参考：http://blog.csdn.net/kitvv/article/details/50696585
以前的文章（centos搭建PPTP实现VPN）：http://www.jb51.cc/article/p-uafjbyel-bbb.html
1 先看看你的主机是否支持pptp，返回结果为yes就表示通过。
modprobe ppp-compress-18 && echo yes2 是否开启了TUN，有的虚拟机主机需要开启，返回结果为cat: /dev/net/tun: File descriptor in bad state。就表示通过。
cat /dev/net/tun
3 更新一下再安装
yum install update yum update -y4 安装EPEL源（CentOS7官方源中已经去掉了xl2tpd）
yum install -y epel-release
5 安装xl2tpd和libreswan(openswan已经停止维护)
yum install -y xl2tpd libreswan lsof
6 编辑xl2tpd配置文件
vim /etc/xl2tpd/xl2tpd.conf
[global] [lns default] ip range = 192.168.1.100-192.168.1.150 local ip = 192.168.1.1 require chap = yes refuse pap = yes require authentication = yes name = LinuxVPNserver ppp debug = yes pppoptfile = /etc/ppp/options.xl2tpd length bit = yes
7 编辑pppoptfile文件
vim /etc/ppp/options.xl2tpd
ipcp-accept-local ipcp-accept-remote ms-dns 8.8.8.8 ms-dns 209.244.0.3 ms-dns 208.67.222.222 name xl2tpd # ms-wins 192.168.1.2 # ms-wins 192.168.1.4 #noccp auth #crtscts # 这个加上centos会报错 idle 1800 mtu 1410 mru 1410 nodefaultroute debug #lock # 这个加上centos会报错 proxyarp connect-delay 5000 refuse-pap refuse-mschap require-mschap-v2 persist logfile /var/log/xl2tpd.log
8 编辑ipsec配置文件（默认就好）
vim /etc/ipsec.conf
config setup
protostack=netkey
dumpdir=/var/run/pluto/
virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:25.0.0.0/8,%v4:100.64.0.0/10,%v6:fd00::/8,%
v6:fe80::/10
include /etc/ipsec.d/*.conf
9 编辑include的conn文件
vim /etc/ipsec.d/l2tp-ipsec.conf
conn L2TP-PSK-NAT
rightsubnet=0.0.0.0/0
dpddelay=10
dpdtimeout=20
dpdaction=clear
forceencaps=yes
also=L2TP-PSK-noNAT
conn L2TP-PSK-noNAT
authby=secret
pfs=no
auto=add
keyingtries=3
rekey=no
ikelifetime=8h
keylife=1h
type=transport
left=172.31.19.114 # 这个是ifconfig网卡eth0的内网IP，后面通过NAT转发
leftprotoport=17/1701
right=%any
rightprotoport=17/%any
10 设置用户名密码
vim /etc/ppp/chap-secrets
vpnuser * pass *说明：
用户名[空格]service[空格]密码[空格]指定IP
11 设置PSK
vim /etc/ipsec.d/default.secrets
: PSK "testvpn"12 CentOS7防火墙设置（7以下的用iptables）
firewall-cmd --permanent --add-service=ipsec firewall-cmd --permanent --add-port=1701/udp firewall-cmd --permanent --add-port=4500/udp firewall-cmd --permanent --add-masquerade firewall-cmd --reload
如果出现
FirewallD is not running先执行下面这个语句开启防火墙，然后再执行上面的
systemctl start firewalld
CentOS 7 以下IPTABLES设置
iptables -A INPUT -p tcp --dport 1723 -j ACCEPT iptables -A INPUT -p tcp --dport 47 -j ACCEPT iptables -A INPUT -p gre -j ACCEPT iptables -A POSTROUTING -t nat -s 192.168.9.0/24 -o eth0 -j MASQUERADE iptables -A INPUT -p UDP --dport 53 -j ACCEPT
13 IP_FORWARD 设置
vim /etc/sysctl.d/60-sysctl_ipsec.conf
net.ipv4.ip_forward = 1 net.ipv4.conf.all.accept_redirects = 0 net.ipv4.conf.all.rp_filter = 0 net.ipv4.conf.all.send_redirects = 0 net.ipv4.conf.default.accept_redirects = 0 net.ipv4.conf.default.rp_filter = 0 net.ipv4.conf.default.send_redirects = 0 net.ipv4.conf.eth0.accept_redirects = 0 net.ipv4.conf.eth0.rp_filter = 0 net.ipv4.conf.eth0.send_redirects = 0 net.ipv4.conf.eth1.accept_redirects = 0 net.ipv4.conf.eth1.rp_filter = 0 net.ipv4.conf.eth1.send_redirects = 0 net.ipv4.conf.eth2.accept_redirects = 0 net.ipv4.conf.eth2.rp_filter = 0 net.ipv4.conf.eth2.send_redirects = 0 net.ipv4.conf.ip_vti0.accept_redirects = 0 net.ipv4.conf.ip_vti0.rp_filter = 0 net.ipv4.conf.ip_vti0.send_redirects = 0 net.ipv4.conf.lo.accept_redirects = 0 net.ipv4.conf.lo.rp_filter = 0 net.ipv4.conf.lo.send_redirects = 0 net.ipv4.conf.ppp0.accept_redirects = 0 net.ipv4.conf.ppp0.rp_filter = 0 net.ipv4.conf.ppp0.send_redirects = 0
重启生效
systemctl restart network
14 ipsec启动&检查
systemctl enable ipsec systemctl restart ipsec检查：
ipsec verify
正常输出：
Verifying installed system and configuration files
Version check and ipsec on-path [OK]
Libreswan 3.15 (netkey) on 3.10.0-123.13.2.el7.x86_64
Checking for IPsec support in kernel [OK]
NETKEY: Testing XFRM related proc values
ICMP default/send_redirects [OK]
ICMP default/accept_redirects [OK]
XFRM larval drop [OK]
Pluto ipsec.conf Syntax [OK]
Hardware random device [N/A]
Two or more interfaces found,checking IP forwarding [OK]
Checking rp_filter [OK]
Checking that pluto is running [OK]
Pluto listening for IKE on udp 500 [OK]
Pluto listening for IKE/NAT-T on udp 4500 [OK]
Pluto ipsec.secret Syntax [OK]
Checking 'ip' command [OK]
Checking 'iptables' command [OK]
Checking 'prelink' command does not interfere with FIPSChecking for obsolete ipsec.conf options [OK]
Opportunistic Encryption [DISABLED]
15 xl2tpd启动
systemctl enable xl2tpd systemctl restart xl2tpd注意：以上配置文件直接复制粘贴可能会出现格式问题等等
其余问题可以查看日志 /var/log/message 或者 /var/log/xl2tpd.log
