OpenSWAN可以在Linux環境下搭建IPSecVPN。我自己動手在CentOS系統下安裝OpenSWAN，現將過程記錄下來。
軟件
VMware-workstation-7.1
CentOS-6.3-i386-bin-DVD1.iso
openswan-2.6.38.tar.gz
在虛擬機中先將CentOS裝好，這裡就不詳細說明了。
這裡需要注意的是需要將機器連到互聯網好下載安裝一些輔助工具包。IP地址為手動配置好後，發現ping ip可以成功，但是ping某個域名卻顯示ping: unknown host ***。這是因為沒有設置域名服務器的原因。
# ping baidu.com
ping: unknown host baidu.com
解決方法如下：
# vi /etc/resolv.conf
#增加以下兩行，具體IP請按實際填寫
nameserver 208.67.222.222
nameserver 208.67.220.220
CentOS安裝gcc--RPM
#yum install gcc-c++
#yum install flex autoconf zlib curl zlib-devel curl-devel bzip2 bzip2-devel ncurses-devel libjpeg-devel libpng-devel libtiff-devel freetype-devel pam-devel
安裝相應 ipsec 套件工具和基礎軟件環境
#yum -y install gmp gmp-devel gawk flex bison
配置環境變量
#sysctl -a | egrep "ipv4.*(accept|send)_redirects" | awk -F "=" '{print $1"= 0"}'
執行上面的命令，把結果添加到/etc/ sysctl.conf的結尾。
並且把
net.ipv4.ip_forward = 0
net.ipv4.conf.default.rp_filter = 1
修改成
net.ipv4.ip_forward = 1
net.ipv4.conf.default.rp_filter = 0
保存後，執行sysctl -p，使其修改後的參數生效。
# cat /etc/sysctl.conf
net.ipv4.ip_forward = 1
net.ipv4.conf.default.rp_filter = 0
net.ipv4.conf.default.accept_source_route = 0
kernel.sysrq = 0
kernel.core_uses_pid = 1
net.ipv4.tcp_syncookies = 1
kernel.msgmnb = 65536
kernel.msgmax = 65536
kernel.shmmax = 68719476736
kernel.shmall = 4294967296
net.ipv4.conf.bond1.send_redirects = 0
net.ipv4.conf.bond1.accept_redirects = 0
net.ipv4.conf.bond0.send_redirects = 0
net.ipv4.conf.bond0.accept_redirects = 0
net.ipv4.conf.eth4.send_redirects = 0
net.ipv4.conf.eth4.accept_redirects = 0
net.ipv4.conf.lo.send_redirects = 0
net.ipv4.conf.lo.accept_redirects = 0
net.ipv4.conf.default.send_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.all.accept_redirects = 0
安裝OpenSWAN
#tar zxvf openswan-2.6.38.tar.gz
#cd openswan-2.6.38
#make programs
#make install
驗證安裝
執行下面的命令驗證OpenSWan是否正確安裝
#ipsec --version
如果程序正確安裝，此命令將顯示
Linux Openswan U2.6.38/K(no kernel code presently loaded)
See `ipsec --copyright' for copyright information.
這裡沒有加載任何的IPsec stack，當啟動IPsec後會自動加載系統自帶的netkey。
