1. 编译

  1. wget http://www.cipherdyne.org/fwknop/download/fwknop-2.6.10.tar.gz
  2. tar -zvxf fwknop-2.6.10.tar.gz
  3. cd fwknop-2.6.10
  5. # 准备依赖
  6. yum install openssl texinfo libtool libpcap-devel
  8. # 配置
  9. ./configure --prefix=/usr --sysconfdir=/etc --disable-client LIBS=-lpthread
  11. make报错：WARNING: ‘aclocal-1.14’ is missing on your system.
  12. autoreconf -ivf
  13. make & make install
  14. which fwknopd
  16. # vim /etc/fwknop/fwknopd.conf
  17. PCAP_INTF                   ens256;
  19. VPP_TELNET_IP               172.16.1.100;
  20. VPP_TELNET_PORT             5002;
  21. WORKER_CNT                   8;
  23. ENABLE_BACKUP               N;
  24. BACKUP_VIP                  172.16.1.77;
  25. BACKUP_PEER_IP              172.16.1.102;
  26. BACKUP_PEER_MAC             00:0c:29:09:95:17;
  28. # vim /etc/fwknop/access.conf
  29. SOURCE              ANY
  30. REQUIRE_USERNAME   bob
  31. OPEN_PORTS          udp/4567,tcp/50152,tcp/22
  32. REQUIRE_SOURCE_ADDRESS    Y
  33. KEY_BASE64          p54XnkUGdXQwoyP1Ip6fja9+y+4EPYrBXx/BgCDd5JM=
  34. HMAC_KEY_BASE64     p54XnkUGdXQwoyP1Ip6fja9+y+4EPYrBXx/BgCDd5JP7bFKcnMJeGN8W0zLk49PsHSbQkhkujfc46luXh5mPgQ==
  35. FW_ACCESS_TIMEOUT   60
  37. SOURCE                  ANY
  38. REQUIRE_USERNAME          bob
  39. OPEN_PORTS                udp/4567
  40. REQUIRE_SOURCE_ADDRESS    Y
  41. KEY_BASE64              p54XnkUGdXQwoyP1Ip6fja9+y+4EPYrBXx/BgCDd5JM=
  42. HMAC_KEY_BASE64         p54XnkUGdXQwoyP1Ip6fja9+y+4EPYrBXx/BgCDd5JP7bFKcnMJeGN8W0zLk49PsHSbQkhkujfc46luXh5mPgQ==
  43. FW_ACCESS_TIMEOUT         30

2. 服务器

  1. # 启动
  2. fwknopd
  4. # 关闭
  5. fwknopd -K
  6. kill -9 `pidof fwknopd`
  8. # 查看
  9. fwknopd --fw-list

3. 客户端

3.1 发起spa

  1. # 生成配置
  2. fwknop -A udp/4567 -a 172.16.1.98 -D 172.16.1.99 --key-gen --use-hmac --save-rc-stanza
  4. # 发起spa
  5. fwknop -n 172.16.1.99 -U bob \
  6. --key-base64-rijndael p54XnkUGdXQwoyP1Ip6fja9+y+4EPYrBXx/BgCDd5JM= \
  7. --key-base64-hmac p54XnkUGdXQwoyP1Ip6fja9+y+4EPYrBXx/BgCDd5JP7bFKcnMJeGN8W0zLk49PsHSbQkhkujfc46luXh5mPgQ== \
  8. -a 172.16.1.98

3.2 扫描服务器

  1. # 扫描tcp
  2. nmap 172.16.1.100 -p50152
  3. nmap 172.16.1.100 -p22
  5. # 扫描udp
  6. nmap 172.16.1.100 -sU -p 4567