You need to enable JavaScript to run this app.
优惠活动
大模型
产品
解决方案
定价
更多

基于多GRE over IPsec隧道的动态流量路由strongSwan配置问题求助

avatar
开发者阿泽
2026-4-21
基于多GRE over IPsec隧道的动态流量路由strongSwan配置问题求助

当前状态

  • 正在学习网络及strongSwan的正确配置，使用自签名通配符SSL证书
  • 所有隧道已成功建立并完成认证，两端配置指定的通信正常
  • 远程设备可成功连接到主节点，但流量仅局限在主节点内，未实现转发；远程用户通过radius插件完成认证

待解决问题

需要搭建一个通用入口+多动态IP出口的VPN网络，具体需求：

  • 移动客户端（macOS、iPhone、Android、Win10/11）连接主节点后，流量随机路由到某一个从节点（后续计划实现负载均衡，先完成基础配置）
  • 若某条到从节点的GRE隧道故障，自动将其从路由系统中排除
  • 客户端通过从节点访问网络时，由该从节点分配IP地址

可用主机信息（Ubuntu 20.04）

  • 主节点（Host A）：x.x.110.138
  • 从节点1（Host B）：x.x.166.115
  • 从节点2（Host C）：x.x.178.214
  • 从节点3（Host D）：x.x.140.120

各主机配置详情

主节点（x.x.110.138）

/etc/sysctl.conf

net.ipv4.ip_forward = 1

/etc/netplan/01-grecfg.yaml

network:
  version: 2
  tunnels:
    tunToSlave1:
      mode: gre
      local: x.x.110.138
      remote: x.x.166.115
      addresses: [10.0.2.1/24]
      mtu: 1442
      ttl: 255
    tunToSlave2:
      mode: gre
      local: x.x.110.138
      remote: x.x.178.214
      addresses: [10.0.3.1/24]
      mtu: 1442
      ttl: 255
    tunToSlave3:
      mode: gre
      local: x.x.110.138
      remote: x.x.140.120
      addresses: [10.0.4.1/24]
      mtu: 1442
      ttl: 255

/etc/ipsec.conf

config setup
  charondebug="cfg 2, dmn 2, ike 2, net 2"
  strictcrlpolicy = yes

conn %default
  reauth = yes
  rekey = yes
  keyingtries = %forever
  keyexchange = ikev2
  dpdaction = restart
  dpddelay = 5s
  mobike = yes

conn tun-slave1
  left = %defaultroute
  right = x.x.166.115
  authby = pubkey
  leftcert = cert.pem
  leftsendcert = always
  leftauth = pubkey
  rightauth = pubkey
  leftid = @mydomain.com
  rightid = @mydomain.com
  rightrsasigkey = /etc/central/rsa.cert.pem
  leftsubnet = %dynamic[gre]
  rightsubnet = %dynamic[gre]
  type = transport
  ike = aes256gcm16-sha384-x25519!
  esp = aes256gcm16-sha384-x25519!
  auto = start

conn tun-slave2
  left = %defaultroute
  right = x.x.178.214
  authby = pubkey
  leftcert = cert.pem
  leftsendcert = always
  leftauth = pubkey
  rightauth = pubkey
  leftid = @mydomain.com
  rightid = @mydomain.com
  rightrsasigkey = /etc/central/rsa.cert.pem
  leftsubnet = %dynamic[gre]
  rightsubnet = %dynamic[gre]
  type = transport
  ike = aes256gcm16-sha384-x25519!
  esp = aes256gcm16-sha384-x25519!
  auto = start

conn tun-slave3
  left = %defaultroute
  right = x.x.140.120
  authby = pubkey
  leftcert = cert.pem
  leftsendcert = always
  leftauth = pubkey
  rightauth = pubkey
  leftid = @mydomain.com
  rightid = @mydomain.com
  rightrsasigkey = /etc/central/rsa.cert.pem
  leftsubnet = %dynamic[gre]
  rightsubnet = %dynamic[gre]
  type = transport
  ike = aes256gcm16-sha384-x25519!
  esp = aes256gcm16-sha384-x25519!
  auto = start

conn remote-mobile
  dpddelay = 30s
  left = %any
  leftid = @mydomain.com
  leftcert = cert.pem
  leftsendcert = always
  leftsubnet = 0.0.0.0/0,::/0
  right = %any
  rightid = %any
  rightauth = eap-radius
  rightsendcert = never
  eap_identity = %identity
  rightsourceip = 10.10.10.0/24
  rightdns = 8.8.8.8
  type = tunnel
  ike=aes128gcm16-sha2_256-prfsha256-ecp256!
  esp=aes128gcm16-sha2_256-ecp256!
  auto = add
  dpdaction = restart
  ikelifetime = 240m
  keylife = 60m

conn remote-pc
  ike=aes256gcm16-aes256gcm12-aes128gcm16-aes128gcm12-sha256-sha1-modp2048-modp4096-modp1024,aes256-aes128-sha256-sha1-modp2048-modp4096-modp1024,3des-sha1-modp1024!
  esp=aes128gcm12-aes128gcm16-aes256gcm12-aes256gcm16-modp2048-modp4096-modp1024,aes128-aes256-sha1-sha256-modp2048-modp4096-modp1024,aes128-sha1-modp2048,aes128-sha1-modp1024,3des-sha1-modp1024,aes128-aes256-sha1-sha256,aes128-sha1,3des-sha1!
  ikelifetime=720m
  keylife=60m

从节点1（x.x.166.115）

/etc/sysctl.conf

net.ipv4.ip_forward = 1
net.ipv4.ip_no_pmtu_disc = 1
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv6.conf.all.disable_ipv6 = 1

/etc/netplan/01-grecfg.yaml

network:
  version: 2
  tunnels:
    tunToMaster:
      mode: gre
      local: x.x.166.115
      remote: x.x.110.138
      addresses: [10.0.2.2/24]
      mtu: 1442
      ttl: 255

/etc/ipsec.conf

config setup
  charondebug="cfg 2, dmn 2, ike 2, net 2"
  strictcrlpolicy = yes

conn %default
  reauth = yes
  rekey = yes
  keyingtries = %forever
  keyexchange = ikev2
  dpdaction = restart
  dpddelay = 5s
  mobike = yes

conn gre-master
  left = %defaultroute
  right = x.x.110.138
  authby = pubkey
  leftcert = cert.pem
  leftsendcert = always
  leftauth = pubkey
  rightauth = pubkey
  leftid = @mydomain.com
  rightid = @mydomain.com
  rightrsasigkey = /etc/central/rsa.cert.pem
  leftsubnet = %dynamic[gre]
  rightsubnet = %dynamic[gre]
  type = transport
  ike = aes256gcm16-sha384-x25519!
  esp = aes256gcm16-sha384-x25519!
  auto = add

从节点2（x.x.178.214）

/etc/sysctl.conf

net.ipv4.ip_forward = 1
net.ipv4.ip_no_pmtu_disc = 1
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv6.conf.all.disable_ipv6 = 1

/etc/netplan/01-grecfg.yaml

network:
  version: 2
  tunnels:
    tunToMaster:
      mode: gre
      local: x.x.178.214
      remote: x.x.110.138
      addresses: [10.0.3.3/24]
      mtu: 1442
      ttl: 255

/etc/ipsec.conf

config setup
  charondebug="cfg 2, dmn 2, ike 2, net 2"
  strictcrlpolicy = yes

conn %default
  reauth = yes
  rekey = yes
  keyingtries = %forever
  keyexchange = ikev2
  dpdaction = restart
  dpddelay = 5s
  mobike = yes

conn gre-master
  left = %defaultroute
  right = x.x.110.138
  authby = pubkey
  leftcert = cert.pem
  leftsendcert = always
  leftauth = pubkey
  rightauth = pubkey
  leftid = @mydomain.com
  rightid = @mydomain.com
  rightrsasigkey = /etc/central/rsa.cert.pem
  leftsubnet = %dynamic[gre]
  rightsubnet = %dynamic[gre]
  type = transport
  ike = aes256gcm16-sha384-x25519!
  esp = aes256gcm16-sha384-x25519!
  auto = add

注：原配置中right字段填写有误，已修正为主节点IP x.x.110.138

从节点3（x.x.140.120）

/etc/sysctl.conf

net.ipv4.ip_forward = 1
net.ipv4.ip_no_pmtu_disc = 1
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv6.conf.all.disable_ipv6 = 1

/etc/netplan/01-grecfg.yaml

network:
  version: 2
  tunnels:
    tunToMaster:
      mode: gre
      local: x.x.140.120
      remote: x.x.110.138
      addresses: [10.0.4.4/24]
      mtu: 1442
      ttl: 255

/etc/ipsec.conf

config setup
  charondebug="cfg 2, dmn 2, ike 2, net 2"
  strictcrlpolicy = yes

conn %default
  reauth = yes
  rekey = yes
  keyingtries = %forever
  keyexchange = ikev2
  dpdaction = restart
  dpddelay = 5s
  mobike = yes

conn gre-master
  left = %defaultroute
  right = x.x.110.138
  authby = pubkey
  leftcert = cert.pem
  leftsendcert = always
  leftauth = pubkey
  rightauth = pubkey
  leftid = @mydomain.com
  rightid = @mydomain.com
  rightrsasigkey = /etc/central/rsa.cert.pem
  leftsubnet = %dynamic[gre]
  rightsubnet = %dynamic[gre]
  type = transport
  ike = aes256gcm16-sha384-x25519!
  esp = aes256gcm16-sha384-x25519!
  auto = add

问题列表

  1. 如何正确配置动态路由的接口参数？尤其是在本地主机层面正确设置网络/子网，我曾通过教程实现了主节点到从节点1的单节点方案，但多节点场景下完全搞不懂。
  2. 当前IPsec配置中的leftsubnet/rightsubnet参数该如何正确定义？是否可以直接保留%dynamic值？
  3. 在这个场景下使用Quagga做动态路由是否多余？
  4. 当前主节点->多从节点的交互架构是否符合需求？我尝试让从节点主动连接主节点，但后续建立的隧道会覆盖之前的，这是怎么回事？
  5. 当前的接口参数和IPsec通用配置中存在哪些错误？
  6. 每个主机需要设置哪些iptables规则？我猜测每个从节点至少需要配置NAT伪装规则，之前单节点strongSwan我用了以下规则，不确定多节点场景是否适用：
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -p udp --dport  500 -j ACCEPT
iptables -A INPUT -p udp --dport 4500 -j ACCEPT
iptables -A FORWARD --match policy --pol ipsec --dir in --proto esp -s 10.10.10.0/24 -j ACCEPT
iptables -A FORWARD --match policy --pol ipsec --dir out --proto esp -d 10.10.10.0/24 -j ACCEPT
iptables -t nat -A POSTROUTING -s 10.10.10.0/24 -o eth0 -m policy --pol ipsec --dir out -j ACCEPT
iptables -t nat -A POSTROUTING -s 10.10.10.0/24 -o eth0 -j MASQUERADE
iptables -t mangle -A FORWARD --match policy --pol ipsec --dir in -s 10.10.10.0/24 -o eth0 -p tcp -m tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1361:1536 -j TCPMSS --set-mss 1360
iptables -A INPUT -p icmp -j DROP
iptables -A INPUT -j DROP
iptables -A FORWARD -j DROP

非常感谢任何帮助、解释和有用的信息！

Cheers <3

备注：内容来源于stack exchange，提问作者IgorMonkey

相关产品推荐
方舟 Agent Plan

超全模态模型 × Harness 升级，最新支持 Deepseek-V4.1-Flash、GLM-5.3 系列、Doubao-Seedream-5.0-pro、Kimi-K3 (部分)， 限时 9.9 元起

产品介绍相关文档
相关产品推荐
方舟 Agent Plan

超全模态模型 × Harness 升级，最新支持 Deepseek-V4.1-Flash、GLM-5.3 系列、Doubao-Seedream-5.0-pro、Kimi-K3 (部分)， 限时 9.9 元起

产品介绍相关文档
火山引擎 最新活动
全面开放
Doubao-Seedance-2.5全新模型升级

模型再升级,30秒超长叙事, 模态参考扩容

HOT
方舟Codingplan

模型自由，工具不限，最新支持 Deepseek-V4 系列、GLM-5.3 系列

HOT
方舟Agent plan

超全模态模型 × Harness 升级，最新支持 Deepseek-V4.1-Flash、GLM-5.3 系列

HOT
新用户特惠专场

大模型19元起，Al应用9.9元畅享，新人首购爆款尽享优惠

最近更新时间：2026.04.21 15:40:28