iptables内核编译

iptables内核编译

1.了解需要了解内核编译用到的4个包

linux-2.6.28.10.tar.gz

netfilter-layer7-v2.22.tar.gz

l7-protocols-2009-05-28.tar.gz

iptables-1.4.4.tar.bz2

2.加压linux包

tar zxvf linux-2.6.28.10.tar.gz -C /usr/src

tar zxvf netfilter-layer7-v2.22.tar.gz -C /usr/src

ln –s /usr/src/linux-2.6.28.10/ /usr/src/linux

cd /usr/src/linux/

patch-p1< ../netfilter-layer7-v2.22/kernel-2.6.25-2.6.28-layer7-2.22.patch（打补丁）

3. cp /boot/config-2.6.18-164.el5 /usr/src/linux/.config

system-config-packages（打开图形界面，选择要安装的包）

make menuconfig

4.打开图形界面，进行选择：

Networking support→ Networking Options →Network packet filtering framework →Code Netfilter Configuration

Ü <M> Netfilter connection tracking support

Ü <M> “layer7” match support

Ü <M> “string” match support

Ü <M> “time” match support

Ü <M> “iprange” match support

Ü <M> “connlimit” match support

Ü <M> “state” match support

Ü <M> “conntrack” connection match support

Ü <M> “mac” address match support

Ü <M> "multiport" Multiple port match support

Ü <M>FTP Protocols Support

5. Networking support→ Networking Options →Network packet filtering framework → IP: Netfilter Configuration

Ü <M> IPv4 connection tracking support (required for NAT)

Ü <M> Full NAT

Ü <M> MASQUERADE target support <M> NETMAP target support <M> REDIRECT target support

6.Start compiling and installing

Ü make

Ü make modules_install

Ü make install

7. Edit the /boot/grub/grub.conf, set the default booting kernel to the new kernel

Ü Restart

8. cp /etc/rc.d/init.d/iptables ~/iptables

Ü rpm -e iptables-ipv6 iptables iptstate --nodeps

Ü tar jxvf iptables-1.4.4.tar.bz2 –C /usr/src

Ü cd /usr/src/iptables-1.4.4

Ü cp ../netfilter-layer7-v2.22/iptables-1.4.3forward-for-kernel-2.6.20forward/libxt_layer7.* ./extensions/

Ü ./configure --prefix=/usr --with-ksource=/usr/src/linux

Ü make

Ü make install

9. tar zxvf l7-protocols-2009-05-28.tar.gz

v # cd l7-protocols-2009-05-28

v # make install

v # mv ~/iptables /etc/rc.d/init.d/

v # service iptables start

(mv iptables-config.rpmsave iptables-config

ln –s /usr/sbin/iptables /sbin/iptables)

L7-filter Supported Protocols

v bittorrent

Ü P2P filesharing / publishing tool

v edonkey

Ü eDonkey2000 - P2P filesharing

v kugoo

Ü KuGoo - a Chinese P2P program

v msn-filetransfer

Ü MSN (Micosoft Network) Messenger file transfers

v msnmessenger

Ü Microsoft Network chat client

v pplive

Ü Chinese P2P streaming video

v qq

v xunlei