iptables内核编译
iptables
内核编译
1.
了解需要了解内核编译用到的
4
个包
linux- 2.6.28 .10.tar.gz
netfilter-layer7-v2.22.tar.gz
l7-protocols- 2009-05-28 .tar.gz
iptables- 1.4.4 .tar.bz2
2.
tar zxvf linux- 2.6.28 .10.tar.gz -C /usr/src
tar zxvf netfilter-layer7-v2.22.tar.gz -C /usr/src
ln �Cs /usr/src/linux- 2.6.28 .10/ /usr/src/linux
cd /usr/src/linux/
patch-p1< ../netfilter-layer7-v2.22/kernel- 2.6.25 -2.6.28-layer7-2.22.patch
（打补丁）
3.
cp /boot/config- 2.6.18 -164.el5 /usr/src/linux/.config
system-config-packages
（打开图形界面，选择要安装的包）
make menuconfig
4.
打开图形界面，进行选择：
Networking support
→
Networking Options
→
Network packet filtering framework
→
Code Netfilter Configuration
Ü
<M>
Netfilter connection tracking support
Ü
<M>
“layer7” match support
Ü
<M>
“string” match support
Ü
<M>
“time” match support
Ü
<M>
“iprange” match support
Ü
<M>
“connlimit” match support
Ü
<M>
“state” match support
Ü
<M>
“conntrack” connection match support
Ü
<M>
“mac” address match support
Ü
<M> "multiport" Multiple port match support
Ü
<M>FTP Protocols Support
5.
Networking support
→
Networking Options
→
Network packet filtering framework
→
IP: Netfilter Configuration
Ü
<M> IPv4 connection tracking support (required for NAT)
Ü
<M> Full NAT
Ü
<M> MASQUERADE target support <M> NETMAP target support <M> REDIRECT target support
6.Start compiling and installing
Ü
make
Ü
make modules_install
Ü
make install
Ü
7.
Edit the /boot/grub/grub.conf, set the default booting kernel to the new kernel
Ü
Restart
8.
cp /etc/rc.d/init.d/iptables ~/iptables
Ü
rpm -e iptables-ipv6 iptables iptstate --nodeps
Ü
tar jxvf iptables- 1.4.4 .tar.bz2 �CC /usr/src
Ü
cd /usr/src/iptables- 1.4.4
Ü
cp ../netfilter-layer7-v2.22/iptables- 1.4.3 forward-for-kernel-2.6.20forward/libxt_layer7.* ./extensions/
Ü
./configure --prefix=/usr --with-ksource=/usr/src/linux
Ü
make
Ü
make install
9.
tar zxvf l7-protocols- 2009-05-28 .tar.gz
v
# cd l7-protocols- 2009-05-28
v
# make install
v
# mv ~/iptables /etc/rc.d/init.d/
v
# service iptables start
(mv iptables-config.rpmsave iptables-config
ln �Cs /usr/sbin/iptables /sbin/iptables)
L7-filter Supported Protocols
v
bittorrent
Ü
P2P filesharing / publishing tool
v
edonkey
Ü
eDonkey2000 - P2P filesharing
v
kugoo
Ü
KuGoo - a Chinese P2P program
v
msn-filetransfer
Ü
MSN (Micosoft Network) Messenger file transfers
v
msnmessenger
Ü
Microsoft Network chat client
v
pplive
Ü
Chinese P2P streaming video
v
qq
v
xunlei