如何设置IPSec VPN客户端

简介


使用VPN,可以让你随时随地,通过加密的隧道,安全访问公司内网资源。

我们使用基于IPSec最新的协议IKEv2来实现VPN。这个协议提供了更可靠快速的认证,以及漫游不同网络的能力。更方便的是,很多常用操作系统,如Window 7以上,macOS,iOS都内置了官方的客户端,使用起来也非常顺畅便捷。

本文介绍了如何在Windows, macOS, Ubuntu, iOS和安卓上设置VPN客户端的方法。

预先准备

  • 下载CA证书
  • 从你的网管那里获取连接参数
    • VPN服务器的域名,类似‘vpn.creekside.network’形式;
    • 你的VPN账户名和密码;
  • 使用安卓手机的客户请下载客户端

Windows10


安装证书

Windows10安装证书的手续略为复杂,请参考以下胶片(点击左右侧箭头可翻页)。

1. 搜索应用程序mmc.exe并以管理员身份运行

2. 从文件菜单,选择添加/删除管理单元

3. 从左侧选择“证书”,然后点击中间的“添加”按钮

4. 选择计算机账户,然后点击下一步

5. 选择本地计算机,然后点击完成

6. 返回证书管理页面

7. 浏览到受信任的根证书颁发机构,鼠标右键,在所有任务菜单下,选择导入

8. 进入证书导入向导

9. 在文件名输入框右侧,点击浏览

10. 找到你之前下载的证书文件,点击打开

11. 浏览择证书保存选择选项,并选择受信任的根证书

12. 恭喜你,完成了证书导入流程

previous arrowprevious arrow
next arrownext arrow
Slider

设置连接

Windows已经内置了IKEv2 VPN客户端。你需要在第4步里填写你收到的VPN服务器设置信息:

  • VPN服务商:选”Windows内置”
  • 连接名称:你可以自定义便于记忆的名称
  • 服务器名称或地址:填写服务器域名
  • VPN类型:选择“IKEv2”
  • 登录类型:账户名和密码
  • 账户名:你的账户名

1. 从任务条右下角,点击网络连接图标。

2. 点击左侧的VPN选项。

3. 右边VPN页面下,选择添加VPN

4. 根据前面说明,填写相应的内容。不要使用图片中的信息

5. 你已完成设置,使用连接启动VPN。

previous arrow
next arrow
Slider

通过VPN访问互联网

IKEv2自动支持split tunnel功能,也就是只有远程网络才走VPN隧道,互联网流量还是走本地网关。在某些应用场景下,如果你希望使用公司的网络来访问互联网,就可以根据以下步骤完成进一步的配置。

1. 在 VPN 页面下, 点击相关设置下的 更改适配器选项

2. 鼠标右键点击VPN连接, 然后从下拉菜单中选择 属性

3.在对话框中,选择网络分页,然后选择TCP/IPv4一行,点击属性

4. 点击右下方的 高级...

5. 勾选在远程网络上使用默认网关,取消勾选自动跃点,并在下方的输入框内填入数字1

previous arrow
next arrow
Slider

Android


Android没有原生客户端,需要下载,并按以下步骤安装。

在应用商店里搜索 “Strongswan VPN Client” 并安装。你也可以从这里下载APK文件并手动安装。

1. 下载Strongswan VPN客户端

通过邮件,或者点击这个链接,下载证书文件到手机,并点击打开。

2. 保存证书文件到手机

选择右侧的证书安装工具,安装证书。

3. 安装证书

你可以用任何字符串命名你的证书,在证书用途上选择VPN应用。然后点击“OK”完成证书安装。

4. 配置证书

打开“Strongswan”应用程序。因为是第一次使用,页面会显示“无活跃VPN”。点击右上角的“添加VPN配置”。

5. 添加VPN配置

输入合适的配置参数(图例只是参考)
- 服务器地址: 输入发送给你的域名.
- VPN 类型: “IKEv2 EAP(用户名/密码)”
- 用户名: 你收到的用户名
- 密码: 你收到的密码
- CA证书: 确认“自动选择”已勾选.(缺省)

完成后保存。

6. 配置VPN连接

回到主页面,点击相应 的VPN配置,即可连接到VPN服务器。

7. 连接到VPN服务器
previous arrow
next arrow
Slider

macOS


首先按以下步骤安装证书:

  • 双击下载的证书文件。钥匙串访问应用会自动弹出一个对话框,并提示“钥匙串访问正在尝试修改系统钥匙串。输入密码以允许此次操作“
  • 输入你的计算机密码,然后点击修改钥匙串
  • 双击刚才新引入的VPN证书Creekside Networks Authority。一个参数设置窗口会弹出来,点击信任左侧的箭头,然后在IP安全 (IPSec)一栏中,把缺省的用不信任改成始终信任
  • 系统会再次要求你输入密码确认。确认完成后,刚才的改变会自动被保存下来。证书导入完毕。

接下来我们设置VPN连接。

  • 打开系统偏好设置,选择网络
  • 点击左侧网络列表框下面的“+“号;
  • 在弹出的对话框里
    • 选择接口为VPN
    • VPN类型缺省是IKEv2,这个不要改;
    • 服务名称项目里,你可以输入任何你喜欢的名字;
    • 完成后点击创建;
  • 在新的连接页面里,
    • 服务器地址:输入管理员发给你的域名;
    • 远程ID:和上述服务器地址一样的域名;
    • 本地ID:保持空白;
    • 点击认证设置…,在对话框里输入:
      • 用户名:你的VPN用户名;
      • 密码:你的VPN密码;
      • 完成后,点击“
    • 回到连接页面后,点击应用以保存刚才的设置;
    • 点击连接,你就会连接到VPN服务器了。

iOS


按照以下步骤配置VPN:

  • 使用隔空投送把证书文件发送到你的手机;
  • 一个对话框会自动弹出来,如果你有Apple Watch, 会首先提示你选择选择要安装的设备,选择iPhone,系统会提示描述文件已下载。
  • 打开设置应用,找到通用并打开
    • 向下滑动到描述文件一行出现,点击打开;
    • 在已下载的配置描述文件下方的列表里,点击Creekside Networks Authority一项;
    • 在随后出现的安装描述文件页面中,点击右上角的安装按钮;
    • 输入你的锁屏密码
    • 再次点击安装,证书安装就完成了。
  • 回到通用页面,我们开始配置VPN连接:
    • 向下滑动到VPN一行,点击打开;
    • 在页面的最后一行,点击添加VPN配置…,进入添加配置页面
      • 类型:使用缺省的IKEv2
      • 描述:VPN连接的名称,填写你公司的名称或者任意名字;
      • 服务器地址:输入管理员发给你的域名
      • 远程ID:和上述服务器地址一样的域名
      • 本地ID:保持空白
      • 用户鉴定:保持用户名不变
      • 用户名:你的VPN用户名;
      • 密码:你的VPN密码;
      • 最后点击左上角的完成
    • 回到VPN页面
      • 点选刚才设置的VPN连接;
      • 状态一栏,点击未连接右侧的开关;
      • 你就会连接到VPN服务器了。

Ubuntu


Ubuntu 16.04

首先,我们要下载Strongswan源码,编译并安装:

cd ~
sudo apt-get install -y libssl-dev libglib2.0-dev libnm-dev
wget http://download.strongswan.org/strongswan-5.6.3.tar.bz2
tar xjf strongswan-5.6.3.tar.bz2
cd ~/strongswan-5.6.3
./configure --sysconfdir=/etc --prefix=/usr --libexecdir=/usr/lib \
   --disable-aes --disable-des --disable-md5 --disable-sha1 
   --disable-sha2 --disable-fips-prf --disable-gmp --enable-openssl \
   --enable-nm --enable-agent --enable-eap-gtc --enable-eap-md5 \
   --enable-eap-mschapv2 --enable-eap-identity
make
sudo make install

然后是NetworkManager的Strongswan插件。

cd ~
sudo apt-get install -y intltool libgtk-3-dev libsecret-1-dev \
  libnma-dev network-manager-dev libnm-util-dev libnm-glib-dev \
  libnm-glib-vpn-dev libnm-gtk-dev

wget http://download.strongswan.org/NetworkManager/NetworkManager-strongswan-1.4.4.tar.bz2

tar xjf NetworkManager-strongswan-1.4.4.tar.bz2
cd ~/NetworkManager-strongswan-1.4.4
./configure --sysconfdir=/etc --prefix=/usr --libexecdir=/usr/lib

make
sudo make install

Ubuntu 18.04

我们先下载官方的Strongswan以及相应的NeworkManager插件。

sudo apt install -y strongswan libcharon-extra-plugins network-manager-strongswan

Setup VPN connections

VPN客户端安装好了,接下来是配置VPN连接。

  • Open System Settings, then select Network;
    • Ubuntu 16.04:
      • Click the + sign at the left-bottom corner, choice Interface type to VPN, then click Create;
    • Ubuntu 18.04
      • Click the + sign at the right side of VPN list.
  • A VPN connection type dialog box will pop out, choose IPSec/IKEv2 (Strongswan), click Create;
    • Now a configuration dialog box will pop out. fill in information as directed below;
      • Name: Any text you like to name the VPN connection
      • Gateway
        • Address: The VPN server’s domain name IT sent to you.
        • Certificate: Browse to choose the certificate file you received. 
      • Client
        • Authentication: Select “EAP
        • Username: Use the userid that is given to you.
        • Password:
          • Click the icon at the end of input box.
          • Select the 2nd option: Store the password for all users.
          • Input your password
      • Options:
        • Make sure you check the “Request an inner IP address”.
        • Optionally you may also check Enforce UDP encapsulation
        • Leave use IP compression unchecked.
      • Cipher Proposals
        • Leave this section blank.
    • Finally click the “Add” button to save the configuration.

如何设置IPSec VPN客户端》有45,008个想法

  1. kem tẩy lông vùng kín veet mua ở đâu

    Thuốc Aspirin được điều chế có thành phần axit salicylic/ axit betahydroxyl . Bên cạnh đó, chúng còn có khả năng tẩy tế bào chết trên da, giúp làm lành vùng da bị tổn thương do mụn mủ viêm gây ra, trả lại vùng da mới. Đặc biệt, Aspirin còn có thể hút nước từ mô biểu bì, thúc đẩy các vùng da bị mụn m

    回复
  2. mua kem tẩy lông vùng kín ở đâu

    Phù hợp với hầu hết các loại da miễn là nền da không có mụn, đang muốn dưỡng trắng giảm thâm. Dưới đây là những sản phẩm mình đang sử dụng và thấy khá “ổn áp” thời gian gần đây. Mọi người có thể tham khảo để chọn được một routine phù hợp cho bản thân mình nhất nhé. Đây là vị thuốc có thể sử dụng đượ

    回复
  3. Gould Malling

    This telephone interview is very important, it’s not necessary to want any distractions will certainly keep you from being your best and making a good impression. The easiest thing in order to can control to reach that goal is racket is so factor. Choose a quiet in order to have this conversation, c

    回复
  4. Vargas Bradford

    Hegy International is probably the leading Pest Control & Cleaning Service company in Doha Qatar that is providing top quality termite treatment , pest control services & Cleaning Services to private residences, restaurants, buildings, hotels, malls and other commercial establishments in Doha Qatar.

    回复
  5. Daniel Blanton

    I have been surfing online more than 4 hours today, yet I never found any interesting article like yours.
    It is pretty worth enough for me. In my view, if all site owners and bloggers made good content as you did, the web will be a lot more useful than ever before.

    回复
  6. Leonard Mccann

    Usually I do not learn post on blogs, however I wish to say that this write-up very pressured me to try and do so! Your writing taste has been surprised me. Thank you, very nice post.

    回复
  7. nạp gas điều hòa bao nhiêu tiền

    Sau đó, nhân viên tư vấn sẽ ghi nhận thông tin và sắp xếp, điều phối nhân viên kỹ thuật đến nhà của khách hàng. Theo Quy trình nạp fuel điều hòa, thợ nạp fuel sẽ kiểm tra áp suất fuel trong bình chứa xem có bị hao fuel không? Sau đó báo cáo Quý khách hàng duyệt phương án có cần thiết nạp thêm fuel đ

    回复
  8. Walton Macdonald

    To select a game are determined by your a unique character. If you are a man who is not interested to consider a lot then might have then you could have consider charming slots. It is an extremely exiting game, needs fewer of plans trip preserves the characteristic of fun and also enthusiasm coupled

    回复
  9. Scott Childers

    The simple truth is the only person that could decide attempting to good-looking or even otherwise is the person. We’re all conditioned by the media to belief what’s deemed attractive and what isn’t. I have been called hot and ugly by various people but I’d in order to decide I was hot, and so i beh

    回复
  10. Voss Overgaard

    Gas 410 làm sao châm thêm được mà báo giá 1psi là 7-10 ngàn . Bảng báo giá bảo trì vệ sinh và nạp gasoline trên chưa bao gồm thuế VAT 10%. Lúc này đồng hồ hạ áp về độ ẩm, bạn tiến hành khóa van lại và tắt mát hút để trong vòng từ 30 phút đến 60 phút. Cho đến khi kim đồng hồ chỉ đến vạch số zero thì

    回复
  11. Blowjob

    Currently it seems like Movable Type is the preferred blogging platform available right now.
    (from what I’ve read) Is that what you are using on your blog?

    回复
  12. Matthew Liz

    It is the best time to make some plans for the future and
    it is time to be happy. I’ve read this post and if I could I wish to suggest
    you some interesting things or suggestions.

    Perhaps you could write next articles referring to this article.
    I wish to read more things about it!

    回复
  13. kem tẩy lông vùng kín veet mua ở đâu

    Vì vậy, lông vùng kín không có tác dụng bảo vệ vùng âm đạo như nhiều người nghĩ, nên việc loại bỏ nó sẽ không gây hại. Trên đây là những loại kem tẩy lông đình đám, được yêu thích tại xứ sở hoa anh đào. Với những sản phẩm trên hello vọng bạn sẽ có sự lựa chọn sáng suốt cho mình để có một làn da sáng

    回复
  14. Cortez Gardner

    I’ve been browsing on-line greater than 3 hours lately, but I by no
    means discovered any attention-grabbing article like yours.
    It’s pretty value sufficient for me. In my view, if all website owners
    and bloggers made good content as you did, the internet can be a lot more helpful than ever before.

    回复
  15. Foss Johns

    Allow me to turning up living by enjoying poker on line you should. As those produced a pretty good job of it many times as a way of playing poker. All these tips and strategies and techniques he has won an incredible three times you have. Becoming a dealer are each dealt three cards that cater for

    回复
  16. Pearce Parks

    But what happens if the dealer and the guitar player happens to get cards which are of equal value? Goes on frequently as it would be an entire deck of 52 cards used. The real Casino War game starts when either the player or the card dealer goes to war or is forced to surrender.First off,

    回复
  17. party character

    Nice post. I used to be checking constantly this blog and I am inspired!
    Extremely helpful information specifically the final part 🙂 I deal with such
    information much. I was looking for this certain info for a very lengthy time.
    Thanks and best of luck.

    回复
  18. Akhtar Baldwin

    There are several people that use free typefaces but are not aware of precisely what the typefaces changers are. We can locate various typefaces on-line but are they well worth to download and spending money on? This is something you need to realize when using any of these fonts.There are

    回复
  19. Singleton Mccall

    Powerball prizes are given for different reasons. The jackpot prize is directed at the winner. Other prizes may be for drawing number combinations and/or specific number combinations. Powerball winners receive additional chances at winning the jackpot. In addition, Powerball players may also be awar

    回复
  20. Honore Damsgaard

    Have you ever given home security serious thought? Are you unsure about what steps need to be taken to ensure your safety while in the home? If so, you will find some great information in the article that follows. Read through it carefully and learn about home security tips and advice.If y

    回复
  21. Walls Bank

    If you utilize the internet frequently you possess surely presently been aware of typefaces changers. These are free of charge software that supply a huge range of efficiency and useful functionality to your Microsoft windows. For example, if you use Microsoft Phrase it can be probably probably the

    回复
  22. https

    My family members all the time say that I am wasting my
    time here at net, however I know I am getting experience
    daily by reading such good content.

    回复
  23. Bertram Nixon

    A more advanced burglar alarm system will have windows home security systems sensors speculate we are talking by the home security essentials were going to be using a motion detector to give our windows home security protection. regardless of what we conscious of when a burglar enters household.<br/

    回复
  24. Josefsen Osborne

    In most states where powerball prizes are awarded, the prize money will undoubtedly be distributed among winning players. A small portion of the prize money is kept by the Powerball Company being an ongoing support for the standard Powerball game. You can find Powerball prizes for jackpots of $1M an

    回复
  25. 争取大脑

    Awesome blog! Do you have any helpful hints for aspiring writers?
    I’m planning to start my own website soon but I’m a
    little lost on everything. Would you recommend starting with a free platform like WordPress or go for a paid option? There
    are so many choices out there that I’m completely overwhelmed
    .. Any tips? Kudos!

    回复
  26. Carljek

    [url=https://viagrapoint.com/]cheap viagra.com[/url] [url=https://viagrabtc.com/]pharmacy rx viagra[/url] [url=https://cialismore.com/]cialis 20mg india price[/url] [url=https://drugstore555.com/]cheap scripts pharmacy[/url] [url=https://cialiscap.com/]cialis rx cost[/url]

    回复
  27. Burris Miller

    Let us take the managing your risk issue first. Whenever you trade should really already be utilizing proper risk management. What i mean is you should never be risking a more then 2-5% of your bank account on any one single trade.Packing is yet area fitted to professionals. A knowledgeabl

    回复
  28. Charles Whitley

    Hey There. I found your blog the use of msn. This is an extremely
    well written article. I’ll be sure to bookmark it and return to read more
    of your helpful information. Thanks for the post.
    I will definitely return.

    回复
  29. Donald Trump coin

    Please let me know if you’re looking for a article writer for your blog.
    You have some really good posts and I think I would be a good asset.
    If you ever want to take some of the load off, I’d really like to
    write some content for your blog in exchange
    for a link back to mine. Please send me an e-mail if interested.
    Thanks!

    回复
  30. Lehman Atkinson

    When you want to install a home security system, you have to know all of your options. There have been many innovations in home security, and it’s important that you know what is available to you. Keep reading to find out more about this subject so that you can protect your family.If you h

    回复
  31. Singh Pollock

    The Washington State Powerball Association is responsible for maintaining a strong and consistent Powerball line in the state. However, many players in other states have found it hard to discover a viable Powerball site in Washington. Well, I’m happy to tell you that there are more than a few Powerb

    回复

发表评论

邮箱地址不会被公开。