alroyso commented 9 years ago

验证客户端，跳过的问题，这个要怎么解决呀？

TASK: [ppp-radiusclient | Enforce radiusclient is installed] ****** skipping: [host1]

TASK: [ppp-radiusclient | upload radiusclient config] ***** skipping: [host1] => (item=radiusclient.conf) skipping: [host1] => (item=servers) skipping: [host1] => (item=dictionary)

TASK: [ppp-radiusclient | fix can't resolve own hostname problem - hostname] *\ skipping: [host1]

TASK: [ppp-radiusclient | fix can't resolve own hostname problem - fqdn] ****\ skipping: [host1]

ftao commented 9 years ago

这个不是一个错误，只是说没有启用通过radius 服务器认证的功能。下面这个文档的配置就是不启用的，如果你的服务器只是给自己／或者很少的几个人用的，可以不用raidus 的。 https://github.com/ftao/vpn-deploy-playbook/wiki/%E9%85%8D%E7%BD%AEPPTP-VPN%E6%9C%8D%E5%8A%A1%E5%99%A8

alroyso commented 9 years ago

你好，host_vars/我是在这里配置变量。

![Uploading 1.png…]()

alroyso commented 9 years ago

pptp_use_radius: true pptp_radius_servers:

host: IP:16450 secret: 123

alroyso commented 9 years ago

但是也是不被启动，这是配置有问题还是环境变量要配置？请指点下。

ftao commented 9 years ago

host_vars/xxx 的文件名和 ansible_hosts 中的主机名要一致的。否则不会被读取。

alroyso commented 9 years ago

还有个问题，验证IP 跟端口是多个，比如ip:16450 ip:16456

pptp_radius_servers:

host: IP:16450 secret: 123 host: IP:16456 secret: 123

那么这个格式是这样写的吗？

ftao commented 9 years ago

使用 YAML 文件中列表的的写法，请自行google 。另外你贴代码的时候用一下markdown 语法，没发现格式都是乱的吗？

alroyso commented 9 years ago

pptp_use_radius: true pptp_radius_servers:

host: IP:16450 secret: 123
- host: IP:16456 secret: 123

这样是对代码？多个服务器配置的话？

ftao commented 9 years ago

IP:16450 要改成完整的IP 就可以了。

alroyso commented 9 years ago

验证客户端买有对win平台的字典吗？

ftao commented 9 years ago

不明白你的意思。之前搭建的服务器， window 系统的客户端可以连上VPN，验证通过的。

alroyso commented 9 years ago

我这里老是鉴定失败

alroyso commented 9 years ago

radiusclient 这个怎么使用调试模式啊?

ftao commented 9 years ago

失败，你要看 pptpd 的日志。打开调试也是打开pptpd 的日志｀/etc/pptpd.conf` . 同时你要去看 radius 服务器的日志是什么情况。

alroyso commented 9 years ago

我找到原因了我使用直接IP 就可以验证通过，但是用ip:16450 这样的方式就无法通过，这个验证是不能这样写的吗？

alroyso commented 9 years ago

因为我这里是多台验证服务器，有的服务器是换了端口的。

ftao commented 9 years ago

那很可能是没有支持自定义端口的情况，可能配置文件格式生成的就不对了。这确实是一个bug .

alroyso commented 9 years ago

o .

alroyso commented 9 years ago

谢谢了

ftao commented 9 years ago

bug 现在应该已经修正，支持指定自定义的port 了。

请配置如下变量

  pptp_use_radius: true
  pptp_radius_servers:
    - host:  ip.of.radius-server-1   #请填写radius 服务器的IP 地址或者域名
      secret: some-radius-secret   #请填写radius 服务器的密钥                                                                
    - host:  ip.of.radius-server-2 
      auth_port: 5678               #如果服务器使用自定义的端口，请配置auth_port 和 acct_port 
      acct_port: 5679
      secret: some-radius-secret

alroyso commented 9 years ago

fatal: [vpn] => {'msg': "AnsibleUndefinedVariable: One or more undefined variables: 'radius_servers' is undefined", 'failed': True} fatal: [vpn] => {'msg': 'One or more items failed.', 'failed': True, 'changed': False, 'results': [{'msg': "AnsibleUndefinedVariable: One or more undefined variables: 'radius_servers' is undefined", 'failed': True}]}

FATAL: all hosts have already failed -- aborting

请问这个问题是什么原因造成的?

我用的vpn.yml 在group_vars/vpn.yml

alroyso commented 9 years ago

radius_servers:

host:IP
auth_port: 16450 acct_port: 16460 secret: 123
host: IP
secret: 123

ipsec_enable_ikev1: true ipsec_enable_ikev2: true ipsec_enable_l2tp: true ipsec_use_radius: true ipsec_radius_servers: "{{ radius_servers }}" ipsec_psk: "123456" ipsec_gen_ios8_profile: false

pptp_network:

local_ip: 172.0.0.1
remote_ip: 172.0.0.2-172.255.255.255
subnet: 172.0.0.0/8
mtu: 1340

pptp_use_radius: true pptp_radius_servers: "{{ radius_servers }}" pptp_dns_servers:

8.8.4.4
8.8.8.8

l2tp_network:

local_ip: 172.0.0.1
remote_ip: 172.0.0.2-172.255.255.255
subnet: 172.0.0.0/8

l2tp_under_ipsec: true l2tp_use_radius: true l2tp_radius_servers: "{{ radius_servers }}"

l2tp_dns_servers:

8.8.4.4
8.8.8.8

ocserv_use_radius: True ocserv_radius_servers: "{{ radius_servers }}" ocserv_cert_auto: true

group_vars/vpn.yml 格式如上，

ftao commented 9 years ago

ansible_hosts 文件怎么写的？如果你用 group_vars/vpn.yml 配置的话，需要把对应主机加入到 vpn 组里面。类似这样在ansible_hosts 这样写

your-host-name  

[vpn]
your-host-name

alroyso commented 9 years ago

server1 ansible_ssh_host=23.88.228.166 ansible_connection=ssh ansible_ssh_user=root ansible_ssh_pass=passwd ansible_sudo=true [vpn] server1

这样写的。是否正确、我是在/etc/ansible/hosts 配置的

alroyso commented 9 years ago

pptp_network:

local_ip: 172.0.0.1
remote_ip: 172.0.0.2-172.255.255.255
subnet: 172.0.0.0/8
mtu: 1340

你好，找到原因了，这样配置报错不能在外面添加这个内网IP吗？

ftao commented 9 years ago

yaml 格式问题。请参考 https://github.com/ftao/vpn-deploy-playbook/blob/master/roles/pptp/defaults/main.yml

pptp_network:
   - local_ip: 172.0.0.1
   - remote_ip: 172.0.0.2-172.255.255.255
   - subnet: 172.0.0.0/8
   - mtu: 1340

这种写法变成列表了。不是字典。

alroyso commented 9 years ago

            eap-radius {
      accounting = yes
      servers {
                        vpnserver-1 {
              address = ip
              secret = 123
          }
                        vpnserver-2 {
              address = ip
              secret = 123
          }

关于 strongSwan 验证的问题，这个也不能添加多个服务器自定义端口这样算是错误的吧。

ftao commented 9 years ago

目前确实不支持自定义端口，欢迎发送 pull request

alroyso commented 9 years ago

你好，我安装成功后，为什么l2tp链接服务器是服务器没有响应，这是什么问题呀？

ftao commented 9 years ago

看日志吧。有可能是网络问题，也有可能是服务器问题。

alroyso commented 9 years ago

TASK: [strongswan | create ca cert] *** skipping: [server1]

TASK: [strongswan | create server key] **** skipping: [server1]

TASK: [strongswan | create server cert] *** skipping: [server1]

TASK: [strongswan | Upload ca cert] *** skipping: [server1]

TASK: [strongswan | Upload ipsec certs] *** skipping: [server1]

TASK: [strongswan | Upload ipsec server key] ****** skipping: [server1]

TASK: [strongswan | get ca certs content from pki server] ***** skipping: [server1 -> server1]

TASK: [strongswan | get server key content from pki server] *** skipping: [server1 -> server1]

TASK: [strongswan | get server cert content from pki server] ****** skipping: [server1 -> server1]

TASK: [strongswan | upload certs to server] *** skipping: [server1] => (item={'content': u'{# ca_cert_content_action.stdout #}', 'path': 'cacerts/ca_cert.pem'}) skipping: [server1] => (item={'content': u'{# server_key_content_action.stdout #}', 'path': 'private/server_key.pem'}) skipping: [server1] => (item={'content': u'{# server_cert_content_action.stdout #}', 'path': 'certs/server_cert.pem'})

这些是是必要的吗？

ftao commented 9 years ago

skipping 都不是错误，只是你在当前配置下面不需要执行部分步骤而已。相关的配置是

ipsec_cert_source: "gen" #pki,upload

alroyso commented 9 years ago

恩，这个我清楚，我的意思是，在配置l2tp ipsec 的时候，这个是不是必要的？

ftao commented 9 years ago

l2tp 使用的是共享密钥，不需要生成证书。这个证书时 ikev2 的时候才需要。

alroyso commented 9 years ago

在ios 上就需要了吧，

ftao commented 9 years ago

no . l2tp ios 可以配置共享密钥模式的。

alroyso commented 9 years ago

IOS 思科IPSEC 呢？

ftao commented 9 years ago

ios cisco ipsec == ikev1 也可以配置共享密钥模式。我的这个项目中的playbook 配置的也是共享密钥模式。

2015-06-19 21:08 GMT+08:00 alroyso notifications@github.com:

IOS 思科IPSEC 呢？

— Reply to this email directly or view it on GitHub https://github.com/ftao/vpn-deploy-playbook/issues/64#issuecomment-113509885 .

Tao Fei (陶飞) Twitter: http://twitter.com/ftao GitHub: https://github.com/ftao

alroyso commented 9 years ago

明白了，我现在l2tp 服务器链接不上， ipsec 模式提示鉴定失败，我在调试看看。

alroyso commented 9 years ago

pptp_network: local_ip: 172.0.0.1 remote_ip: 172.0.0.2-172.255.255.255 subnet: 172.0.0.0/8
mtu: 1340

你好，我吧PPTP网络设置成这样，VPN就链接不上，我查看iptables -L 得出一下结果

Chain INPUT (policy ACCEPT) target prot opt source destination

Chain FORWARD (policy ACCEPT) target prot opt source destination
EASY_NAT_SET_MTU_FILTER all -- anywhere anywhere

Chain OUTPUT (policy ACCEPT) target prot opt source destination

Chain EASY_NAT_SET_MTU (1 references) target prot opt source destination
TCPMSS tcp -- anywhere anywhere tcp flags:FIN,SYN,RST,ACK/SYN TCPMSS set 1340

Chain EASY_NAT_SET_MTU_FILTER (1 references) target prot opt source destination
EASY_NAT_SET_MTU tcp -- 172-0-0-0.lightspeed.brhmal.sbcglobal.net/8 anywhere

172-0-0-0.lightspeed.brhmal.sbcglobal.net/8 变成这样了，这个问题要怎么解决啊？

ftao commented 9 years ago

你为什么要设置成 172.0.0.0/8 , 这个都不是私有网段了。很可能各种冲突的。

alroyso commented 9 years ago

我发现了原因格式问题导致的。

alroyso commented 9 years ago

172.0.0.2-172.255.255.255 如果我是这样多段IP 172.0.0.0/8 这个8应该改成什么呀？

alroyso commented 9 years ago

pki 是不是只需要定义 pki_server_certs 这个就可以了吧？

alroyso commented 9 years ago

还是要这样ipsec_pki_server: "{{ inventory_hostname }}" inventory_hostname: "vpn" 这样弄？

alroyso commented 9 years ago

ipsec_enable_ikev2 为true的时候为什么安装证书会被跳过呀，。，，ipsec_cert_source: "pki" 这样做也报错

ftao commented 9 years ago

ipsec_cert_source: "pki" 表示有一台另外的服务器作为 pki server . ipsec_cert_source: "gen" 表示在自动生成证书 ipsec_cert_source: "upload" 表示本地有已经生成好的证书。

你想要的模式应该是要 "gen" 模式吧？

alroyso commented 9 years ago

默认的不就是ipsec_cert_source: "gen" 吗？不被执行哦，被跳过了？

alroyso commented 9 years ago

TASK: [strongswan | init ca] ****** skipping: [vpn]

TASK: [strongswan | create ca cert] *** skipping: [vpn]

TASK: [strongswan | create server key] **** skipping: [vpn]

TASK: [strongswan | create server cert] *** skipping: [vpn]

TASK: [strongswan | Upload ca cert] *** skipping: [vpn]

TASK: [strongswan | Upload ipsec certs] *** skipping: [vpn]

TASK: [strongswan | Upload ipsec server key] ****** skipping: [vpn]

TASK: [strongswan | get ca certs content from pki server] ***** skipping: [vpn -> vpn]

TASK: [strongswan | get server key content from pki server] *** skipping: [vpn -> vpn]

TASK: [strongswan | get server cert content from pki server] ****** skipping: [vpn -> vpn]

TASK: [strongswan | upload certs to server] *** skipping: [vpn] => (item={'content': u'{# ca_cert_content_action.stdout #}', 'path': 'cacerts/ca_cert.pem'}) skipping: [vpn] => (item={'content': u'{# server_key_content_action.stdout #}', 'path': 'private/server_key.pem'}) skipping: [vpn] => (item={'content': u'{# server_cert_content_action.stdout #}', 'path': 'certs/server_cert.pem'})

TASK: [strongswan | get ca cert content] ****** skipping: [vpn]

TASK: [strongswan | fetch back ca cert] *** skipping: [vpn]

都跳过了

alroyso commented 9 years ago

ipsec_enable_ikev1: true ipsec_enable_ikev2: true ipsec_enable_l2tp: true ipsec_use_radius: true ipsec_radius_servers: "{{ radius_servers }}"

ipsec_cert_source: "upload" #pki,upload

ipsec_psk: "123456"

ipsec_cert_source: "pki"

ipsec_pki_server: "{{ inventory_hostname }}"

ipsec_gen_ios8_profile: false

pptp_network:

local_ip: 172.0.0.1

remote_ip: 172.0.0.2-172.255.255.255

subnet: 172.0.0.0/8

mtu: 1340

pptp_use_radius: true pptp_radius_servers: "{{ radius_servers }}" pptp_dns_servers:

8.8.4.4
8.8.8.8

这是我的配置，还差点什么？

ftao / vpn-deploy-playbook

[ppp-radiusclient | Enforce radiusclient is installed] #64

ipsec_cert_source: "upload" #pki,upload

ipsec_cert_source: "pki"

ipsec_pki_server: "{{ inventory_hostname }}"

pptp_network:

local_ip: 172.0.0.1

remote_ip: 172.0.0.2-172.255.255.255

subnet: 172.0.0.0/8

mtu: 1340