iptables+l7-filter 封QQ MSN和P2P

root # wget ftp://ftp.tw.kernel.org/pub/linux/kernel/v2.6/linux-2.6.24.4.tar.bz2
root # wget ftp://ftp.netfilter.org/pub/iptables/iptables-1.4.0.tar.bz2
root # wget http://nchc.dl.sourceforge.net/sourceforge/l7-filter/netfilter-layer7-v2.17.tar.gz
root # wget http://nchc.dl.sourceforge.net/sourceforge/l7-filter/l7-protocols-2008-02-20.tar.gz

root # patch -p1 < ../netfilter-layer7-v2.17/kernel-2.6.22-2.6.24-layer7-2.17.patch
patching file net/netfilter/Kconfig
patching file net/netfilter/Makefile
patching file net/netfilter/xt_layer7.c
patching file net/netfilter/regexp/regexp.c
patching file net/netfilter/regexp/regexp.h
patching file net/netfilter/regexp/regmagic.h
patching file net/netfilter/regexp/regsub.c
patching file net/netfilter/nf_conntrack_core.c
patching file net/netfilter/nf_conntrack_standalone.c
patching file include/net/netfilter/nf_conntrack.h
patching file include/linux/netfilter/xt_layer7.h

0001
0002
0003
0004
0005
0006
0007
0008
0009
0010
0011
0012
0013
0014
0015
0016
0017
0018
0019
0020
0021
0022
0023
0024
0025
0026
0027
0028
0029
0030
0031
0032
0033
0034
0035
0036
0037
0038
0039
0040
0041
0042
0043
0044
0045
0046
0047
0048
0049
0050
0051
0052
0053
0054
0055
0056
0057
0058
0059
0060
0061
0062
0063
0064
0065
0066
0067
0068
0069
0070
0071
0072
0073
0074
0075
0076
0077
0078
0079
0080
0081
0082
0083
0084
0085
0086
0087
0088
0089
0090
0091
0092

root # make menuconfig
General setup --->
[*] Prompt for development and/or incomplete code/drivers
Networking --->
Networking options --->
[*] Network packet filtering framework (Netfilter) --->
Core Netfilter Configuration --->
<M> Netfilter connection tracking support
-*- Connection tracking flow accounting
-*- Connection mark tracking support
[*] Connection tracking security mark support
[*] Connection tracking events (EXPERIMENTAL)
<M> SCTP protocol connection tracking support (EXPERIMENTAL)
<M> UDP-Lite protocol connection tracking support (EXPERIMENTAL)
<M> Amanda backup protocol support
<M> FTP protocol support
<M> H.323 protocol support (EXPERIMENTAL)
<M> IRC protocol support
<M> NetBIOS name service protocol support (EXPERIMENTAL)
<M> PPtP protocol support
<M> SANE protocol support (EXPERIMENTAL)
<M> SIP protocol support (EXPERIMENTAL)
<M> TFTP protocol support
<M> Connection tracking netlink interface (EXPERIMENTAL)
{M} Netfilter Xtables support (required for ip_tables)
<M> "CLASSIFY" target support
<M> "CONNMARK" target support
<M> "DSCP" target support
<M> "MARK" target support
<M> "NFQUEUE" target Support
<M> "NFLOG" target support
<M> "NOTRACK" target support
<M> "TRACE" target support
<M> "TRACE" target support
<M> "SECMARK" target support
<M> "CONNSECMARK" target support
<M> "TCPMSS" target support
<M> "comment" match support
<M> "connbytes" per-connection counter match support
<M> "connlimit" match support"
<M> "connmark" connection mark match support
<M> "conntrack" connection tracking match support
<M> "DCCP" protocol match support
<M> "DCCP" protocol match support
<M> "DSCP" match support
<M> "ESP" match support
<M> "helper" match support
<M> "length" match support
<M> "limit" match support
<M> "mac" address match support
<M> "mark" match support
<M> IPsec "policy" match support
<M> Multiple port match support
<M> "physdev" match support
<M> "pkttype" packet type match support
<M> "quota" match support
<M> "realm" match support
<M> "sctp" protocol match support (EXPERIMENTAL)
<M> "state" match support
<M> "layer7" match support
[*] Layer 7 debugging output
<M> "statistic" match support
<M> "string" match support
<M> "tcpmss" match support
<M> "time" match support
<M> "u32" match support
<M> "hashlimit" match support
IP: Netfilter Configuration --->
<M> IPv4 connection tracking support (required for NAT)
[*] proc/sysctl compatibility with old connection tracking (NEW
<M> IP Userspace queueing via NETLINK (OBSOLETE)
<M> IP tables support (required for filtering/masq/NAT)
<M> IP range match support
<M> TOS match support
<M> recent match support
<M> ECN match support
<M> AH match support
<M> TTL match support
<M> Owner match support
<M> address type match support
<M> Packet filtering
<M> REJECT target support
<M> LOG target support
<M> ULOG target support
<M> Full NAT (NEW)
<M> MASQUERADE target support
<M> REDIRECT target support
<M> NETMAP target support
<M> SAME target support (OBSOLETE)
<M> Basic SNMP-ALG support (EXPERIMENTAL)
<M> Packet mangling
<M> TOS target support

root # cd /usr/src/kernels/iptables-1.4.0
root # patch -p1 < ../netfilter-layer7-v2.17/iptables-1.4-for-kernel-2.6.20forward-layer7-2.17.patch
patching file extensions/libipt_layer7.c
patching file extensions/libipt_layer7.man
patching file extensions/.layer7-test

root # cd iptables-1.4.2
root # cp ../netfilter-layer7-v2.21/iptables-1.4.1.1-for-kernel-2.6.20forward/libxt_layer7.* extensions/
root # ./configure --with-ksource=/usr/src/kernels/linux
root # make
root # make install

root # iptables -A OUTPUT -m layer7 --l7proto msnmessenger -j DROP
root # iptables -L -n -v
Chain INPUT (policy ACCEPT 3056 packets, 394K bytes)
pkts bytes target prot opt in out source destination

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination

Chain OUTPUT (policy ACCEPT 1274 packets, 159K bytes)
pkts bytes target prot opt in out source destination
34 2584 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 LAYER7 l7proto msnmessenger

root # iptables -A OUTPUT -m layer7 --l7proto bittorrent -j DROP
root # iptables -L -n -v
Chain INPUT (policy ACCEPT 33768 packets, 33M bytes)
pkts bytes target prot opt in out source destination

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination

Chain OUTPUT (policy ACCEPT 25235 packets, 2362K bytes)
pkts bytes target prot opt in out source destination
91 6916 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 LAYER7 l7proto msnmessenger
78 7920 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 LAYER7 l7proto bittorrent

(收藏大鬼不动Blog)
平台:CentOS release 5.3 (Final) ChinaUnix个人空间 v+^0r:d G\u0003P
内核:2.6.18-128.el5 ChinaUnix个人空间&a\u0013D\u001B?\u0001U$a.^\u001Cl\u001A]*D\u000Eh
iptables:1.3.5 ChinaUnix个人空间\u001BI\u001ER\u001DE\u0015E\u0015Q
1、准备阶段 ChinaUnix个人空间 R!R8j-W\u0004U$L\u0010M3Y6R
1、kernel-2.6.28:
'W)J\u0013B(^\u001A{ V\u0003l\u0008m0ftp://ftp.kernel.org/pub/linux/kernel/v2.6/linux-2.6.27.tar.gz ChinaUnix个人空间1]\u0008k\u0004V c(e.c*J\u0014L\u001AX)p(R
2、iptables-1.4.1.1: ChinaUnix个人空间4?0k\u0002]?a\u0019V7@\u0014`\u001A{/a
http://www.netfilter.org/projects/iptables/files/iptables-1.4.1.1.tar.bz2
\u0017W\u0008?'}%W\u0012o\u0002n'W2s\u0014A03、netfilter-layer7: ChinaUnix个人空间6v\u001BR\u0016d6Z4\\u000Eo
http://nchc.dl.sourceforge.net/sourceforge/l7-filter/netfilter-layer7-v2.21.tar.gz ChinaUnix个人空间\u001E].~ A\u0018_\u0005[(J:T
帮助文件: ChinaUnix个人空间1u\u001BJ6A/F7M {(M!{\u001Dy
http://l7-filter.sf.net/HOWTO-kernel
\u0008F2F\u001FK\u0004_\u0018r7@%k0非常不错的帮助文档,如果安装前详细阅读,安装过程中能减少很多错误,因为没有事先看,害得我重编译了好多次;
\u000E};D\u001BE8~ i#R04、l7-protocols-2008-12-18: ChinaUnix个人空间\u001E\;C\u0004l$@6~\u0003i5G6w\u0006x i
http://nchc.dl.sourceforge.net/sourceforge/l7-filter/l7-protocols-2008-12-18.tar.gz ChinaUnix个人空间\u0013W,s,]\u000CY\u000FK0D\u001ER
5、将上述文件下载至/usr/src 下,解压:
5^5G"d\u000Cx+F\u000Eq0[root@ 大鬼不动 src]# tar jxvf iptables-1.4.1.1.tar.bz2 && tar zxvf linux-2.6.27.tar.gz && tar zxvf netfilter-layer7-v2.21.tar.gz
\u0012I2v6D%o1R'L\u000El0&& tar zxvf l7-protocols-2008-12-18.tar.gz
\u0003d\u0015z9z5Y\u0007`02、开始编译 ChinaUnix个人空间1d\u0011g\u000FJ\u0014c\u0011O\u0013b+G
1、切换到 l7-protocols-2008-12-18 目录,执行 make install
:Y(y(a S\u0018d\u0018\0[root@大鬼不动 src]# cd l7-protocols-2008-12-18 ChinaUnix个人空间\u001DM!?.|\u0011v n
[root@大鬼不动 l7-protocols-2008-12-18]# cat Makefile ChinaUnix个人空间\u0004}&Q\u000Fi?K-N
all:
0f4{2H\u0007v"w\u001B\*f\u0008y0             @echo Nothing to compile, just run \'make install\' #提示、帮助、说明; ChinaUnix个人空间\u0010p\u0015_1F\u0005E\u000E}2j
             @echo $This simply copies this directory into $(PREFIX)/etc/l7-protocols $
6x\u000Fn\u0015k f4j {\u000CI\u0013I0 install:
\u0004\\u0002|2D\u0018O X0             mkdir -p $(PREFIX)/etc/l7-protocols
\u0018d2M\u0007L3Y\u0006w0             cp -R * $(PREFIX)/etc/l7-protocols
0`\u0008g$k\u001E`1{\u001Ey7\0不执行 make install 也可以,就将该目录下的所有文件、目录拷贝到/etc/l7-protocols/下; ChinaUnix个人空间9z\u0007f)u?u/P
[root@大鬼不动 l7-protocols-2008-12-18]# make install
\u0014H4{ _(K"e#I)z!t02、切换至 linux-2.6.28 目录,编译 kernel
\u0019n\u0008b$Q3c\u001DX\u001A?0[root@大鬼不动 l7-protocols-2008-12-18]# cd ../linux-2.6.27 ChinaUnix个人空间\u0015h\u000B]\u0006J\u001Cc\u0007o j\u0008H\u001Fz\u0011_+M
                                                                                #利用发行版本提供的.config 来配置,           这样方便点;
\u0008R\u0016R\u0016D\u0010u I\u0019[0[root@大鬼不动 linux-2.6.27]# cp /boot/config-2.6.18-128.el5 .config
\u001CS\u0015?4f\u0018R\u0003r\u001EW\u001B`\u0011z0[root@大鬼不动 linux-2.6.27]# patch -p1 < /usr/src/netfilter-layer7-v2.21/kernel-2.6.25-2.6.28-layer7-2.21.patch
)R\u000CA,F\u0001m(O#A0 1 ChinaUnix个人空间4D?d8o*W\u000B_\u0014K/l1n)b![
    How to patch a source tree
^9z q\u001Aq\u0010A\u0003c\u000BX\u0016\1A0 Suppose you have a patch called happy.patch. To apply it, go into the root directory of the ChinaUnix个人空间:[\u0008Q*V.B U\u0013q\u0006P7l6c3P
source tree you want to patch and run "patch -p1 < happy.patch"
2L)_/^$t$D\u0014y(r0[root@大鬼不动 linux-2.6.27]# make menuconfig #需要 gcc 和 ncurses-devel 的支持,如果没有安装,yum 安装; ChinaUnix个人空间+]\u000Ew\u0005@2F$^
   Load an Alternate Configuration Fileà载入刚才复制过来的.config,然后执行下面操作:
0V v\u001Bk\u0004S\u0019n\u0017Y4N9n\u0004L!m0make menuconfig-->Networking support-->Networking options-->Network packet filtering framework (Netfilter)
B\u001CC4C\u0019C!@1W\u001Fp5~\u001DY\u0005k\u001Aj0勾选需要的模块,然后退出,保存至.config。 ChinaUnix个人空间*n\u0007i8h\u001Da\u0015A\u0010o\u0005e+J
备注:
\u0001b H\u0015J0x\u0018|\u0002]0     内核配置有两种方法,一种是直接置入内核 * ;另一种是编成模块 M ;两种方法各有优点;直接编入内核的, ChinaUnix个人空间1w\u0001Z*G5g\u0004d\u0012m\u000F~\u001FX
比如设备的启动,不再需要加载模块的这一过程了;而编译成模块,则需要加载设备的内核支持的模块;但直接把
\u0013J\u0008^&}\u0005~\u0002r R:]0所有的东西都编入内核也不是可行的,内核体积会变大,系统负载也会过重。我们编内核时最好把极为重要的编入 ChinaUnix个人空间 [\u0014f3^9B6b\u0003k a
内核;其它的如果您不明白的,最好用默认。 ChinaUnix个人空间\u0004z-g%G\u001EY3a G
     如果不勾选“Netfilter connection tracking support”            ,那么“”layer7” match support”将不会在这里显示出来,
1W$\ V\u0002T2N p\u001Fq\u0005z\u0015h%H0务必将“Netfilter connection tracking support”打上对勾。 ChinaUnix个人空间$F8j*r)d\u0001@\u0003e\u0012B\u0019K\u0001u.H
[root@大鬼不动 linux-2.6.27]# make && make modules_install && make install ChinaUnix个人空间\u0007_+_?~ a,d\u0014S4M\u0014D!p&F
[root@大鬼不动 linux-2.6.27]# vi /boot/grub/grub.conf       #以新内核启动系统,重启系统;
8?\u0012A8i,N\u001Ck\u001D{;`"f*~03、切换至 iptables-1.4.1.1 目录,编译 iptables ChinaUnix个人空间\u0011e `\u0019k\u0003C6G\u0016Z\u0012]$j
查看 layer7 官方帮助: ChinaUnix个人空间*b\u000Bt#I\u0015^\u0015W7u p?G ?
     http://l7-filter.sf.net/HOWTO-kernel
+M U-i\u0006b e0 iptables 1.4.1.1 and newer
\u0003F\u0011j\u000Co\u0012`\u0017F\u0003e*n v0 Copy libxt_layer7.c and libxt_layer7.man (from the subdirectory of the "Layer 7 patches"
;?)L3F\u0008a\u0008y\u0016^#O3\?w\u0008r ]0 package that the README points you to) to the extensions/ directory of your iptables source. ChinaUnix个人空间\u0016k&e1o\u0015B\u0006m
Then: ChinaUnix个人空间\u0013_;o\u0011n:E\u0010q\u0004d\u0004w\u0004p
         "./configure --with-ksource=/path/to/patched/kernel_source" (use the full path)
1t\u0010e\u001D]#M#N3} @\u0012p0      •
\u000Bz\u001AP+b2V5c\u000FY#~0f\u0006E\u0013y e\u0018G0         "make"
:[\u001AM R\u0011T\u0015t\u0007Y t0      • ChinaUnix个人空间 h'C.W\u001AB\u001AZ\u0004Z\u001ER)d\u0008i
         (as root) "make install"
:j7?\u0018k\u000E@ O,I2c0      •
\u000Ez:X\u0014b!H\u0005r/{ v\u000Bg0[root@大鬼不动 linux-2.6.27]# cd ../iptables-1.4.1.1 ChinaUnix个人空间#[\u000Fe J\u0007a\u0017O\u0016M\u001DX\u0010b
[root@大鬼不动 iptables-1.4.1.1]# cp ../netfilter-layer7-v2.21/iptables-1.4.1.1-for-kernel-2.6.20forward/* extensions/ ChinaUnix个人空间,W\u0002Z'g H;u\u0003q-A
[root@ 大鬼不动 iptables-1.4.1.1]# ./configure --with-ksource=/usr/src/linux-2.6.27 && make && make install && reboot
3n)e$E#Y7i\u0011M._)t9C0备注: ChinaUnix个人空间7|\u001B}\u001DA\u0007~\u0013N\u000F_/L
     如果不将/usr/src/netfilter-layer7-v2.21/iptables-1.4.1.1-for-kernel-2.6.20forward/下的 libxt_layer7.c、       libxt_layer7.man ChinaUnix个人空间(N\u0014N\u0016a\u000CK'K
拷贝至/usr/src/iptables-1.4.1.1/extensions/下,编译时将出现大量错误提示,编译失败,另外执行 iptables 规则时将出
5O&@\u000B}9X\u001DY\u0017]7r\u001F@)~\u001FF0现以下错误提示: ChinaUnix个人空间\u0019e\u001B[,q'`3^?S\u000Fa
iptables v1.4.1.1: Couldn't load match `layer7':/usr/local/libexec/xtables/libipt_layer7.so: cannot open shared object file: ChinaUnix个人空间'f\u0013@3?\u001Do u\u0005V
No such file or directory
\u001Fm"j\u0003r8N\u000B|\u0014K\u0013D\u001Fv-X\u0001S\u0006x0 Try `iptables -h' or 'iptables --help' for more information.
\u000CM5U!G6j)X A03、测试 ChinaUnix个人空间/c&e\u0001K4O3D;K:l#B\u0004E
     根据自己的需求测试吧!
*P\u0001D\u0004w g.Y `04、结束
\u0007s2a\u001Ey\u0015[\u001AT2H3d9Z&d0     本文同样适合于 RHEL5.3,同样也适合 kernel-2.6.28+iptables-1.4.1.1;

iptables+l7-filter 封QQ MSN和P2P

你可能感兴趣的:(职场,iptables,休闲)