if(User-Name) {
if(“%{sql:UPDATE radacct set AcctStopTime=ADDDATE(AcctStartTime,INTERVAL AcctSessionTime SECOND),AcctTerminateCause=’Clear-Stale Session’ WHERE UserName=’%{User-Name}’ and CallingStationId=’%{Calling-Station-Id}’ and AcctStopTime is null}”){
}
}

如果不允许一个用户同时多处登录，去掉Calling-Station-Id的条件即可。

if(User-Name) {
if(“%{sql:UPDATE radacct set AcctStopTime=ADDDATE(AcctStartTime,INTERVAL AcctSessionTime SECOND),AcctTerminateCause=’Clear-Stale Session’ WHERE UserName=’%{User-Name}’ and AcctStopTime is null}”){
}
}

注意这里sql是有意放在一个空的if语句中，因为在freeradius的配置文件中，一般语句中的sql会要求有返回值。放在if条件中可以避免因为检查返回值失败。

———————–

补记：

再想想这样做也还有些问题，因为只是在数据库中清除了状态，如果前一个连接物理上还存在的话，并不能物理上断开相应的连接。完美解决方案需要NAS能检查连接状态，如果NAS不提供相应功能的话，不能有完好解决方案。

折中的方案是通过Acct-Interim-Interval设置NAS更新数据周期，在检查无效连接时只处理一段时间(比如三个更新周期)没有更新数据的连接。一点问题是如果一个连接异常断开后，在一段时间内无法再次登陆。

if(User-Name) {
if(“%{sql:UPDATE radacct set AcctStopTime=ADDDATE(AcctStartTime,INTERVAL AcctSessionTime SECOND),AcctTerminateCause=’Clear-Stale Session’ WHERE UserName=’%{User-Name}’ and AcctStopTime is null and (TIME_TO_SEC(TIMEDIFF(NOW(),AcctStartTime))-1000)>AcctSessionTime}”){
}
}

//示例是1000秒没有新数据即清除状态

1. CentOS可以从EPEL中安装mod_fcgid

yum install httpd php-cli mod_fcgid

2. vi /etc/php.ini

cgi.fix_pathinfo = 1

3. 创建vhosts

First we create the users and groups:

groupadd web1
groupadd web2
useradd -s /bin/false -d /var/www/web1 -m -g web1 web1
useradd -s /bin/false -d /var/www/web2 -m -g web2 web2
chmod 755 /var/www/web1
chmod 755 /var/www/web2

Then we create the document roots and make them owned by the users/groups web1 resp. web2:

mkdir -p /var/www/web1/web
chown web1:web1 /var/www/web1/web
mkdir -p /var/www/web2/web
chown web2:web2 /var/www/web2/web

We will run PHP using suExec; suExec’s document root is /var/www, as the following command shows:

/usr/sbin/suexec -V

[root@server1 ~]# /usr/sbin/suexec -V
-D AP_DOC_ROOT=”/var/www”
-D AP_GID_MIN=100
-D AP_HTTPD_USER=”apache”
-D AP_LOG_EXEC=”/var/log/httpd/suexec.log”
-D AP_SAFE_PATH=”/usr/local/bin:/usr/bin:/bin”
-D AP_UID_MIN=500
-D AP_USERDIR_SUFFIX=”public_html”
[root@server1 ~]#

Therefore we cannot call the PHP binary (/usr/bin/php-cgi) directly because it is located outside suExec’s document root. As suExec does not allow symlinks, the only way to solve the problem is to create a wrapper script for each web site in a subdirectory of /var/www; the wrapper script will then call the PHP binary /usr/bin/php-cgi. The wrapper script must be owned by the user and group of each web site, therefore we need one wrapper script for each web site. I’m going to create the wrapper scripts in subdirectories of /var/www/php-fcgi-scripts, e.g. /var/www/php-fcgi-scripts/web1 and /var/www/php-fcgi-scripts/web2.

mkdir -p /var/www/php-fcgi-scripts/web1
mkdir -p /var/www/php-fcgi-scripts/web2

vi /var/www/php-fcgi-scripts/web1/php-fcgi-starter

#!/bin/sh
PHPRC=/etc/
export PHPRC
export PHP_FCGI_MAX_REQUESTS=5000
export PHP_FCGI_CHILDREN=8
exec /usr/bin/php-cgi

vi /var/www/php-fcgi-scripts/web2/php-fcgi-starter

#!/bin/sh
PHPRC=/etc/
export PHPRC
export PHP_FCGI_MAX_REQUESTS=5000
export PHP_FCGI_CHILDREN=8
exec /usr/bin/php-cgi

The PHPRC line contains the directory where the php.ini file is located (i.e., /etc/ translates to /etc/php.ini). PHP_FCGI_MAX_REQUESTS is the maximum number of requests before an fcgid process is stopped and a new one is launched. PHP_FCGI_CHILDREN defines the number of PHP children that will be launched.

The php-fcgi-starter scripts must be executable, and they (and the directories they are in) must be owned by the web site’s user and group:

chmod 755 /var/www/php-fcgi-scripts/web1/php-fcgi-starter
chmod 755 /var/www/php-fcgi-scripts/web2/php-fcgi-starter
chown -R web1:web1 /var/www/php-fcgi-scripts/web1
chown -R web2:web2 /var/www/php-fcgi-scripts/web2

Now we create the Apache vhosts for www.example1.com and www.example2.com. Add the following two vhosts at the end of /etc/httpd/conf/httpd.conf:

vi /etc/httpd/conf/httpd.conf

[...]
NameVirtualHost *:80

<VirtualHost *:80>
  ServerName www.example1.com
  ServerAlias example1.com
  ServerAdmin webmaster@example1.com
  DocumentRoot /var/www/web1/web/

  <IfModule mod_fcgid.c>
    SuexecUserGroup web1 web1
    PHP_Fix_Pathinfo_Enable 1
    <Directory /var/www/web1/web/>
      Options +ExecCGI
      AllowOverride All
      AddHandler fcgid-script .php
      FCGIWrapper /var/www/php-fcgi-scripts/web1/php-fcgi-starter .php
      Order allow,deny
      Allow from all
    </Directory>
  </IfModule>

  # ErrorLog /var/log/apache2/error.log
  # CustomLog /var/log/apache2/access.log combined
  ServerSignature Off

</VirtualHost>

<VirtualHost *:80>
  ServerName www.example2.com
  ServerAlias example2.com
  ServerAdmin webmaster@example2.com
  DocumentRoot /var/www/web2/web/

  <IfModule mod_fcgid.c>
    SuexecUserGroup web2 web2
    PHP_Fix_Pathinfo_Enable 1
    <Directory /var/www/web2/web/>
      Options +ExecCGI
      AllowOverride All
      AddHandler fcgid-script .php
      FCGIWrapper /var/www/php-fcgi-scripts/web2/php-fcgi-starter .php
      Order allow,deny
      Allow from all
    </Directory>
  </IfModule>

  # ErrorLog /var/log/apache2/error.log
  # CustomLog /var/log/apache2/access.log combined
  ServerSignature Off

</VirtualHost>

Make sure you fill in the right paths (and the correct user and group in the SuexecUserGroup lines).

Reload Apache afterwards:

/etc/init.d/httpd reload

原文链接：http://www.mounix.com/blog/2011/08/how-to-set-up-apache2-with-mod_fcgid-and-php5-on-centos-5-6/

参考网上的说明，安装还是很顺利的，PPTP和L2TP都可以支持，FreeRADIUS还是很强大的。

管理界面用的FreeRADIUS自己带的Dailup Admin. 安装可以参考官方网站 ( http://www.freeradius.org/ )。

下面是几篇参考文章：

1. PPTP/L2TP + FreeRADIUS + MySQL 安装与配置  ( https://wangyan.org/blog/freeradius-pptp-l2tp-html.html )

2. 通过FreeRADIUS实现VPN流量控制功能 ( https://wangyan.org/blog/freeradius-traffic-limit.html )

3. 在PPTP VPN服务器上配置FreeRADIUS+daloRADIUS实现用户跟踪管理 ( http://dayanjia.com/2011/03/configure-freeradius-and-daloradius-on-pptp-vpn-server.html )

也摘录在此

PPTP/L2TP + FreeRADIUS + MySQL 安装与配置

1
2
3
4
5

wget -c ftp://ftp.freeradius.org/pub/freeradius/freeradius-server-2.1.11.tar.gz
tar zxf freeradius-server-2.1.11.tar.gz
cd freeradius-server-2.1.11
./configure
make && make install

1
2

vim /usr/local/etc/raddb/users
查找 steve Cleartext-Password := "testing" （76-84行）, 取消该段内容的注释。

1
2
3
4
5

# 大写X，意思是以debug模式运行。
/usr/local/sbin/radiusd -X 

#新开一个窗口执行，看到 "Access-Accept packet" 表示成功了，"Access-Reject" 表示失败了。
/usr/local/bin/radtest steve testing localhost 0 testing123

1
2

# 查找"sql.conf”(683行)，去掉#号
vim /usr/local/etc/raddb/radiusd.conf

1
2

# 123456是你mysql的root密码
mysqladmin -uroot -p123456 create radius;

1
2
3
4

#修改radius帐号的密码
cd /usr/local/etc/raddb/sql/mysql
sed -i 's/radpass/123456/g' admin.sql
sed -i 's/radpass/123456/g' /usr/local/etc/raddb/sql.conf

1
2
3
4
5
6

mysql -uroot -p123456 < admin.sql
mysql -uroot -p123456 radius < ippool.sql
mysql -uroot -p123456 radius < schema.sql
mysql -uroot -p123456 radius < wimax.sql
mysql -uroot -p123456 radius < cui.sql
mysql -uroot -p123456 radius < nas.sql

1

sed -i 's/\#readclients/readclients/g' /usr/local/etc/raddb/sql.conf

1
2

# 查找simul_count_query将279-282行注释去掉
vim /usr/local/etc/raddb/sql/mysql/dialup.conf

1

vim /usr/local/etc/raddb/sites-enabled/default

1

vim /usr/local/etc/raddb/sites-enabled/inner-tunnel

1
2
3
4
5

wget -c ftp://ftp.freeradius.org/pub/freeradius/freeradius-client-1.1.6.tar.gz
tar -zxf freeradius-client-1.1.6.tar.gz
cd freeradius-client-1.1.6
./configure
make && make install

1
2
3

cat >>/usr/local/etc/radiusclient/servers<<EOF
localhost   testing123
EOF

1

sed -i 's/localhost/192.168.8.129/g' /usr/local/etc/radiusclient/radiusclient.conf

1
2

wget -c http://small-script.googlecode.com/files/dictionary.microsoft
mv ./dictionary.microsoft /usr/local/etc/radiusclient/

1
2
3
4
5
6
7

cat >>/usr/local/etc/radiusclient/dictionary<<EOF
INCLUDE /usr/local/etc/radiusclient/dictionary.sip
INCLUDE /usr/local/etc/radiusclient/dictionary.ascend
INCLUDE /usr/local/etc/radiusclient/dictionary.merit
INCLUDE /usr/local/etc/radiusclient/dictionary.compat
INCLUDE /usr/local/etc/radiusclient/dictionary.microsoft
EOF

1
2
3

sed -i 's/logwtmp/\#logwtmp/g' /etc/pptpd.conf
sed -i 's/radius_deadtime/\#radius_deadtime/g' /usr/local/etc/radiusclient/radiusclient.conf
sed -i 's/bindaddr/\#bindaddr/g' /usr/local/etc/radiusclient/radiusclient.conf

1
2
3
4

cat >>/etc/ppp/pptpd-options<<EOF
plugin /usr/lib/pppd/2.4.5/radius.so
radius-config-file /usr/local/etc/radiusclient/radiusclient.conf
EOF

1
2
3
4

cat >>/etc/ppp/options.xl2tpd<<EOF
plugin /usr/lib/pppd/2.4.5/radius.so
radius-config-file /usr/local/etc/radiusclient/radiusclient.conf
EOF

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21

# 连接 MySQL 数据库
mysql -uroot -p123456;

# 使用 radius 数据库
USE radius;

# 添加用户demo，密码demo，注意是在radchec表
INSERT INTO radcheck (username,attribute,op,VALUE) VALUES ('demo','Cleartext-Password',':=','demo');

# 将用户demo加入VIP1用户组
INSERT INTO radusergroup (username,groupname) VALUES ('demo','VIP1');

# 限制同时登陆人数，注意是在radgroupcheck表
INSERT INTO radgroupcheck (groupname,attribute,op,VALUE) VALUES ('normal','Simultaneous-Use',':=','1');

# 其他
INSERT INTO radgroupreply (groupname,attribute,op,VALUE) VALUES ('VIP1','Auth-Type',':=','Local');
INSERT INTO radgroupreply (groupname,attribute,op,VALUE) VALUES ('VIP1','Service-Type',':=','Framed-User');
INSERT INTO radgroupreply (groupname,attribute,op,VALUE) VALUES ('VIP1','Framed-Protocol',':=','PPP');
INSERT INTO radgroupreply (groupname,attribute,op,VALUE) VALUES ('VIP1','Framed-MTU',':=','1500');
INSERT INTO radgroupreply (groupname,attribute,op,VALUE) VALUES ('VIP1','Framed-Compression',':=','Van-Jacobson-TCP-IP');

1
2

cp /usr/local/sbin/rc.radiusd /etc/init.d/radiusd
/etc/init.d/radiusd start

通过FreeRADIUS实现VPN流量控制功能

1

vim /usr/local/etc/raddb/radiusd.conf

1

vim /usr/local/etc/raddb/sql/mysql/counter.conf

1
2
3
4
5
6
7
8
9

sqlcounter monthlytrafficcounter {
    counter-name = Monthly-Traffic
    check-name = Max-Monthly-Traffic
    reply-name = Monthly-Traffic-Limit
    sqlmod-inst = sql
    key = User-Name
    reset = monthly
    query = "SELECT SUM(acctinputoctets + acctoutputoctets) FROM radacct WHERE UserName='%{%k}' AND UNIX_TIMESTAMP(AcctStartTime) > '%b'"
}

1

vim /usr/local/etc/raddb/sites-enabled/default

1

monthlytrafficcounter

1

vim /usr/local/etc/raddb/dictionary

1
2

ATTRIBUTE Max-Monthly-Traffic 3003 integer
ATTRIBUTE Monthly-Traffic-Limit 3004 integer

1

mysql -uroot -p123456;

1

INSERT INTO radgroupcheck (groupname,attribute,op,VALUE) VALUES ('VIP1','Max-Monthly-Traffic',':=','1073741824');

1

INSERT INTO radgroupcheck (groupname,attribute,op,VALUE) VALUES ('VIP1','Acct-Interim-Interval',':=','60');

Nov 25 00:17:58 srv xl2tpd[3447]: control_finish: Peer requested tunnel 18 twice, ignoring second one.
Nov 25 00:17:58 srv xl2tpd[3447]: Maximum retries exceeded for tunnel 6477.  Closing.

解决方法如下：

在/etc/ipsec.conf里的L2TP-PSK-noNAT中加上

dpddelay=40
dpdtimeout=130
dpdaction=clear

参数说明：

dpddelay

Set the delay (in seconds) between Dead Peer Dectection (RFC 3706) keepalives (R_U_THERE, R_U_THERE_ACK) that are sent for this connection (default 30 seconds). If dpddelay is set, dpdtimeout also needs to be set.

dpdtimeout

Set the length of time (in seconds) we will idle without hearing either an R_U_THERE poll from our peer, or an R_U_THERE_ACK reply. After this period has elapsed with no response and no traffic, we will declare the peer dead, and remove the SA (default 120 seconds). If dpdtimeout is set, dpdaction also needs to be set.

dpdaction

When a DPD enabled peer is declared dead, what action should be taken. hold (default) means the eroute will be put into %hold status, while clear means the eroute and SA with both be cleared. restart means the the SA will immediately be renegotiated, and restart_by_peer means that ALLSA’s to the dead peer will renegotiated.dpdaction=clear is really only useful on the server of a Road Warrior config.

呵呵，更多说明。还是做个明白人好。

Support for Dead Peer Detection:
A Traffic-Based Method of Detecting Dead IKE Peers

The DPD feacture provides support for RFC3706 Dead Peer Detection.

DPD works using a keepalive system, where when a tunnel is idle
(established, but no traffic has traversed it for N period (dpddelay=N1)
one or both sides send a “hello” messages (R_U_THERE) and the other
replies with a acknowledge message (R_U_THERE_ACK). If no response
received, this continues until the DPD timeout value (dpdtimeout=N2)
has elapsed. If there still hasn’t been any traffic or R_U_THERE_ACK
packets received, the peer is declared to be dead, and the SA deleted,
and related eroute removed from the table.

DPD support is tuneable on a per connection basis, using the dpdaction,
dpddelay and dpdaction directives. See also the ipsec.conf man page for
more information.

An example follows:

conn laptop2myhome
left=%defaultroute
leftnexthop=%defaultroute
right=192.168.0.1
dpddelay=30
dpdtimeout=120
dpdaction=clear

In the above example, our keepalive time is 30 seconds, our timeout is 120
seconds, and our action is clear. So during idle periods, we send
R_U_THERE packets every 30 seconds. If the tunnel is idle and we haven’t
received an R_U_THERE_ACK from our peer in 120 seconds, we declare the
peer dead, and clear the SA + eroute (the entire tunnel is removed).

Note that both sides must have either dpddelay or dpdtimeout set for DPD
to be proposed or accepted. If one directive is set but not the other,
the defaults are used (dpddelay=30, dpdtimeout=120).

The dpdaction parameter controls what we do when a peer is determined to
be dead. If set to “hold” (the default) it will place the eroute into
%hold status, and wait for the peer to return. If set to “clear” it will
remove the connection entirely, including both the SA and eroute.

We recommend that “hold” be used for statically defined tunnels, and
“clear” be used for roadwarrior tunnels.

下面是OpenWRT Wiki的说明:

PPTP NAT Traversal

Background

Required Packages

Installation

opkg install kmod-ipt-nathelper-extra

1.安裝pptpd:
opkg update
opkg install pptpd
opkg install kmod-mppe
/etc/init.d/pptpd enable
/etc/init.d/pptpd start

2. 配置pptpd
———————————–
vi /etc/pptpd.conf

option /etc/ppp/options.pptpd
localip 192.168.1.1
remoteip 192.168.1.2-99
speed 1152000
stimeout 10
#localip & remoteip are not needed, ip management is done by pppd

——————————————–
vi /etc/ppp/options.pptpd

auth
name “pptp-server”
lcp-echo-failure 3
lcp-echo-interval 60
default-asyncmap
mtu 1482
mru 1482
nobsdcomp
nodeflate
#noproxyarp
#nomppc
chapms-strip-domain
# Otherwise, your chap-secret file will have to include “DOMAIN\\user” instead of user.
mppe required,no40,no56,stateless
require-mschap-v2
refuse-chap
refuse-mschap
refuse-eap
refuse-pap
ms-dns 192.168.1.1
#plugin radius.so
#radius-config-file /etc/radius.conf
———————————————————–
最後修改你pptp用戶名及密碼,格式: username * password *

vi /etc/ppp/chap-secrets

user * 123 *
————————————————————-

加入以下firewall rule:

vi /etc/firewall.user

iptables -A input_wan -p tcp –dport 1723 -j ACCEPT
iptables -A input_wan -p gre -j ACCEPT
iptables -A input_rule -i ppp+ -j ACCEPT
iptables -A forwarding_rule -i ppp+ -j ACCEPT
iptables -A forwarding_rule -o ppp+ -j ACCEPT
iptables -A output_rule -o ppp+ -j ACCEPT

不知道startssl是不是唯一一家其根证书被主流浏览器认可且提供免费的SSL证书的。申请(https://www.startssl.com/)过程并不麻烦，需要确认电邮地址还域名归属，确认都是通过电子邮件瞬间完成。

在Apache上安装却并不顺利，总是找不到证书。问题是出在文件格式，证书是在Windows下生成的，需要转成unix文件格式。这个可又通过dos2unix完成。另外，在Windows创建文件时，要使用纯文本格式。自己存成了UTF8格式，apache也不行。最后删除的文件开始的UTF8文件标识就好了。

 iptables-save > /etc/iptables.up.rules

To make sure the iptables rules are started on a reboot we’ll create a new file:

 nano /etc/network/if-pre-up.d/iptables

Add these lines to it:

 #!/bin/bash
 /sbin/iptables-restore < /etc/iptables.up.rules

The file needs to be executable so change the permissions:

 chmod +x /etc/network/if-pre-up.d/iptables

From: http://wiki.debian.org/iptables

route -p add 0.0.0.0 mask 0.0.0.0 dev eth0:x

在网上找了些文章，安装过程中遇到些问题，最终还是配置好。主是要注意的不能用CentOS 5自身带的OpenSwan(Federa 14中的OpenSwan是可以的），需要从更新版本的源码自己编译安装，XL2TP可是从EPEL中安装，当然也可通过源码安装。

下面内容引自 http://www.wifay.com/blog/2010/08/21/centos-install-ipsec-l2tp-vpn/

一、部署IPSEC 、安装 openswan

1、关联包

yum install make gcc gmp-devel bison flex

2、编译安装

cd /usr/src
wget http://www.openswan.org/download/openswan-2.6.24.tar.gz
tar zxvf openswan-2.6.24.tar.gz
cd openswan-2.6.24
make programs install

3、配置

vi /etc/ipsec.conf

config setup
nat_traversal=yes
virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12
oe=off
protostack=netkey

conn L2TP-PSK-NAT
rightsubnet=vhost:%priv
also=L2TP-PSK-noNAT

conn L2TP-PSK-noNAT
authby=secret
pfs=no
auto=add
keyingtries=3
rekey=no
ikelifetime=8h
keylife=1h
type=transport
left=YOUR.SERVER.IP.ADDRESS
leftprotoport=17/1701
right=%any
rightprotoport=17/%any

4、 设置 Shared Key

vi /etc/ipsec.secrets

YOUR.SERVER.IP.ADDRESS %any: PSK “YourSharedSecret”

5、 修改包转发设置

for each in /proc/sys/net/ipv4/conf/*
do
echo 0 > $each/accept_redirects
echo 0 > $each/send_redirects
done

6、 重启 IPSec ，测试

/etc/init.d/ipsec restart
ipsec verify

.

二、安装 L2TP

1、关联包

yum install libpcap-devel ppp

2、编译安装

cd /usr/src
wget http://downloads.sourceforge.net/project/rp-l2tp/rp-l2tp/0.4/rp-l2tp-0.4.tar.gz
tar zxvf rp-l2tp-0.4.tar.gz
cd rp-l2tp-0.4
./configure
make
cp handlers/l2tp-control /usr/local/sbin/
mkdir /var/run/xl2tpd/
ln -s /usr/local/sbin/l2tp-control /var/run/xl2tpd/l2tp-control

cd /usr/src
wget  http://www.xelerance.com/software/xl2tpd/xl2tpd-1.2.4.tar.gz
tar zxvf xl2tpd-1.2.4.tar.gz
cd xl2tpd-1.2.4
make install

3、配置

mkdir /etc/xl2tpd
vi /etc/xl2tpd/xl2tpd.conf

[global]
ipsec saref = yes

[lns default]
ip range = 10.1.2.2-10.1.2.254
local ip = 10.1.2.1
refuse chap = yes
refuse pap = yes
require authentication = yes
ppp debug = yes
pppoptfile = /etc/ppp/options.xl2tpd
length bit = yes

4、修改 ppp 配置

vi /etc/ppp/options.xl2tpd

require-mschap-v2
ms-dns 8.8.8.8
ms-dns 8.8.4.4
asyncmap 0
auth
crtscts
lock
hide-password
modem
debug
name l2tpd
proxyarp
lcp-echo-interval 30
lcp-echo-failure 4

5、添加用户名/密码

vi /etc/ppp/chap-secrets

# user      server      password            ip
username        l2tpd       userpass        *

6、启用包转发

iptables --table nat --append POSTROUTING --jump MASQUERADE

echo 1 > /proc/sys/net/ipv4/ip_forward

7、修改/etc/sysctl.conf

vi  /etc/sysctl.conf

net.ipv4.ip_forward = 1
net.ipv4.conf.default.rp_filter = 0
net.ipv4.conf.default.accept_source_route = 0
kernel.sysrq = 0
kernel.core_uses_pid = 1
net.ipv4.tcp_syncookies = 1
kernel.msgmnb = 65536
kernel.msgmax = 65536
kernel.shmmax = 68719476736
kernel.shmall = 4294967296

8、启动 xl2tpd

/usr/local/sbin/xl2tpd

.

三、扫尾

设置开机自动运行

vi /etc/rc.local

iptables --table nat --append POSTROUTING --jump MASQUERADE

echo 1 > /proc/sys/net/ipv4/ip_forward
for each in /proc/sys/net/ipv4/conf/*
do
echo 0 > $each/accept_redirects
echo 0 > $each/send_redirects
done
/etc/init.d/ipsec restart
/usr/local/sbin/xl2tpd

.