Add the layer7 patch for iptables in Linux (Linux kernel 2.6.25)

System Environment: RHEL5 [2.6.18-8. el5xen]

Software environment:
Http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.25.19.tar.bz2
Http://www.netfilter.org/projects/iptables/files/iptables-1.4.2.tar.bz2
Http://ie.archive.Ubuntu.com/sourceforge/l/l7/l7-filter/netfilter-layer7-v2.20.tar.gz
Http://ie.archive.ubuntu.com/sourceforge/l/l7/l7-filter/l7-protocols-2008-10-04.tar.gz

Target Features:
Add the layer7 patch for iptables to implement Application Layer filtering.

Recommended reading:

Iptables-packet filtering (Network Layer) Firewall

Linux Firewall iptables

Iptables + L7 + Squid implements a complete software firewall

Basic use of iptables backup, recovery, and firewall scripts

Detailed description of firewall iptables usage rules in Linux

Text Version: add the layer7 patch for iptables (Linux2.6.25 kernel)

######################################## ########################

I. recompile the kernel

1. Merge kernel + layer7 Patches
Shell> tar-jxvf linux-2.6.25.19.tar.bz2-C/usr/src/
Shell> tar-zxvf netfilter-layer7-v2.20.tar.gz-C/usr/src/
Shell> cd/usr/src/linux-2.6.25.19/
Shell> patches-p1 </usr/src/netfilter-layer7-v2.20/kernel-2.6.25-layer7-2.20.patch

View the current Kernel

Download new kernel and patch to linux

Unpack kernel and patch

[Root @ localhost ~] # Tar-jxvf linux-2.6.25.19.tar.bz2-C/usr/src/

[Root @ localhost ~] # Tar-jxvf netfilter-layer7-v2.20.tar.gz-C/usr/src/

2. Configure the kernel

Shell> cp/boot/config-2.6.18-8.el5. config

// When configuring the kernel, pay attention to the following two points in "Networking ---> Networking Options ---> Network Packet filtering framework (Netfilter:

1) ---> Code Netfilter Configuration

// Compile "Netfilter connection tracking suport (NEW)" into a module (M). Select this option to see the configuration supported by layer7.

// Set layer7, string, state, time, IPsec, iprange, connlimit ...... Compile it into a module.

2) ---> IP: Netfilter Configuration

// Compile "IPv4 connection tracking support (require for NAT)" into a module.

// Compile "MASQUERADE target support" and "REDIRECT target support" under "Full NAT" into a module.

3. Compile and install modules and new kernels

Shell> make & make modules_install & make install

// After compilation and installation, restart and choose to use the new kernel (2.6.25.19) to boot the system

This process takes a lot of time.

1 2 Next Page