Ubuntu14.04でL2TP/IPsecのクライアント側を速攻で構築する

# なにこれ
最近、VPNの先にあるデータベースやAPPサーバーと連帯するシステムを作ることがあって、
その時のメモ。これやるとVPN接続が出来て、ppp0っていうインターフェースが出来る。
実際は、これにVPN切断を検知して再接続するデーモンスクリプトを用意してる。
（この仕組がないと実利用が難しい。後日、スクリプトをアップ予定）

# 想定する環境
* プロトコル：L2TP/IPsec
* 接続先：XXX.XXX.XXX.XXX
* 取得想定IP：172.17.5.X

# 手順

## パッケージインストール
みんなだいすきapt-get

```bash
sudo apt-get install l2tp-ipsec-vpn
sudo apt-get install lsof
```

## 設定ファイルのコピー

### vi /etc/ipsec.conf

```bash
# /etc/ipsec.conf - Openswan IPsec configuration file

# This file:  /usr/share/doc/openswan/ipsec.conf-sample
#
# Manual:     ipsec.conf.5


version	2.0	# conforms to second version of ipsec.conf specification

# basic configuration
config setup
	# Do not set debug options to debug configuration issues!
	# plutodebug / klipsdebug = "all", "none" or a combation from below:
	# "raw crypt parsing emitting control klips pfkey natt x509 dpd private"
	# eg:
	# plutodebug="control parsing"
	# Again: only enable plutodebug or klipsdebug when asked by a developer
	#
	# enable to get logs per-peer
	# plutoopts="--perpeerlog"
	plutoopts="--interface=eth0"
	#
	# Enable core dumps (might require system changes, like ulimit -C)
	# This is required for abrtd to work properly
	# Note: incorrect SElinux policies might prevent pluto writing the core
	dumpdir=/var/run/pluto/
	#
	# NAT-TRAVERSAL support, see README.NAT-Traversal
	nat_traversal=yes
	# exclude networks used on server side by adding %v4:!a.b.c.0/24
	# It seems that T-Mobile in the US and Rogers/Fido in Canada are
	# using 25/8 as "private" address space on their 3G network.
	# This range has not been announced via BGP (at least upto 2010-12-21)
	virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.17.0.0/12,%v4:25.0.0.0/8,%v6:fd00::/8,%v6:fe80::/10
	# OE is now off by default. Uncomment and change to on, to enable.
	oe=off
	# which IPsec stack to use. auto will try netkey, then klips then mast
	protostack=netkey
	# Use this to log to a file, or disable logging on embedded systems (like openwrt)
	#plutostderrlog=/dev/null

# Add connections here
conn L2TP-PSK
     authby=secret
     pfs=no
     auto=add
     keyingtries=3
     dpddelay=30
     dpdtimeout=120
     dpdaction=clear
     rekey=yes
     ikelifetime=8h
     keylife=1h
     type=transport
     #left=%any
     left=<LOCAL INTERFACE IP>
     leftprotoport=17/1701
     right=XXX.XXX.XXX.XXX
     #rightsubnet=0.0.0.0/0
     rightprotoport=17/1701
```

### vi /etc/ipsec.secrets

```bash
# This file holds shared secrets or RSA private keys for inter-Pluto
# authentication.  See ipsec_pluto(8) manpage, and HTML documentation.

# RSA private key for this host, authenticating it to any other host
# which knows the public part.  Suitable public keys, for ipsec.conf, DNS,
# or configuration of other implementations, can be extracted conveniently
# with "ipsec showhostkey".

%any XXX.XXX.XXX.XXX : PSK "PreSharedKey"

# this file is managed with debconf and will contain the automatically created RSA keys
include /var/lib/openswan/ipsec.secrets.inc
```

### vi /etc/xl2tpd/xl2tpd.conf

```bash
;
; Sample l2tpd configuration file
;
; This example file should give you some idea of how the options for l2tpd
; should work.  The best place to look for a list of all options is in
; the source code itself, until I have the time to write better documetation :)
; Specifically, the file "file.c" contains a list of commands at the end.
;
; You most definitely don't have to spell out everything as it is done here
;
; [global]								; Global parameters:
; port = 1701						 	; * Bind to port 1701
; auth file = /etc/l2tpd/l2tp-secrets 	; * Where our challenge secrets are
; access control = yes					; * Refuse connections without IP match
; rand source = dev                     ; Source for entropy for random
;                                       ; numbers, options are:
;                                       ; dev - reads of /dev/urandom
;                                       ; sys - uses rand()
;                                       ; egd - reads from egd socket
;                                       ; egd is not yet implemented
;
; [lns default]							; Our fallthrough LNS definition
; exclusive = no						; * Only permit one tunnel per host
; ip range = 192.168.0.1-192.168.0.20	; * Allocate from this IP range
; no ip range = 192.168.0.3-192.168.0.9 ; * Except these hosts
; ip range = 192.168.0.5				; * But this one is okay
; ip range = lac1-lac2					; * And anything from lac1 to lac2's IP
; lac = 192.168.1.4 - 192.168.1.8		; * These can connect as LAC's
; no lac = untrusted.marko.net			; * This guy can't connect
; hidden bit = no						; * Use hidden AVP's?
; local ip = 192.168.1.2				; * Our local IP to use
; length bit = yes						; * Use length bit in payload?
; require chap = yes					; * Require CHAP auth. by peer
; refuse pap = yes						; * Refuse PAP authentication
; refuse chap = no						; * Refuse CHAP authentication
; refuse authentication = no			; * Refuse authentication altogether
; require authentication = yes			; * Require peer to authenticate
; unix authentication = no				; * Use /etc/passwd for auth.
; name = myhostname						; * Report this as our hostname
; ppp debug = no						; * Turn on PPP debugging
; pppoptfile = /etc/ppp/options.l2tpd.lns	; * ppp options file
; call rws = 10							; * RWS for call (-1 is valid)
; tunnel rws = 4						; * RWS for tunnel (must be > 0)
; flow bit = yes						; * Include sequence numbers
; challenge = yes						; * Challenge authenticate peer ;
; rx bps = 10000000				; Receive tunnel speed
; tx bps = 10000000				; Transmit tunnel speed
; bps = 100000					; Define both receive and transmit speed in one option

; [lac marko]							; Example VPN LAC definition
; lns = lns.marko.net					; * Who is our LNS?
; lns = lns2.marko.net					; * A backup LNS (not yet used)
; redial = yes							; * Redial if disconnected?
; redial timeout = 15					; * Wait n seconds between redials
; max redials = 5						; * Give up after n consecutive failures
; hidden bit = yes						; * User hidden AVP's?
; local ip = 192.168.1.1				; * Force peer to use this IP for us
; remote ip = 192.168.1.2				; * Force peer to use this as their IP
; length bit = no						; * Use length bit in payload?
; require pap = no						; * Require PAP auth. by peer
; require chap = yes					; * Require CHAP auth. by peer
; refuse pap = yes						; * Refuse PAP authentication
; refuse chap = no						; * Refuse CHAP authentication
; refuse authentication = no			; * Refuse authentication altogether
; require authentication = yes			; * Require peer to authenticate
; name = marko							; * Report this as our hostname
; ppp debug = no						; * Turn on PPP debugging
; pppoptfile = /etc/ppp/options.l2tpd.marko	; * ppp options file for this lac
; call rws = 10							; * RWS for call (-1 is valid)
; tunnel rws = 4						; * RWS for tunnel (must be > 0)
; flow bit = yes						; * Include sequence numbers
; challenge = yes						; * Challenge authenticate peer
;
; [lac cisco]							; Another quick LAC
; lns = cisco.marko.net					; * Required, but can take from default
; require authentication = yes
[lac vpn-connection]
lns = XXX.XXX.XXX.XXX
ppp debug = yes
pppoptfile = /etc/ppp/options.l2tpd.client
length bit = yes
```

### vi /etc/ppp/options.l2tpd.client

```bash
ipcp-accept-local
ipcp-accept-remote
refuse-eap
require-mschap-v2
noccp
noauth
idle 1800
mtu 1410
mru 1410
defaultroute
usepeerdns
debug
lock
connect-delay 5000
name <USERNAME>
password <PASSWORD>
```

## おまじない
これをやらないとipsec verifyが通らないんだよね

```bash
$ for line in `ls /proc/sys/net/ipv4/conf/*/send_redirects`; do echo 0 > $line ;done
```

## 検証
通るかチェック。

```bash
$ ipsec verify
Checking your system to see if IPsec got installed and started correctly:
Version check and ipsec on-path                             	[OK]
Linux Openswan U2.6.38/K3.13.0-45-generic (netkey)
Checking for IPsec support in kernel                        	[OK]
 SAref kernel support                                       	[N/A]
 NETKEY:  Testing XFRM related proc values                  	[FAILED]

  Please disable /proc/sys/net/ipv4/conf/*/send_redirects
  or NETKEY will cause the sending of bogus ICMP redirects!

	[FAILED]

  Please disable /proc/sys/net/ipv4/conf/*/accept_redirects
  or NETKEY will accept bogus ICMP redirects!

	[OK]
Checking that pluto is running                              	[OK]
 Pluto listening for IKE on udp 500                         	[OK]
 Pluto listening for NAT-T on udp 4500                      	[OK]
Two or more interfaces found, checking IP forwarding        	[FAILED]
Checking NAT and MASQUERADEing                              	[OK]
Checking for 'ip' command                                   	[OK]
Checking /bin/sh is not /bin/dash                           	[WARNING]
Checking for 'iptables' command                             	[OK]
Opportunistic Encryption Support                            	[DISABLED]
```

## サービスの起動
これで接続できる

```bash
$ ipsec auto --add L2TP-PSK
$ ipsec auto --up L2TP-PSK
$ xl2tpd-control connect vpn-connection
00 OK
```

## ルーティング情報の登録
これ大事。

```bash
$ route add -net 172.17.5.0 netmask 255.255.255.0 dev ppp0
```