IKEV2

admin · 发表于 2023-5-12 10:20

这个是介绍
https://github.com/hwdsl2/setup- ... s/ikev2-howto-zh.md

这个是docker
https://github.com/hwdsl2/docker ... master/README-zh.md

先编辑环境配置文件
VPN_PUBLIC_IP=192.168.11.157
VPN_IPSEC_PSK=yourpsk
VPN_USER=admin
VPN_PASSWORD=Admin@123456
VPN_ADDL_USERS=user1 user2
VPN_ADDL_PASSWORDS=User1@123456 User2@123456
公共IP填外网IP,这个IP服务器和客户端要一致,我是内网测试,所以用的内网IP
docker run \
--name ikev2_8 \
--env-file /root/docker/ikev2/vpn.env \
--restart=unless-stopped \
-v /root/docker/ikev2/ikev2-vpn-data:/etc/ipsec.d \
-v /lib/modules:/lib/modules:ro \
-p 500:500/udp \
-p 4500:4500/udp \
--network=docker_bridge_192_168_21 --ip=192.168.21.8 \
-e TZ=Asia/Shanghai \
-d --privileged \
hwdsl2/ipsec-vpn-server
查看日志
docker logs ikev2_8
输出如下信息说明成功了,如果没成功看看提示什么,再解决
Trying to auto discover IP of this server...
Starting IPsec service...
================================================
IPsec VPN server is now ready for use!
Connect to your new VPN with these details:
Server IP: 192.168.11.157
IPsec PSK: yourpsk
Username: admin
Password: Admin@123456
Additional VPN users (username | password):
user1 | User1@123456
user2 | User2@123456
Write these down. You'll need them to connect!
VPN client setup: https://vpnsetup.net/clients2
================================================
Setting up IKEv2. This may take a few moments...
然后服务器放行500 4500这2个UDP端口
客户端连接:
下载证书
docker cp ikev2_8:/etc/ipsec.d/vpnclient.p12 /root/docker/ikev2/
WIN10客户端安装方式:
把下面的内容保存为批处理,然后把批处理和证书文件放在同一个目录,然后运行批处理就行了
@echo off
:: IKEv2 Configuration Import Helper Script for Windows 8, 10 and 11
:: Copyright (C) 2022 Lin Song <linsongui@gmail.com>
:: This work is licensed under the Creative Commons Attribution-ShareAlike 3.0
:: Unported License: http://creativecommons.org/licenses/by-sa/3.0/
:: Attribution required: please include my name in any derivative and let me
:: know how you have improved it!
setlocal DisableDelayedExpansion
set "SPath=%SystemRoot%\System32"
if exist "%SystemRoot%\Sysnative\reg.exe" (set "SPath=%SystemRoot%\Sysnative")
set "Path=%SPath%;%SystemRoot%;%SPath%\Wbem;%SPath%\WindowsPowerShell\v1.0"
set "_err====== ERROR ====="
set "_work=%~dp0"
if "%_work:~-1%"=="" set "_work=%_work:~0,-1%"
for /f "tokens=4-5 delims=. " %%i in ('ver') do set version=%%i.%%j
if "%version%" == "10.0" goto :Check_Admin
if "%version%" == "6.3" goto :Check_Admin
if "%version%" == "6.2" goto :Check_Admin
goto :E_Win
:Check_Admin
reg query HKU\S-1-5-19 >nul 2>&1 || goto :E_Admin
where certutil >nul 2>&1
if %errorlevel% neq 0 goto :E_Cu
where powershell >nul 2>&1
if %errorlevel% neq 0 goto :E_Ps
title IKEv2 Configuration Import Helper Script
setlocal EnableDelayedExpansion
cd /d "!_work!"
@cls
echo ===================================================================
echo Welcome^^! Use this helper script to import an IKEv2 configuration
echo into a PC running Windows 8, 10 or 11.
echo For more details, see https://vpnsetup.net/ikev2
echo.
echo Before continuing, you must put the .p12 file you transferred from
echo the VPN server in the *same folder* as this script.
echo ===================================================================
set client_name_gen=
for /F "eol=| delims=" %%f in ('dir "*.p12" /A-D /B /O-D /TW 2^>nul') do (
set "p12_latest=%%f"
set "client_name_gen=!p12_latest:.p12=!"
goto :Enter_Client_Name
)
:Enter_Client_Name
echo.
echo Enter the name of the IKEv2 VPN client to import.
echo Note: This is the same as the .p12 filename without extension.
set client_name=
set p12_file=
if defined client_name_gen (
echo To accept the suggested client name, press Enter.
set /p client_name="VPN client name: [%client_name_gen%] "
if not defined client_name set "client_name=%client_name_gen%"
) else (
set /p client_name="VPN client name: "
if not defined client_name goto :Abort
)
set "client_name=%client_name:"=%"
set "client_name=%client_name: =%"
set "p12_file=%_work%\%client_name%.p12"
if not exist "!p12_file!" (
echo.
echo ERROR: File "!p12_file!" not found.
echo You must put the .p12 file you transferred from the VPN server
echo in the *same folder* as this script.
goto :Enter_Client_Name
)
echo.
echo Enter the IP address (or DNS name) of the VPN server.
echo Note: This must exactly match the VPN server address in the output
echo of the IKEv2 helper script on your server.
set server_addr=
set /p server_addr="VPN server address: "
if not defined server_addr goto :Abort
set "server_addr=%server_addr:"=%"
set "server_addr=%server_addr: =%"
set "conn_name_gen=IKEv2 VPN %server_addr%"
powershell -command "Get-VpnConnection -Name '%conn_name_gen%'" >nul 2>&1
if !errorlevel! neq 0 (
goto :Enter_Conn_Name
)
set "conn_name_gen=IKEv2 VPN 2 %server_addr%"
powershell -command "Get-VpnConnection -Name '%conn_name_gen%'" >nul 2>&1
if !errorlevel! neq 0 (
goto :Enter_Conn_Name
)
set "conn_name_gen=IKEv2 VPN 3 %server_addr%"
powershell -command "Get-VpnConnection -Name '%conn_name_gen%'" >nul 2>&1
if !errorlevel! equ 0 (
set conn_name_gen=
)
:Enter_Conn_Name
echo.
echo Provide a name for the new IKEv2 connection.
set conn_name=
if defined conn_name_gen (
echo To accept the suggested connection name, press Enter.
set /p conn_name="IKEv2 connection name: [%conn_name_gen%] "
if not defined conn_name set "conn_name=%conn_name_gen%"
) else (
set /p conn_name="IKEv2 connection name: "
if not defined conn_name goto :Abort
)
set "conn_name=%conn_name:"=%"
powershell -command "Get-VpnConnection -Name '%conn_name%'" >nul 2>&1
if !errorlevel! equ 0 (
echo.
echo ERROR: A connection with this name already exists.
goto :Enter_Conn_Name
)
echo.
echo Importing .p12 file...
certutil -f -p "" -importpfx "%p12_file%" NoExport >nul 2>&1
if !errorlevel! equ 0 goto :Create_Conn
echo When prompted, enter the password for client config files, which can be found
echo in the output of the IKEv2 helper script on your server.
:Import_P12
certutil -f -importpfx "%p12_file%" NoExport
if !errorlevel! neq 0 goto :Import_P12
:Create_Conn
echo.
echo Creating VPN connection...
powershell -command "Add-VpnConnection -ServerAddress '%server_addr%' -Name '%conn_name%' -TunnelType IKEv2 -AuthenticationMethod MachineCertificate -EncryptionLevel Required -PassThru"
if !errorlevel! neq 0 (
echo ERROR: Could not create the IKEv2 VPN connection.
goto :Done
)
echo Setting IPsec configuration...
powershell -command "Set-VpnConnectionIPsecConfiguration -ConnectionName '%conn_name%' -AuthenticationTransformConstants GCMAES128 -CipherTransformConstants GCMAES128 -EncryptionMethod AES256 -IntegrityCheckMethod SHA256 -PfsGroup None -DHGroup Group14 -PassThru -Force"
if !errorlevel! neq 0 (
echo ERROR: Could not set IPsec configuration for the IKEv2 VPN connection.
goto :Done
)
echo IKEv2 configuration successfully imported^^!
echo To connect to the VPN, click on the wireless/network icon in your system tray,
echo select the "%conn_name%" VPN entry, and click Connect.
goto :Done
:E_Admin
echo %_err%
echo This script requires administrator privileges.
echo Right-click on the script and select 'Run as administrator'.
goto :Done
:E_Win
echo %_err%
echo This script requires Windows 8, 10 or 11.
echo Windows 7 users can manually import IKEv2 configuration. See https://vpnsetup.net/ikev2
goto :Done
:E_Cu
echo %_err%
echo This script requires 'certutil', which is not detected.
goto :Done
:E_Ps
echo %_err%
echo This script requires 'powershell', which is not detected.
goto :Done
:Abort
echo.
echo Abort. No changes were made.
:Done
echo.
echo Press any key to exit.
pause >nul
goto :eof
linux客户端和iphone客户端自己看教程吧
特别是linux客户端,教程写的太不完善了,我用rockylinux8的minimal模式死活不能连上
写在最后
WIN10客户端连上了,然后服务端没有IP 这个模式和L2TP不一样,不知道怎么ping服务端了,也许服务端也需要一个docker-ikev2-client
估计这样才能ping通吧

复制代码

admin · 发表于 2023-5-15 15:34

用docker配置完毕但是WIN10连接的时候提示

IKE 身份验证凭证不可接受

用教程里面提供的批处理文件,创建的VPN链接正常连接上了

但是有个问题

客户端获取到了IP
但是IKEV2服务器端没有IP啊

这样怎么做端口转发?

访问服务器的端口自动转发到VPN客户端这个需求用PPTP和L2TP都可以做到,但是IKEV2做不到
这个需求我大概明白是什么实现了,需要在服务器上也安装IKEV2客户端
这样服务器和我家里的电脑就属于同一个网络了,就可以转发了,有点麻烦

IKEV2和L2TP的使用上还是有些区别的

感觉还是L2TP简单明了手动添加路由表就可以实现各个地区的公司内网互访
IKEV2感觉就是想把用户当傻瓜,自动同步各个客户端的路由表,我觉得有点过犹不及了

admin · 发表于 2023-5-15 16:01

总结一下:
用docker一个命令配置IKEV2服务端

docker run \
--name ipsec-vpn-server \
--restart=always \
-v ikev2-vpn-data:/etc/ipsec.d \
-v /lib/modules:/lib/modules:ro \
-p 500:500/udp \
-p 4500:4500/udp \
-d --privileged \
hwdsl2/ipsec-vpn-server

复制代码

然后服务器放行1701 500 4500这3个UDP端口

然后输入命令

docker logs ipsec-vpn-server

复制代码

查看用户名和密码
里面还有psk,好像这个psk客户端不需要关注

最后就是客户端配置
Client configuration is available inside the
Docker container at:
/etc/ipsec.d/vpnclient.p12 (for Windows & Linux)
/etc/ipsec.d/vpnclient.sswan (for Android)
/etc/ipsec.d/vpnclient.mobileconfig (for iOS & macOS)

win10客户端配置需要把证书下载下来

docker cp ipsec-vpn-server:/etc/ipsec.d/vpnclient.p12 ./

复制代码

然后把证书下载到本地
然后根据这个教程
https://github.com/hwdsl2/setup- ... s/ikev2-howto-zh.md
先下载cmd脚本用这个脚本自动的配置连接就行了

我按照他的教程手动创建的链接,证书导入了,注册表也改了,结果死活提示 IKE 身份验证凭证不可接受
最后我用他的批处理就行了

admin · 发表于 2023-5-15 16:16

https://developer.aliyun.com/ask/53504

如何通过strongswan等工具搭建IKEv2 VPN服务，从而远程组建办公局域网？
希望通过strongswan等工具，搭建一个IKEv2的VPN隧道，将不同地区的员工组成内网通讯，但各自外网流量不经过vpn。

设备：
1. 阿里云ECS充当VPN主机，安装strongswan搭建IKEv2 VPN服务；
2. 公司电脑A，同事电脑B，同事电脑C；

需要效果：
3. 电脑A、B、C三者使用各自账号连接VPN服务后，取得对应的固定虚拟IP地址；
4. 电脑A、B、C三者之间可以互相通讯，但不能访问VPN主机的资源；
5. 电脑A、B、C三者访问的外网流量不经过VPN，直接使用本地互联网；

这个是阿里云上一个用户的提问,最后他的需求没有得到解决

		自动登录	找回密码
密码			立即注册