openswan不一樣應用情景配置方法

場景1

192.168.28.213<192.168.28.213>[+S=C]...192.168.28.214[+S=C]===162.168.1.0/24

conn test
    left=192.168.28.213
    right=%any          
    rightsubnet=vhost:%no,%priv
    auto=add                  
    authby=secret
    ike=3des-md5!
    ikelifetime=3600s
    type=transport
    esp=3des-md5!
    keylife=28800s    
    pfs=no

conn ipsec_1
    left=192.168.28.214
    leftsubnet=162.168.1.0/24
    right=192.168.28.213
    auto=add
    authby=secret
    leftid=192.168.28.214
    rightid=192.168.28.213
    ike=3des-md5
    ikelifetime=3600s
    type=transport
    esp=3des-md5
    keylife=28800s
    pfs=no

場景2

192.168.28.213<192.168.28.213>[+S=C]...192.168.28.214[+S=C]

conn test
    left=192.168.28.213
    right=%any          
    rightsubnet=vhost:%no,%priv
    auto=add                  
    authby=secret
    ike=3des-md5!
    ikelifetime=3600s
    type=transport
    esp=3des-md5!
    keylife=28800s    
    pfs=no

conn ipsec_1
    left=192.168.28.214
    right=192.168.28.213
    auto=add
    authby=secret
    leftid=192.168.28.214
    rightid=192.168.28.213
    ike=3des-md5
    ikelifetime=3600s
    type=transport
    esp=3des-md5
    keylife=28800s
    pfs=no

場景3

網絡拓撲

192.165.1.1/24      192.168.252.8   192.168.252.5    / vlan1 192.166.1.1/24                                                                   
                  /------\                   /------\  /
                  |  S   |===================|  C   |-X
                  \------/                   \------/  \
                                                        \ vlan2 192.167.1.0/24

S端配置

conn lantolan2
    left=192.168.252.8
    leftsubnet=192.165.1.0/24
    right=%any
    rightsubnet=vhost:%no,%priv
    auto=add
    authby=secret
    leftid=192.168.252.8
    rightid=192.168.252.5
    ike=des-md5-modp1024!
    ikelifetime=3600s
    type=tunnel
    esp=des-md5!
    keylife=28800s
    pfs=no

C端配置

conn lantolan1
    left=192.168.252.5
    leftsubnet=192.166.1.0/24
    right=192.168.252.8
    rightsubnet=192.165.1.0/24
    auto=add
    authby=secret
    leftid=192.168.252.5
    rightid=192.168.252.8
    ike=des-md5-modp1024!
    ikelifetime=3600s
    type=tunnel
    esp=des-md5!
    keylife=28800s
    pfs=no

conn test
    left=192.168.252.5
    leftsubnet=192.167.1.0/24
    right=192.168.252.8
    rightsubnet=192.165.1.0/24
    auto=add
    authby=secret
    leftid=192.168.252.5
    rightid=192.168.252.8
    ike=des-md5-modp1024!
    ikelifetime=3600s
    type=tunnel
    esp=des-md5!
    keylife=28800s
    pfs=no

場景4

網絡拓撲 (注意網絡拓撲)

10.61.2.1/24
        PC1
           \          10.61.2.254/8                              10.61.48.254/24
            \_________________                         
                              \ /-------\                    /--------\        10.61.48.1/24
                               |   S     |===================|   C    |---------PC3
             _________________/ \-------/                    \--------/
            /       
           /          10.61.1.254/8
         PC2
    10.61.1.1/24

注意：
PC1和PC2的IP地址，若是PC1和PC2的IP地址爲10.61.0.0/8這個網段就不能互通了，由於PC會創建一條這個網段到本地的一條路由

S端配置

conn ss
    left=192.168.28.213
    leftsubnet=10.61.0.0/16
    right=192.168.28.214
    rightsubnet=10.61.48.0/24
    auto=add
    authby=secret
    leftid=192.168.28.213
    rightid=192.168.28.214
    ike=3des-md5!
    ikelifetime=3600s
    type=tunnel
    esp=3des-md5!
    keylife=28800s
    pfs=no

C端配置

conn s1200
    left=192.168.28.214
    leftsubnet=10.61.48.0/24
    right=192.168.28.213
    rightsubnet=10.61.0.0/16
    auto=add
    authby=secret
    leftid=192.168.28.214
    rightid=192.168.28.213
    ike=3des-md5
    ikelifetime=3600s
    type=tunnel
    esp=3des-md5
    keylife=28800s
    pfs=no