Networking
strongSwan 客戶端可以連接到網際網路（通過 VPN），但不能通過 SSH 連接到 VPN 伺服器或 VPN 子網上的其他客戶端
不久前我寫了一個 strongSwan指南，我遵循了。
然後我為 DHCP 安裝
isc-dhcp-server並配置了 strongSwan。一切正常，除了客戶端無法通過 SSH 連接到 VPN 伺服器或 VPN 子網上的其他客戶端 (
10.0.2.0/24)。我無法弄清楚我錯過了什麼。我在另一台伺服器上執行了完全相同的步驟，客戶端可以通過 SSH 連接到 VPN 伺服器和其他客戶端（相同的配置，但 strongSwan 版本
5.5.1vs5.7.2）。$ ipsec --version Linux strongSwan U5.7.2/K4.19.0-8-amd64$ cat /etc/ipsec.conf config setup charondebug="ike 1, knl 1, cfg 0" uniqueids=never conn ikev2 auto=add compress=no type=tunnel keyexchange=ikev2 fragmentation=yes forceencaps=yes ike=aes256gcm16-sha384-modp3072! esp=aes256gcm16-sha384-modp3072! dpdaction=clear dpddelay=300s rekey=no left=%any leftid=my-vpn.com leftcert=vpn-server.crt leftsendcert=always leftsubnet=0.0.0.0/0 right=%any rightid=%any rightauth=eap-tls rightdns=1.1.1.1,1.0.0.1 rightsourceip=%dhcp rightsendcert=never eap_identity=%identity$ cat /etc/strongswan.conf libtls { suites = TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA } charon { plugins { dhcp { force_server_address = yes identity_lease = yes interface = ens3 load = yes server = 10.0.2.255 } } }$ cat /etc/network/interfaces # This file describes the network interfaces available on your system # and how to activate them. For more information, see interfaces(5). source /etc/network/interfaces.d/* # The loopback network interface auto lo iface lo inet loopback # The primary network interface allow-hotplug ens3 iface ens3 inet static # Redacted # The VPN DHCP network interface auto ens3:1 iface ens3:1 inet static address 10.0.2.1 netmask 255.255.255.0$ cat /etc/dhcp/dhcpd.conf default-lease-time 600; max-lease-time 7200; ddns-update-style none; subnet 10.0.2.0 netmask 255.255.255.0 { range 10.0.2.10 10.0.2.254; }$ iptables-save # Generated by xtables-save v1.8.2 on Sat May 2 08:16:30 2020 *mangle :PREROUTING ACCEPT [33047:26369989] :INPUT ACCEPT [15485:16310786] :FORWARD ACCEPT [16291:10015891] :OUTPUT ACCEPT [13361:11160535] :POSTROUTING ACCEPT [29612:21159798] -A FORWARD -p tcp -m policy --dir in --pol ipsec -m tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1361:1536 -j TCPMSS --set-mss 1360 -A FORWARD -p tcp -m policy --dir out --pol ipsec -m tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1361:1536 -j TCPMSS --set-mss 1360 COMMIT # Completed on Sat May 2 08:16:30 2020 # Generated by xtables-save v1.8.2 on Sat May 2 08:16:30 2020 *nat :PREROUTING ACCEPT [1644:68855] :INPUT ACCEPT [58:4901] :POSTROUTING ACCEPT [124:8399] :OUTPUT ACCEPT [138:9996] -A POSTROUTING -s 10.0.2.0/24 -o ens3 -m policy --dir out --pol ipsec -j ACCEPT -A POSTROUTING -s 10.0.2.0/24 -o ens3 -j MASQUERADE COMMIT # Completed on Sat May 2 08:16:30 2020 # Generated by xtables-save v1.8.2 on Sat May 2 08:16:30 2020 *filter :INPUT DROP [82:5220] :FORWARD DROP [32:18146] :OUTPUT DROP [17:1198] -A INPUT -i lo -j ACCEPT -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT -A INPUT -p udp -m udp --sport 67:68 --dport 67:68 -m state --state NEW -j ACCEPT -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT -A INPUT -p udp -m udp --dport 500 -j ACCEPT -A INPUT -p udp -m udp --dport 4500 -j ACCEPT -A INPUT -p udp -m udp --sport 67:68 --dport 67:68 -m state --state NEW -j ACCEPT -A INPUT -p tcp -m tcp --dport 80 --tcp-flags FIN,SYN,RST,ACK SYN -m connlimit --connlimit-above 50 --connlimit-mask 32 --connlimit-saddr -j REJECT --reject-with icmp-port-unreachable -A INPUT -p tcp -m tcp --dport 443 --tcp-flags FIN,SYN,RST,ACK SYN -m connlimit --connlimit-above 50 --connlimit-mask 32 --connlimit-saddr -j REJECT --reject-with icmp-port-unreachable -A INPUT -p tcp -m tcp --dport 80 -m conntrack --ctstate NEW -m limit --limit 60/sec --limit-burst 20 -j ACCEPT -A INPUT -p tcp -m tcp --dport 443 -m conntrack --ctstate NEW -m limit --limit 60/sec --limit-burst 20 -j ACCEPT -A FORWARD -s 10.0.2.0/24 -m policy --dir in --pol ipsec --proto esp -j ACCEPT -A FORWARD -d 10.0.2.0/24 -m policy --dir out --pol ipsec --proto esp -j ACCEPT -A OUTPUT -o lo -j ACCEPT -A OUTPUT -p tcp -m tcp --dport 53 -m state --state NEW -j ACCEPT -A OUTPUT -p udp -m udp --dport 53 -m state --state NEW -j ACCEPT -A OUTPUT -p udp -m udp --sport 67:68 --dport 67:68 -m state --state NEW -j ACCEPT -A OUTPUT -p tcp -m tcp --dport 80 -m state --state NEW -j ACCEPT -A OUTPUT -p tcp -m tcp --dport 443 -m state --state NEW -j ACCEPT -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT -A OUTPUT -p udp -m udp --sport 67:68 --dport 67:68 -m state --state NEW -j ACCEPT -A OUTPUT -p udp -m udp --dport 123 -j ACCEPT -A OUTPUT -p tcp -m tcp --dport 22 -m state --state NEW -j ACCEPT COMMIT # Completed on Sat May 2 08:16:30 2020 # Generated by xtables-save v1.8.2 on Sat May 2 08:16:30 2020 *raw :PREROUTING ACCEPT [33047:26369989] :OUTPUT ACCEPT [13361:11160535] COMMIT # Completed on Sat May 2 08:16:30 2020$ sysctl -p net.ipv4.ip_forward = 1 net.ipv6.conf.all.disable_ipv6 = 1 net.ipv6.conf.default.disable_ipv6 = 1 net.ipv6.conf.lo.disable_ipv6 = 1
向解決此問題的 Noel 大喊。
使用 dnsmasq vs ISC DHCP 作為 DHCP 伺服器和以下配置，我現在可以從客戶端 SSH 到伺服器。
/etc/dnsmasq.d/01-dhcp-loopback.conf
interface=lo dhcp-range=10.0.2.10,10.0.2.254,255.255.255.0 port=0/etc/strongswan.conf
charon { load_modular = yes plugins { include strongswan.d/charon/*.conf } } include strongswan.d/*.conf/etc/strongswan.d/charon/dhcp.conf
dhcp { force_server_address = yes identity_lease = yes interface = lo load = yes server = 10.0.2.1 }此外，不再需要以下 iptables 規則。
-A INPUT -p udp -m udp --sport 67:68 --dport 67:68 -m state --state NEW -j ACCEPT -A OUTPUT -p udp -m udp --sport 67:68 --dport 67:68 -m state --state NEW -j ACCEPT