[*] Network packet filtering (replaces ipchains)
　　[*]   Network packet filtering debugging (NEW)
　　进入：IP: Netfilter Configuration  --->
　　<*> Connection tracking (required for masq/NAT) (NEW)
      FTP protocol support (NEW)
      IRC protocol support (NEW)

　　boot=/dev/sda
　　map=/boot/map
　　install=/boot/boot.b
　　prompt
　　timeout=50
　　lba32
　　default=linux-vpn
　　image=/boot/vmlinuz
        label=linux
        initrd=/boot/initrd
        read-only
        root=/dev/sda5
　　image=/boot/vmlinuz-2.4.18-vpn
        label=linux-vpn
        initrd=/boot/initrd
        read-only
        root=/dev/sda5

　　echo 0 > /proc/sys/net/ipv4/conf/eth0/rp_filter
　　echo 1 > /proc/sys/net/ipv4/ip_forward

　　   FTP protocol support (NEW)     
       IRC protocol support (NEW)

　　modprobe ip_nat_ftp

　　~/sslca#/usr/lib/ssl/misc/CA.sh -newca
　　CA certificate filename (or enter to create)
(enter)
　　Making CA certificate ...
　　Using configuration from /usr/lib/ssl/openssl.cnf
　　Generating a 2048 bit RSA private key
　　........................................+++
　　........................................+++
　　writing new private key to ''./demoCA/private/./cakey.pem''
　　Enter PEM pass phrase:(enter password)
　　Verifying password - Enter PEM pass phrase:(enter same password again)
　　-----
　　You are about to be asked to enter 　　
　　information that will be incorporated
　　into your certificate request.
　　What you are about to enter is what is called a Distinguished Name or a DN.
　　There are quite a few fields but you can leave some blank
　　For some fields there will be a default value,
If you enter ''.'', the field will be left blank.
　　-----
　　Country Name (2 letter code) [AU]:US(enter)
　　State or Province Name (full name) [Some-State]:State(enter)
　　Locality Name (eg, city) []:City(enter)
　　Organization Name (eg, company) [Internet Widgits Pty Ltd]:21vianet(enter)
　　Organizational Unit Name (eg, section) []:(enter)
　　Common Name (eg, YOUR name) []:CA(enter)
　　Email Address []:ca@xxx.com(enter)
　　~/sslca#

　　~/sslca# /usr/lib/ssl/misc/CA.sh -newreq
　　Using configuration from /usr/lib/ssl/openssl.cnf
　　Generating a 2048 bit RSA private key
　　...................................+++
　　...............................+++
　　writing new private key to ''newreq.pem''
　　Enter PEM pass phrase:(enter password)
　　Verifying password - Enter PEM pass phrase:(repeat password)
　　-----
　　You are about to be asked to enter information that will be incorporated
　　into your certificate request.
　　What you are about to enter is what is called a Distinguished Name or a DN.
　　There are quite a few fields but you can leave some blank
　　For some fields there will be a default value,
　　If you enter ''.'', the field will be left blank.
　　-----
　　Country Name (2 letter code) [AU]:US(enter)
　　State or Province Name (full name) [Some-State]:State(enter)
　　Locality Name (eg, city) []:City(enter)
　　Organization Name (eg, company) [Internet Widgits Pty Ltd]:ExampleCo(enter)
　　Organizational Unit Name (eg, section) []:(enter)
　　Common Name (eg, YOUR name) []:vpnserver.rd.xxx.com(enter)
　　Email Address []:user@xxx.com(enter)
　　Please enter the following ''extra'' attributes
　　to be sent with your certificate request
　　A challenge password []:(enter)
　　An optional company name []:(enter)
　　Request (and private key) is in newreq.pem
　　natecars@buzzword:~/sslca$ /usr/lib/ssl/misc/CA.sh -sign
　　Using configuration from /usr/lib/ssl/openssl.cnf
　　Enter PEM pass phrase:(password you entered for the ca certificate)
　　Check that the request matches the signature
Signature ok
　　The Subjects Distinguished Name is as follows
　　countryName           :PRINTABLE:''US''
　　stateOrProvinceName   :PRINTABLE:''State''
　　localityName          :PRINTABLE:''City''
　　organizationName      :PRINTABLE:''21vianet''
　　commonName            :PRINTABLE:''vpnserver.rd.xxx.com''
　　emailAddress          :IA5STRING:''rd@xxx.com''
　　Certificate is to be certified until Feb 13 16:28:40 2012 GMT (3650 days)
　　Sign the certificate? [y/n]:y(enter)
　　1 out of 1 certificate requests certified, commit? [y/n]y(enter)
　　Write out database with 1 new entries
Data Base Updated
　　(certificate snipped)
　　Signed certificate is in newcert.pem

　　~/sslca# mv newcert.pem vpnserver.rd.xxx.com.pem
　　~/sslca# mv newreq.pem vpnserver.rd.xxx.com.key

　　# cp vpnserver.rd.xxx.com.key /etc/ipsec.d/private
　　# cp vpnserver.rd.xxx.com.pem /etc/ipsec.d
　　# openssl x509 -in demoCA/cacert.pem -outform der -out rootca.der
　　# cp rootca.der /etc/ipsec.d/cacerts/RootCA.der
　　# openssl x509 -in host.example.com.pem -outform der -out /etc/x509cert.der
　　# openssl ca -gencrl -out crl.pem
　　# cp crl.pem /etc/ipsec.d/crls

　　# basic configuration
　　config setup
 interfaces=%defaultroute
 klipsdebug=none
 plutodebug=none
 plutoload=%search
 plutostart=%search
 uniqueids=yes
　　conn %default
 keyingtries=1
 compress=yes
 disablearrivalcheck=no
 authby=rsasig
 leftrsasigkey=%cert
 rightrsasigkey=%cert
 left=%defaultroute
 leftcert=vpnserver.rd.xxx.com.pem
 auto=add
 pfs=yes
　　conn roadwarrior
 right=%any
　　conn roadwarrior-net
 leftsubnet=192.168.1.0/255.255.255.0
 right=%any
　　conn net-net
 leftsubnet=192.168.1.0/255.255.255.0
 right=%any
 rightsubnet=192.168.10.0/255.255.255.0
　　conn world-net
 leftsubnet=*
 right=%any
 rightsubnet=192.168.10.0/255.255.255.0