set firewall name WAN_LOCAL rule 210 action accept
set firewall name WAN_LOCAL rule 210 description 'ipsec'
set firewall name WAN_LOCAL rule 210 ipsec match-ipsec
set firewall name WAN_LOCAL rule 210 log disable
set firewall name WAN_LOCAL rule 210 protocol all
VyOS端，我们之前已经做过这个配置，不必重复了。
路由
要让流量通过GRE隧道转发，还需要配置相应的路由。下面我们就用静态路由作为参考。
EdgeOS端
set protocols static route 10.1.0.0/24 next-hop 10.254.0.2 description 'right side via GRE over IPSec'
set protocols static route 10.1.0.0/24 next-hop 10.254.0.2 distance 100
commit;save;exit
VyOS端
set protocols static route 10.0.0.0/24 next-hop 10.254.0.1 description 'right side via GRE over IPSec'
set protocols static route 10.0.0.0/24 next-hop 10.254.0.1 distance 100
commit;save;exit
[email protected]:~$ generate vpn rsa-key
Generating 2048 bit rsa-key to /config/ipsec.d/rsa-keys/localhost.key
.........+++++
...........................+++++
Your new local RSA key has been generated
The public portion of the key is:
0sAwEAAe7k2zE85tw4T7BGQGjkGEcIB3K7PnktckNx/JskpkhAjcU3TE7Q9xj6MtjWw794XKNFk2cnGmLCD9tkNPK30vITi3quJQxVNfuTJy3rFT6uJfPxyNsnCr+D483UNYdJThtsac8zenBoqQVMS5O50Db7/6UFdKF6QsoAMd9aRyROFZ+3RBiPe3uDMMwCaFEW28EFKN3Ye47LTCk1r1V/cXIUsMa9uVkgy9b5Axp+FnYwDl84m2mbViE+/sm7WPRGpuR15nFVwZHlk8Fj+USXMmjdteqOzq0Q19I4ma7v15LLdKlhhboxJiwjO/OqRzKsW4zt+5GcvbCagF6PzM942ok=
configure
set vpn rsa-keys local-key file /config/ipsec.d/rsa-keys/localhost.key
set vpn rsa-keys rsa-key-name local-pub rsa-key 0sAwEAAe7k2zE85tw4T7BGQGjkGEcIB3K7PnktckNx/JskpkhAjcU3TE7Q9xj6MtjWw794XKNFk2cnGmLCD9tkNPK30vITi3quJQxVNfuTJy3rFT6uJfPxyNsnCr+D483UNYdJThtsac8zenBoqQVMS5O50Db7/6UFdKF6QsoAMd9aRyROFZ+3RBiPe3uDMMwCaFEW28EFKN3Ye47LTCk1r1V/cXIUsMa9uVkgy9b5Axp+FnYwDl84m2mbViE+/sm7WPRGpuR15nFVwZHlk8Fj+USXMmjdteqOzq0Q19I4ma7v15LLdKlhhboxJiwjO/OqRzKsW4zt+5GcvbCagF6PzM942ok=
同样，在右端VyOS侧执行同样的命令。
[email protected]:~$ generate vpn rsa-key
Generating rsa-key to /config/ipsec.d/rsa-keys/localhost.key
Generating RSA private key, 2192 bit long modulus (2 primes)
.+++++
.........................+++++
e is 65537 (0x010001)
Your new local RSA key has been generated
The public portion of the key is:
0sAwEAAd3MOCvSY2WnMCz9uVOLO34o+Cmhwlld+ldz0iP+x4jdCiD/676r5C4hfc9m8VDWfaFy/Ya6r4cprfM6XuPymRH+VgRPXoHafBdLY+1y6//HES/f2QUGqRfxjIbDn6fzDBqLHSPIB8eryYA6YFj0cgZMlG7EJGmkk/yEP5nziGJUHHKyGu+yAXdEsHoHar4Fp13hdzzdXFiqQ6hNg4LP3q8cTOiXVd1Ba3UuAwH+9tiLxUmPOBkYQXBxcBrlYu9tkU9kGB0vOj6crMnCt73qUO9aOrLSK8qEoi/4JnHLA9HHNna9fcTlCrn7fXRANzq0CYHfoyoosUhRIBnzeqUzGcDvCZ3diMxm8pmKI3vWD8RdUqs=
并且把两端的公钥都保存到VyOS配置里。
configure
set vpn rsa-keys local-key file /config/ipsec.d/rsa-keys/localhost.key
set vpn rsa-keys rsa-key-name local-pub rsa-key 0sAwEAAd3MOCvSY2WnMCz9uVOLO34o+Cmhwlld+ldz0iP+x4jdCiD/676r5C4hfc9m8VDWfaFy/Ya6r4cprfM6XuPymRH+VgRPXoHafBdLY+1y6//HES/f2QUGqRfxjIbDn6fzDBqLHSPIB8eryYA6YFj0cgZMlG7EJGmkk/yEP5nziGJUHHKyGu+yAXdEsHoHar4Fp13hdzzdXFiqQ6hNg4LP3q8cTOiXVd1Ba3UuAwH+9tiLxUmPOBkYQXBxcBrlYu9tkU9kGB0vOj6crMnCt73qUO9aOrLSK8qEoi/4JnHLA9HHNna9fcTlCrn7fXRANzq0CYHfoyoosUhRIBnzeqUzGcDvCZ3diMxm8pmKI3vWD8RdUqs=
set vpn rsa-keys rsa-key-name edgeos-pub rsa-key 0sAwEAAe7k2zE85tw4T7BGQGjkGEcIB3K7PnktckNx/JskpkhAjcU3TE7Q9xj6MtjWw794XKNFk2cnGmLCD9tkNPK30vITi3quJQxVNfuTJy3rFT6uJfPxyNsnCr+D483UNYdJThtsac8zenBoqQVMS5O50Db7/6UFdKF6QsoAMd9aRyROFZ+3RBiPe3uDMMwCaFEW28EFKN3Ye47LTCk1r1V/cXIUsMa9uVkgy9b5Axp+FnYwDl84m2mbViE+/sm7WPRGpuR15nFVwZHlk8Fj+USXMmjdteqOzq0Q19I4ma7v15LLdKlhhboxJiwjO/OqRzKsW4zt+5GcvbCagF6PzM942ok=
回到左边的EdgeOS，我们再把VyOS的公钥保存到配置里。
set vpn rsa-keys rsa-key-name vyos-pub rsa-key 0sAwEAAd3MOCvSY2WnMCz9uVOLO34o+Cmhwlld+ldz0iP+x4jdCiD/676r5C4hfc9m8VDWfaFy/Ya6r4cprfM6XuPymRH+VgRPXoHafBdLY+1y6//HES/f2QUGqRfxjIbDn6fzDBqLHSPIB8eryYA6YFj0cgZMlG7EJGmkk/yEP5nziGJUHHKyGu+yAXdEsHoHar4Fp13hdzzdXFiqQ6hNg4LP3q8cTOiXVd1Ba3UuAwH+9tiLxUmPOBkYQXBxcBrlYu9tkU9kGB0vOj6crMnCt73qUO9aOrLSK8qEoi/4JnHLA9HHNna9fcTlCrn7fXRANzq0CYHfoyoosUhRIBnzeqUzGcDvCZ3diMxm8pmKI3vWD8RdUqs=
set firewall name WAN_LOCAL rule 200 action 'accept'
set firewall name WAN_LOCAL rule 200 description 'ipsec ike'
set firewall name WAN_LOCAL rule 200 destination port '500,4500'
set firewall name WAN_LOCAL rule 200 log 'disable'
set firewall name WAN_LOCAL rule 200 protocol 'udp'
set firewall name WAN_LOCAL rule 201 action 'accept'
set firewall name WAN_LOCAL rule 201 description 'ipsec esp'
set firewall name WAN_LOCAL rule 201 log 'disable'
set firewall name WAN_LOCAL rule 201 protocol 'esp'
set firewall name WAN_LOCAL rule 210 action 'accept'
set firewall name WAN_LOCAL rule 210 description 'ipsec traffic'
set firewall name WAN_LOCAL rule 210 log 'disable'
set firewall name WAN_LOCAL rule 210 protocol 'all'
set firewall name WAN_LOCAL rule 210 ipsec match-ipsec
set firewall name WAN_IN rule 210 action 'accept'
set firewall name WAN_IN rule 210 description 'ipsec traffic'
set firewall name WAN_IN rule 210 log 'disable'
set firewall name WAN_IN rule 210 protocol 'all'
set firewall name WAN_IN rule 210 ipsec match-ipsec
NAT
我们需要配置地址转换规则，把隧道流量排除在出口NAT之外。
set nat source rule 10 description 'exclude ipsec'
set nat source rule 10 destination address '10.0.0.0/24'
set nat source rule 10 source address '10.1.0.0/24'
set nat source rule 10 exclude
set nat source rule 10 outbound-interface 'eth0'
set nat source rule 10 protocol 'all'
set nat source rule 10 translation address 'masquerade'
IPSec
然后是配置VPN。
set vpn ipsec auto-update 30
set vpn ipsec esp-group ESP_GRP compression disable
set vpn ipsec esp-group ESP_GRP lifetime 3600
set vpn ipsec esp-group ESP_GRP mode tunnel
set vpn ipsec esp-group ESP_GRP pfs enable
set vpn ipsec esp-group ESP_GRP proposal 1 encryption aes256
set vpn ipsec esp-group ESP_GRP proposal 1 hash sha1
set vpn ipsec ike-group IKE_V1 dead-peer-detection action restart
set vpn ipsec ike-group IKE_V1 dead-peer-detection interval 30
set vpn ipsec ike-group IKE_V1 dead-peer-detection timeout 120
set vpn ipsec ike-group IKE_V1 ikev2-reauth no
set vpn ipsec ike-group IKE_V1 key-exchange ikev1
set vpn ipsec ike-group IKE_V1 lifetime 28800
set vpn ipsec ike-group IKE_V1 proposal 1 dh-group 2
set vpn ipsec ike-group IKE_V1 proposal 1 encryption aes256
set vpn ipsec ike-group IKE_V1 proposal 1 hash sha1
set vpn ipsec ike-group IKE_V2 dead-peer-detection action restart
set vpn ipsec ike-group IKE_V2 dead-peer-detection interval 30
set vpn ipsec ike-group IKE_V2 dead-peer-detection timeout 120
set vpn ipsec ike-group IKE_V2 ikev2-reauth no
set vpn ipsec ike-group IKE_V2 key-exchange ikev2
set vpn ipsec ike-group IKE_V2 lifetime 28800
set vpn ipsec ike-group IKE_V2 proposal 1 dh-group 2
set vpn ipsec ike-group IKE_V2 proposal 1 encryption aes256
set vpn ipsec ike-group IKE_V2 proposal 1 hash sha1
set vpn ipsec ipsec-interfaces interface eth0
set vpn ipsec nat-traversal enable
edit vpn ipsec site-to-site peer edgeos.ddns.com
set authentication id vyos.ddns.com
set authentication mode rsa
set authentication remote-id edgos.ddns.com
set authentication rsa-key-name edgeos-pub
set connection-type respond
set description 'ipsec tunnel vyos ... edgeos'
set ike-group IKE_V2
set ikev2-reauth inherit
set local-address any
set tunnel 0 allow-nat-networks disable
set tunnel 0 allow-public-networks disable
set tunnel 0 esp-group ESP_GRP
set tunnel 0 local prefix 10.1.0.0/24
set tunnel 0 remote prefix 10.0.0.0/24
configure
edit service dns dynamic interface pppoe0 service custom-cloudflare
set host-name www.yoursite.com
set login your_cloudflare_email
set password your_cloudflare_global_API_key
set protocol cloudflare
set options "zone=yoursite.com"
commit;save;exit
#!/bin/bash
# A bash script to update a Cloudflare DNS A record with the external IP of the source machine
# Used to provide DDNS service for my home
# Needs the DNS record pre-creating on Cloudflare
# Cloudflare zone is the zone which holds the record
zone="yourdomain.com"
# dnsrecord is the A record which will be updated
dnsrecord="www.yourdomain.com"
# Cloudflare authentication details, keep these private
cloudflare_auth_email="[email protected]"
cloudflare_auth_key="your_cloudflare_global_API_key"
log_file="/var/log/cloudflare.log"
# LOGGER
log() {
if [ "$1" ]; then
echo -e "[$(date)] - $1" >> $log_file
fi
}
# Get the current external IP address
ip=$(curl -s -X GET https://checkip.amazonaws.com)
echo "Current IP is $ip"
if host $dnsrecord 8.8.8.8 | grep "has address" | grep "$ip"; then
echo "$dnsrecord is currently set to $ip; no changes needed"
exit
fi
# if here, the dns record needs updating
# get the zone id for the requested zone
zoneid=$(curl -s -X GET "https://api.cloudflare.com/client/v4/zones?name=$zone&status=active" \
-H "X-Auth-Email: $cloudflare_auth_email" \
-H "X-Auth-Key: $cloudflare_auth_key" \
-H "Content-Type: application/json" | jq -r '{"result"}[] | .[0] | .id')
echo "Zoneid for $zone is $zoneid"
# get the dns record id
dnsrecordid=$(curl -s -X GET "https://api.cloudflare.com/client/v4/zones/$zoneid/dns_records?type=A&name=$dnsrecord" \
-H "X-Auth-Email: $cloudflare_auth_email" \
-H "X-Auth-Key: $cloudflare_auth_key" \
-H "Content-Type: application/json" | jq -r '{"result"}[] | .[0] | .id')
echo "DNSrecordid for $dnsrecord is $dnsrecordid"
# update the record
update=$(curl -s -X PUT "https://api.cloudflare.com/client/v4/zones/$zoneid/dns_records/$dnsrecordid" \
-H "X-Auth-Email: $cloudflare_auth_email" \
-H "X-Auth-Key: $cloudflare_auth_key" \
-H "Content-Type: application/json" \
--data "{\"type\":\"A\",\"name\":\"$dnsrecord\",\"content\":\"$ip\",\"ttl\":1,\"proxied\":false}")
if [[ $update == *"\"success\":false"* ]]; then
message="API UPDATE FAILED. DUMPING RESULTS:\n$update"
log "$message"
echo -e "$message"
exit 1
else
message="IP changed to: $ip"
log "$message"
echo "$message"
fi
configure
edit service dns dynamic interface pppoe0
set service noip host-name yourhost.ddns.net
set service noip login yourloginID
set service noip password yourloginpasswd
set service noip server dynupdate.no-ip.com
set web checkip.dyndns.com
commit;save;exit
configure
edit system task-scheduler task update_noip_pppoe0
set executable arguments 'update dns dynamic interface pppoe0'
set executable path /opt/vyatta/bin/vyatta-op-cmd-wrapper
set interval 1d
commit;save;exit
公云PubYun
公云是国内老牌DDNS提供商，这里就不赘述了，直接上干货。
configure
set service dns dynamic interface pppoe0 service custom-pubyun host-name yourdomain.f3322.net
set service dns dynamic interface pppoe0 service custom-pubyun login yourlogin
set service dns dynamic interface pppoe0 service custom-pubyun options ssl=no
set service dns dynamic interface pppoe0 service custom-pubyun password yourpasswd
set service dns dynamic interface pppoe0 service custom-pubyun protocol dyndns2
set service dns dynamic interface pppoe0 service custom-pubyun server www.pubyun.com
commit;save;exit
configure
set system task-scheduler task update-aliyun-ddns executable arguments 'myhostname'
set system task-scheduler task update-aliyun-ddns executable path '/config/scripts/update-aliddns.sh'
set system task-scheduler task update-aliyun-ddns interval '1m'
commit;save;exit
