AnyConnect搭建

安装

apt-get install ocserv

添加账号密码

ocpasswd -c /etc/ocserv/ocpasswd guest

生成证书

// 安装easy-rsa
sudo apt-get install easy-rsa

cd /usr/share/easy-rsa

// 配置vars，设置easy-rsa目录，keys生成目录
sudo vim vars

// 载入vars
source ./vars

// 生成cnf
sudo cp openssl-1.0.0.cnf openssl.cnf

// 生成ca证书
./build-ca

// 生成server证书，并设置common name
./build-key-server server

编辑配置

vim /etc/ocserv/ocserv.conf

参考配置，设置证书文件路径

auth = "plain[/etc/ocserv/ocpasswd]"
listen-host-is-dyndns = true
tcp-port = 11130
udp-port = 11130
run-as-user = nobody
run-as-group = daemon
socket-file = /var/run/ocserv-socket
server-cert = /etc/ocserv/ssl/server.crt
server-key = /etc/ocserv/ssl/server.key
ca-cert =  /etc/ocserv/ssl/ca.crt
isolate-workers = false
max-clients = 16
max-same-clients = 2
keepalive = 360000
dpd = 90
mobile-dpd = 1800
try-mtu-discovery = true
cert-user-oid = 2.5.4.3
tls-priorities = "NORMAL:%SERVER_PRECEDENCE:%COMPAT:-VERS-SSL3.0"
auth-timeout = 240
min-reauth-time = 300
max-ban-score = 50
ban-reset-time = 300
cookie-timeout = 86400
deny-roaming = false
rekey-time = 172800
rekey-method = ssl
use-occtl = true
pid-file = /var/run/ocserv.pid
device = vpns
predictable-ips = true
default-domain = example.com
ipv4-network = 10.12.0.0
ipv4-netmask = 255.255.255.0
dns = 8.8.8.8
dns = 8.8.4.4
#dns = 114.114.114.114
ping-leases = false
no-route = 192.168.1.0/255.255.255.0
cisco-client-compat = true
dtls-legacy = true

设置防火墙

iptables -I INPUT -p tcp --dport 11130 -j ACCEPT
iptables -I INPUT -p udp --dport 11130 -j ACCEPT
iptables -D INPUT -p tcp --dport 11130 -j ACCEPT
iptables -D INPUT -p udp --dport 11130 -j ACCEPT

iptables -t nat -A POSTROUTING -s 10.12.0.0/24 -o eth0 -j MASQUERADE
iptables -A FORWARD -s 10.12.0.0/24 -j ACCEPT

设置流量转发

sudo vim /etc/sysctl.conf

// 取消注释
net.ipv4.ip_forward=1

// 加载修改
sysctl -p