操作系统为:Centos 5.7

拓扑如下:
 
局域网A---Linux防火墙A-----公网------Linux防火墙B----局域网B
 
局域网A的网段:192.168.2.0/24
Linux防火墙A   内网接口eth1:192.168.2.1/24
               外网接口eth0: 192.168.1.1/24
 
局域网B的网段:192.168.3.0/24
Linux防火墙B   内网接口eth1:192.168.3.1/24
               外网接口eth0: 192.168.1.2/24
 
下面对Linux防火墙B进行操作  A配置大概一致
 
安装ipsec ***所需要的openswan
 
[root@gw ~]#yum install openswan
 
打开路由转发
[root@gw ~]#vim /etc/sysctl.conf 
net/ipv4/ip_forward = 1
net.ipv4.conf.default.rp_filter = 0
使其生效
[root@gw ~]#sysctl -p
 
禁止icmp重定向
[root@gw ~]# vim disableimcp.txt
for each in /proc/sys/net/ipv4/conf/*
 do
 echo0 > $each/accept_redirects
 echo0 > $each/send_redirects
 done
 
[root@gw ~]# chmod 755 disableimcp.txt
[root@gw ~]# sh disableimcp.txt
 
定义ipsec的预共享密钥
[root@gw ~]# cat /etc/ipsec.secrets
#include /etc/ipsec.d/*.secrets
#本端地址   对端地址          共享密钥
192.168.1.2 192.168.1.1 : PSK 'my***'
#假如中心为固定IP,对端为ADSL动态地址 则使用以下,让客户端主动发起就行了
192.168.1.2 %any : PSK  'my***'
 
编辑ipsec.conf文档
[root@gw ~]# cat /etc/ipsec.conf
# /etc/ipsec.conf - Openswan IPsecconfiguration file
#
# Manual:     ipsec.conf.5
#
# Please place your own config files in/etc/ipsec.d/ ending in .conf
 
version 2.0     # conforms to second version of ipsec.confspecification
 
# basic configuration
config setup
       # Debug-logging controls: "none" for (almost) none, "all" for lots.
       # klipsdebug=none
       # plutodebug="control parsing"
       # For Red Hat Enterprise Linux and Fedora, leave protostack=netkey
       protostack=netkey
       nat_traversal=yes
       virtual_private=
       oe=off
       # Enable this if you see "failed to find any available worker"
       # nhelpers=0
 
#You may put your configuration (.conf)file in the "/etc/ipsec.d/" and uncomment this.
#include /etc/ipsec.d/*.conf
#在后面增加以下内容
conn haiwang
       left=192.168.1.2
       leftsubnet=192.168.3.0/255.255.255.0
       right=192.168.1.1
       rightsubnet=192.168.2.0/255.255.255.0
       ike=3des-md5-modp1024!
       esp=3des-md5!
       ikelifetime=1h
       keylife=8h
        dpddelay=30
       dpdtimeout=120
       dpdaction=restart
       pfs=no
       authby=secret
       auto=start
 
5 iptables防火墙设定
[root@gw ~]#iptables -t nat -A POSTROUTING -s 192.168.3.0/24 -d ! 192.168.2.0/24 -j SNAT --to 192.168.1.2   ##注意:到×××对端的流量不要走NAT出防火墙
[root@gw ~]#iptables -A FORWARD -s 192.168.3.0/24 -j ACCEPT
[root@gw ~]#iptables -A FORWARD -d 192.168.3.0/24 -j ACCEPT
[root@gw ~]#iptables -A INPUT -p udp --dport 500 -j ACCEPT
[root@gw ~]#iptables -A INPUT -p udp --dport 4500 -j ACCEPT
 
验证一下
[root@gw ~]# ipsec verify
Checking your system to see if IPsec gotinstalled and started correctly:
Version check and ipsec on-path                                 [OK]
Linux Openswan U2.6.32/K2.6.18-274.el5(netkey)
Checking for IPsec support in kernel                            [OK]
 SAref kernel support                                          [N/A]
 NETKEY: Testing for disabled ICMP send_redirects              [OK]
NETKEY detected, testing for disabled ICMPaccept_redirects     [OK]
Checking that pluto is running                                  [OK]
 Pluto listening for IKE on udp 500                             [OK]
 Pluto listening for NAT-T on udp 4500                          [OK]
Two or more interfaces found, checking IPforwarding            [OK]
Checking NAT and MASQUERADEing                                  [OK]
Checking for 'ip' command                                       [OK]
Checking /bin/sh is not /bin/dash                               [OK]
Checking for 'iptables' command                                 [OK]
Opportunistic Encryption Support                                [DISABLED]
看下×××的路由表咋走的
 [root@gw ~]# ipsec look
gw.haiwang.com Sun Aug 26 18:21:38 CST 2012
IPSEC TABLE
iptables: No chain/target/match by that name
ROUTING TABLE
192.168.1.0/24 dev eth0  proto kernel  scope link  src 192.168.1.2
default via 192.168.1.254 dev eth0
B局域网的一个机器ping局域网A的一个机器
 Ping通就对了