杂烩-自建IPSec VPN服务

本文最后更新于：September 10, 2026 pm

Internet Protocol security (IPsec) 是一个开放标准的框架协议，用于确保通过互联网协议（IP)使用加密安全服务进行私有的、安全的通信。它通过加密、认证和密钥管理等技术，为IP网络通信提供机密性、数据完整性验证和来源真实性保障，是构建虚拟专用网（VPN）的常用技术。

IPsec 保护可以使用两种模式，转换模式和隧道模式。

目录

参考：

部署服务端

首先创建环境变量文件vpn.env，也可参考示例文件(地址：https://github.com/hwdsl2/docker-ipsec-vpn-server/blob/master/vpn.env.example)

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
# Note: All the variables to this image are optional.
# See README for more information.
# To use, uncomment and replace with your own values.

# Define IPsec PSK, VPN username and password
# - DO NOT put "" or '' around values, or add space around =
# - DO NOT use these special characters within values: \ " '
# VPN_IPSEC_PSK=your_ipsec_pre_shared_key
# VPN_USER=your_vpn_username
# VPN_PASSWORD=your_vpn_password

# Define additional VPN users
# - DO NOT put "" or '' around values, or add space around =
# - DO NOT use these special characters within values: \ " '
# - Usernames and passwords must be separated by spaces
# VPN_ADDL_USERS=additional_username_1 additional_username_2
# VPN_ADDL_PASSWORDS=additional_password_1 additional_password_2

# Use a DNS name for the VPN server
# - The DNS name must be a fully qualified domain name (FQDN)
# VPN_DNS_NAME=vpn.example.com

# Specify a name for the first IKEv2 client
# - Use one word only, no special characters except '-' and '_'
# - The default is 'vpnclient' if not specified
# VPN_CLIENT_NAME=your_client_name

# Use alternative DNS servers
# - By default, clients are set to use Google Public DNS
# - Example below shows Cloudflare's DNS service
# VPN_DNS_SRV1=1.1.1.1
# VPN_DNS_SRV2=1.0.0.1

# Protect IKEv2 client config files using a password
# - By default, no password is required when importing IKEv2 client configuration
# - Uncomment if you want to protect these files using a random password
# VPN_PROTECT_CONFIG=yes

# Specify the public IPv6 address of the Docker host (optional)
# - Only used when the Docker host has a public IPv6 address
# - If not specified, the IPv6 address is auto-detected
# VPN_PUBLIC_IP6=your_ipv6_address

# Customize the IPv6 pool subnet for IKEv2 clients (optional)
# - Only used when the Docker host has a public IPv6 address
# - Must be a /64 subnet in the ULA range (e.g. fddd::/16)
# - Default is fddd:500:500:500::/64 if not specified
# VPN_IP6_NET=fddd:1234:5678:9012::/64

根据实际情况调整为自己的配置：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
# Note: All the variables to this image are optional.
# See README for more information.
# To use, uncomment and replace with your own values.

# 设置共享密钥以及用户和密码
# Define IPsec PSK, VPN username and password
# - DO NOT put "" or '' around values, or add space around =
# - DO NOT use these special characters within values: \ " '
VPN_IPSEC_PSK=fsafsafsdfafdsdf
VPN_USER=ttf
VPN_PASSWORD=tothefor


# 其他用户和密码,多个空格分开
# Define additional VPN users
# - DO NOT put "" or '' around values, or add space around =
# - DO NOT use these special characters within values: \ " '
# - Usernames and passwords must be separated by spaces
VPN_ADDL_USERS=guest_1 guest_2
VPN_ADDL_PASSWORDS=guest_1 guest_2

# Use a DNS name for the VPN server
# - The DNS name must be a fully qualified domain name (FQDN)
# VPN_DNS_NAME=vpn.example.com

# Specify a name for the first IKEv2 client
# - Use one word only, no special characters except '-' and '_'
# - The default is 'vpnclient' if not specified
# VPN_CLIENT_NAME=your_client_name

# Use alternative DNS servers
# - By default, clients are set to use Google Public DNS
# - Example below shows Cloudflare's DNS service
# VPN_DNS_SRV1=1.1.1.1
# VPN_DNS_SRV2=1.0.0.1

# Protect IKEv2 client config files using a password
# - By default, no password is required when importing IKEv2 client configuration
# - Uncomment if you want to protect these files using a random password
# VPN_PROTECT_CONFIG=yes

# Specify the public IPv6 address of the Docker host (optional)
# - Only used when the Docker host has a public IPv6 address
# - If not specified, the IPv6 address is auto-detected
#VPN_PUBLIC_IP6=103.6.222.93
VPN_PUBLIC_IP=1.2.3.4 # IP4的对外公网IP

# Customize the IPv6 pool subnet for IKEv2 clients (optional)
# - Only used when the Docker host has a public IPv6 address
# - Must be a /64 subnet in the ULA range (e.g. fddd::/16)
# - Default is fddd:500:500:500::/64 if not specified
# VPN_IP6_NET=fddd:1234:5678:9012::/64

启动服务

1
2
3
4
5
6
7
8
9
10
docker run \
    --name ipsec-vpn-server \
    --env-file ./vpn.env \
    --restart=always \
    -v ikev2-vpn-data:/etc/ipsec.d \
    -v /lib/modules:/lib/modules:ro \
    -p 500:500/udp \
    -p 4500:4500/udp \
    -d --privileged \
    hwdsl2/ipsec-vpn-server

启动成功后查看信息：

1
docker logs ipsec-vpn-server

输出类似如下：

1
2
3
4
5
6
Connect to your new VPN with these details:

Server IP: 你的VPN服务器IP
IPsec PSK: 你的IPsec预共享密钥
Username: 你的VPN用户名
Password: 你的VPN密码

连接使用

具体可参考：https://github.com/hwdsl2/setup-ipsec-vpn/blob/master/docs/clients-zh.md

Windows

首先在终端中执行如下两条命令，然后重启电脑！！！

Windows 11

  1. 右键单击系统托盘中的无线/网络图标。
  2. 选择 网络和 Internet 设置，然后在打开的页面中单击 VPN。
  3. 单击 添加 VPN 按钮。
  4. 从 VPN 提供商 下拉菜单选择 Windows (内置)。
  5. 在 连接名称 字段中输入任意内容。
  6. 在 服务器名称或地址 字段中输入你的 VPN 服务器 IP。
  7. 从 VPN 类型 下拉菜单选择 使用预共享密钥的 L2TP/IPsec。
  8. 在 预共享密钥 字段中输入你的 VPN IPsec PSK。
  9. 在 用户名 字段中输入你的 VPN 用户名。
  10. 在 密码 字段中输入你的 VPN 密码。
  11. 选中 记住我的登录信息 复选框。
  12. 单击 保存 保存 VPN 连接的详细信息。
杂烩
杂烩 IPSec VPN

本文作者: 墨水记忆
本文链接: https://tothefor.com/DragonOne/7baba722.html
版权声明: 本博客所有文章除特别声明外，均采用 CC BY-SA 4.0 协议 ，转载请注明出处！