机器

两台测试机器：
1）IP地址：192.168.1.44，内网地址：172.16.111.44
2）IP地址：192.168.1.55，内网地址：172.16.111.55

配置

安装strongswan

两台机器都需要：yum install -y strongswan

192.168.1.44的配置

/etc/strongswan/ipsec.conf 内容如下：

# ipsec.conf - strongSwan IPsec configuration file

# basic configuration

config setup
# strictcrlpolicy=yes
# uniqueids = no

# Add connections here.

# Sample VPN connections

conn %default
authby=psk
auto=route
type=tunnel
compress=no
ikelifetime=86400s
lifetime=28800s
keyexchange=ikev1
ike=3des-sha1-modp768
esp=3des-md5

conn node-44
left=192.168.1.44
leftsubnet=172.16.111.0/24
leftid=@node-44
right=192.168.1.55
rightsubnet=172.16.111.0/24
rightid=@node-115
auto=start

/etc/strongswan/ipsec.secrets 内容如下：

# ipsec.secrets - strongSwan IPsec secrets file

@node-44 @node-115 : PSK "4TiF/Y0BMVP+vv1pIg6wcg=="

192.168.1.55的配置

/etc/strongswan/ipsec.conf 内容如下：

# ipsec.conf - strongSwan IPsec configuration file

# basic configuration

config setup
	# strictcrlpolicy=yes
	# uniqueids = no

# Add connections here.

# Sample VPN connections

conn %default
     authby=psk
     auto=route
     type=tunnel
     compress=no
     ikelifetime=86400s
     lifetime=28800s
     keyexchange=ikev1
     ike=3des-sha1-modp768
     esp=3des-md5

conn node-44
     left=192.168.1.55
     leftsubnet=172.16.111.0/24
     leftid=@node-55
     right=192.168.1.44
     rightsubnet=172.16.111.0/24
     rightid=@node-44
     auto=start

/etc/strongswan/ipsec.secrets 内容如下

# ipsec.secrets - strongSwan IPsec secrets file
@node-55 @node-44 : PSK "4TiF/Y0BMVP+vv1pIg6wcg=="

查看状态

命令：strongswan statusall
如下：

192.168.1.55上 ping -c 1 172.16.111.44 即可以走ipsec隧道了。