAkey ca\/ca.key -CAcreateserial -out client\/$1.crt
\n<\/code>
\n\u0412\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u043c
\ngenerate-client.sh user<\/code>
\n\u043e\u0442\u0432\u0435\u0447\u0430\u0435\u043c \u043d\u0430 \u0432\u043e\u043f\u0440\u043e\u0441\u044b, \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u043c \u043a\u043b\u044e\u0447\u0438 \u044e\u0437\u0435\u0440\u0430.
\n\u0422\u0435\u043f\u0435\u0440\u044c \u043a\u043e\u043f\u0438\u0440\u0443\u0435\u043c user.crt \u0438 user.key \u0438\u0437 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430 client \u043d\u0430 \u043a\u043b\u0438\u0435\u043d\u0442\u0441\u043a\u0443\u044e \u043c\u0430\u0448\u0438\u043d\u0443, \u0432 \u043a\u0430\u0442\u0430\u043b\u043e\u0433 \/usr\/local\/etc\/racoon\/cert
\n\u0422\u0430\u043a\u043e\u0435 \u043f\u0440\u043e\u0434\u0435\u043b\u044b\u0432\u0430\u0435\u043c \u0434\u043b\u044f \u043a\u0430\u0436\u0434\u043e\u0433\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u043f\u043e\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u044f \u0432\u043c\u0435\u0441\u0442\u043e user \u0438\u043c\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f.
\n\u041d\u0430\u043f\u043e\u0441\u043b\u0435\u0434\u043e\u043a:
\n\/etc\/syslog.conf
\n...
\n!mpd
\n*.*\t\t\t\t\t\t\/var\/log\/mpd.log
\n!racoon
\n*.*\t\t\t\t\t\t\/var\/log\/racoon.log
\n...
\n<\/code>
\n\/etc\/newsyslog.conf
\n
\n...
\n\/var\/log\/mpd.log\t\t\t600 10\t 100\t* JC
\n\/var\/log\/racoon.log\t\t\t600 10\t 100\t* JC
\n...
\n<\/code>
\n\u041f\u0435\u0440\u0435\u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u043c \u0441\u0438\u0441\u043b\u043e\u0433, \u043d\u044c\u044e\u0441\u0438\u0441\u043b\u043e\u0433, \u0435\u043d\u043e\u0442\u0430 \u043d\u0430 \u043e\u0431\u043e\u0438\u0445 \u043c\u0430\u0448\u0438\u043d\u0430\u0445, \u043f\u0440\u0438 \u0445\u043e\u0440\u043e\u0448\u043e \u0440\u0430\u0441\u043f\u043e\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0445 \u0437\u0432\u0435\u0437\u0434\u0430\u0445 \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u043c \u0440\u0430\u0431\u043e\u0447\u0438\u0439 IPSec\/L2TP \u0442\u0443\u043d\u043d\u0435\u043b\u044c.
\n\u0415\u0441\u043b\u0438 \u0437\u0432\u0435\u0437\u0434\u044b \u043e\u0442\u0432\u0435\u0440\u043d\u0443\u043b\u0438\u0441\u044c, \u043b\u043e\u0432\u0438\u043c \u043a\u043e\u0441\u044f\u043a\u0438 \u0441\u043d\u0430\u0447\u0430\u043b\u0430 \u0432 \/var\/log\/racoon.log, \u0430 \u043a\u043e\u0433\u0434\u0430 \u0442\u0430\u043c \u0434\u043e\u0431\u0438\u0432\u0430\u0435\u043c\u0441\u044f \u0441\u0442\u0440\u043e\u0447\u0435\u043a:
\n
\nDec 24 14:49:26 hostname racoon: INFO: ISAKMP-SA established 192.168.55.1[500]-10.10.0.40[500] spi:xxxxx
\n\u0438 \u0434\u0430\u043b\u0435\u0435
\nDec 24 14:49:27 hostname racoon: INFO: IPsec-SA established: ESP\/Transport 192.168.55.1[500]->10.10.0.40[500] spi=xxxxxx
\n<\/code>
\n\u043f\u0440\u043e\u0432\u0435\u0440\u044f\u0435\u043c \u043d\u0430\u043b\u0438\u0447\u0438\u0435 SA \u043a\u043e\u043c\u0430\u043d\u0434\u043e\u0439
\nsetkey -D<\/code>
\n\u0438 \u043d\u0430\u0447\u0438\u043d\u0430\u0435\u043c \u0434\u0435\u0431\u0430\u0436\u0438\u0442\u044c MPD<\/p>\n","protected":false},"excerpt":{"rendered":"

\u0417\u0430\u0434\u0430\u0447\u0430: 2 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 FreeBSD 9.0 RELEASE, \u043c\u0435\u0436\u0434\u0443 \u043d\u0438\u043c\u0438 \u043d\u0443\u0436\u043d\u043e \u043f\u043e\u0434\u043d\u044f\u0442\u044c \u0442\u0443\u043d\u043d\u0435\u043b\u044c IPSec\/L2TP \u0418\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b: \/usr\/ports\/security\/ipsec-tools (racoon) \/usr\/ports\/net\/mpd5<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[57],"tags":[],"_links":{"self":[{"href":"https:\/\/bos-info.com\/index.php?rest_route=\/wp\/v2\/posts\/457"}],"collection":[{"href":"https:\/\/bos-info.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/bos-info.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/bos-info.com\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/bos-info.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=457"}],"version-history":[{"count":1,"href":"https:\/\/bos-info.com\/index.php?rest_route=\/wp\/v2\/posts\/457\/revisions"}],"predecessor-version":[{"id":458,"href":"https:\/\/bos-info.com\/index.php?rest_route=\/wp\/v2\/posts\/457\/revisions\/458"}],"wp:attachment":[{"href":"https:\/\/bos-info.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=457"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/bos-info.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=457"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/bos-info.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=457"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}