Iptables implements layer-7 Filtering

Software Package

L7-protocols-2009-05-28.tar.gz

Linux-2.6.28.10.tar.gz

Netfilter-layer7-v2.22.tar.gz

Iptables-1.4.6.tar.bz2

Extract kernel source code and netfilter-L7 source code

[[Email protected] ~] # Tar linux-2.6.28.10.tar.gz-C/usr/src/

[[Email protected] ~] # Tar netfilter-layer7-v2.22.tar.gz-C/usr/src/

[[Email protected] ~] #

Compile the kernel

[[Email protected] Linux] # cp/boot/config-2.6.18-308.el5. config

[[Email protected] Linux] # Make menuconfig

Select order

Networking support ---> networking options ---> network packet filtering framework (netfilter) --->

Core netfilter configuration --->

<M> netfilter Connection Tracking Support

<M> "layer7" Match support

Compile

[[Email protected] Linux] # Make

[[Email protected] Linux] # Make modules_install

[[Email protected] Linux] # make install

View the kernel version after restart

[[Email protected] ~] # Uname-R

2.6.28.10-L7

[[Email protected] ~] #

Install the new iptables

[[Email protected] ~] # Rpm-e iptables-ipv6 iptables -- nodeps

Warning:/etc/sysconfig/iptables-config saved as/etc/sysconfig/iptables-config.rpmsave

[[Email protected] ~] #

[[Email protected] ~] # Tar iptables-1.4.6.tar.bz2-C/usr/src/

[[Email protected] ~] # Cd/usr/src/iptables-1.4.6/extensions/

[[Email protected] extensions] #

[[Email protected] netfilter-layer7-v2.22] # cp iptables-1.4.3forward-for-kernel-2.6.20forward/libxt_layer7 ../iptables-1.4.6/extensions/

[[Email protected] netfilter-layer7-v2.22] #

[[Email protected] SRC] # cd iptables-1.4.6/

[[Email protected] iptables-1.4.6] #

[[Email protected] iptables-1.4.6] #./configure -- prefix =/usr/-- With-ksource =/usr/src/Linux

[[Email protected] iptables-1.4.6] # Make

[[Email protected] iptables-1.4.6] # make install

[[Email protected] iptables-1.4.6] #

Install layer-7

[[Email protected] ~] # Tar xf l7-protocols-2009-05-28.tar.gz

[[Email protected] ~] # Cd l7-protocols-2009-05-28

[[Email protected] l7-protocols-2009-05-28] # make install

Mkdir-P/etc/l7-protocols

CP-R */etc/l7-protocols

[[Email protected] l7-protocols-2009-05-28] #

Prohibit QQ

Iptables-a forward-s 10.10.1.0/24-M layer7 -- l7proto QQ-J Drop

Iptables implements layer-7 Filtering