Centos7搭建CiscoAnyConnect

yum -y install epel-release #安装EPEL源
yum install ocserv #安装ocserv

cd ~
mkdir certificates
cd certificates

cn = "Aierpf" 
organization = "aierpf.cn" 
serial = 1 
expiration_days = 3650
ca 
signing_key 
cert_signing_key 
crl_signing_key

certtool --generate-self-signed --load-privkey ca-key.pem --template ca.tmpl --outfile ca-cert.pem

cn = "Your hostname or IP" 
organization = "aierpf.cn" 
expiration_days = 3650
signing_key 
encryption_key
tls_www_server

certtool --generate-certificate --load-privkey server-key.pem --load-ca-certificate ca-cert.pem --load-ca-privkey ca-key.pem --template server.tmpl --outfile server-cert.pem

cp ca-cert.pem /etc/ssl/my-ca-cert.pem
cp server-cert.pem /etc/ssl/my-server-cert.pem
cp server-key.pem /etc/ssl/my-server-key.pem

mkdir /etc/ocserv
cd ~/ocserv-0.10.8
cp doc/sample.config /etc/ocserv/ocserv.conf

wget ftp://ftp.infradead.org/pub/ocserv/ocserv-0.10.8.tar.xz
tar xvf ocserv-0.10.8.tar.xz
cd ocserv-0.10.8

# 登陆方式，目前先用密码登录
auth = "plain[/etc/ocserv/ocpasswd]"
# 允许同时连接的客户端数量
max-clients = 4
# 限制同一客户端的并行登陆数量
max-same-clients = 2
# 服务监听的IP（服务器IP，可不设置）
listen-host = 1.2.3.4
#配置客户端获取到的IP地址（自定义）
ipv4-network = 10.8.0.0/24
#添加客户端获取的DNS
dns = 192.168.0.7
# 服务监听的TCP/UDP端口（选择你喜欢的数字）
tcp-port = 9000
udp-port = 9001
# 自动优化VPN的网络性能
try-mtu-discovery = true
# 确保服务器正确读取用户证书（后面会用到用户证书）
cert-user-oid = 2.5.4.3
# 服务器证书与密钥(如果有自己的共有证书，可在此处替换为相应路径)
server-cert = /etc/ssl/private/my-server-cert.pem
server-key = /etc/ssl/private/my-server-key.pem
# 客户端连上vpn后使用的dns
dns = 8.8.8.8
dns = 8.8.4.4
# 注释掉所有的route，让服务器成为gateway
#route = 192.168.1.0/255.255.255.0
# 启用cisco客户端兼容性支持
cisco-client-compat = true
#定义user-profile
user-profile = /etc/ocserv/profile.xml

ocpasswd -c /etc/ocserv/ocpasswd username
#username为你要添加的用户名
systemctl start ocserv

ocserv -c /etc/ocserv/ocserv.conf -f -d 1

iptables -F
iptables -X
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -A INPUT -p tcp --dport 443 -j ACCEPT
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j MASQUERADE
iptables-save
service iptables save
echo 'net.ipv4.ip_forward = 1' >> /etc/sysctl.conf #添加net.ipv4.ip_forward = 1到/etc/sysctl.conf文件最后一行，如果已存在，修改或者无视
sysctl -p #使修改立即生效

wget https://kojipkgs.fedoraproject.org//packages/http-parser/2.7.1/3.el7/x86_64/http-parser-2.7.1-3.el7.x86_64.rpm
rpm -ivh http-parser-2.7.1-3.el7.x86_64.rpm