#! BinbashIPTsbiniptables * Current System Version centos5.3, kernel version 2.6.18-128. el5, upgrade and optimize the existing system kernel, and add the L7-filter module, so that iptables supports L7filter, filter the layer-7 Application * # download the installation package
#! /Bin/bash
IPT =/sbin/iptables
/*
The current system version centos5.3, kernel version 2.6.18-128. el5, upgrade and optimize the existing system kernel, and add the L7-filter module, so that iptables supports L7filter, filter layer-7 Applications
*/
#========================== Download the installation package ========== ====================================
# Kernel 2.6.28.10
Wget http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.28.10.tar.bz2
# Iptables
# Wget http://www.netfilter.org/projects/iptables/FileS/iptables-1.4.7.tar.bz2
WgetFtp: // Ftp.netfilter.org/pub/iptables/iptables-1.4.0.tar.bz2
# L7-protocoLs
Wget http ://NcU.dl.sourceforge.net/project/l7-filter/ProtoCol% 20 definitions/2009-05-28/l7-protocols-2009-05-28.tar.gz
# Netfilter-layer7
Wget http://ncu.dl.sourceforge.net/project/l7-filter/l7-filter%20kernel%20version/2.21/netfilter-layer7-v2.21.tar.gz
#Patch-O-matic-ng
Wget ftp://ftp.netfilter.org/pub/patch-o-matic-ng/snapshot/patch-o-matic-ng-20100218.tar.bz2
#============================ Kernel compilation ======== ==========================================
Cd/Opt
Tar jxvf iptables-1.4.3.tar.bz2
Tar zxvf ipp2p-0.99.16.tar.gz
Tar zxvf netfilter-layer7-v2.22.tar.gz
Tar jxvf linux-2.6.28.10.tar.bz2
MvLinux-2.6.28.10/usr/src/
#
# To the kernel L7-filter patch, the above software packages areExtractTo the/usr/src directory
Cd/usr/src/linux-2.6.28.10
Patch-p1 </opt/netfilter-layer7-v2.22/kernel-2.6.25-2.6.28-layer7-2.22.patch
# Check whether the. o file and dependency are correct. Use the downloaded full source package for compilation. Therefore, this step can be omitted. If you use these source programs multiple times to compile the kernel, you 'd better run thisCommand
# Make mrproper
# Use make oldconfig to inherit the old kernel configuration, saving a lot of trouble for your own configuration
Make oldconfig
# Make menuconfig is a recommended method on the text interface. Here you can select the module you need to compile to the core.
Make menuconfig
/*
Space key is used to select the configuration type
Configure different functions
[]: If this parameter is set to null, this function does not need to be used in the new kernel.
[M]: compile this function as a module to load Mo as needed.DuLe
[*]: This function is directly compiled into the new kernel. Which kernel compilation parameters need to be configured as part of the new kernel?
*/
# NetworkingSuPport --->
# Networking options --->
# Network packet filtering framework (Netfilter) --->
# IP: netfilter configuraton --->
IPv4 connection TrAcking support (requir EdFor NAT)
# Full NAT
# Networking support --->
# Networking options --->
# Network packet filtering framework (Netfilter) --->
# Core netfilter configuration --->
Netfilter connection tracking support
# "Connlimit" match support"
#" Time"Match support
# "String" match support
# "Layer7" match support
#
- Layer 7 debugging output
# Upgrade the kernel
Make
Make modules
Make modules_install
Make install
# Modify the default value to start with a new kernel.
Vi/boot/grub. conf
Default = 0
# Copy the new Kernel configuration file to the/boot directory.
Cp/Usr/src/linux-2.6.28.10/. config/boot/config-2.8.10
# Check whether the kernel version is correct after restart.
Reboot
Uname-R
2.6.28
#5. Patch and upgrade iptables
# Uninstall the old version iptables in the system.
Rpm-qa |GrepIptables
Rpm-e -- nodeps iptables-1.3.5-4.el5
Rpm-e -- nodeps iptables-ipv6-1.3.5-4.el5
# Merge patches and compile and install the new iptables Tool
Cd/opt
Tar jxvf iptables-1.4.3.tar.bz2-C/opt/
Iptables-1.4.3/cd/opt/
Cp/opt/netfilter-layer7-v2.22/iptables-1.4.3forward-for-kernel-2.6.20forward/libxt_layer7 .*ExTensions/
./Configure -- prefix =/-- with-ksource =/usr/src/linux-2.6.28.10
Make; make install
Iptables-V
Iptables v1.4.3
Check whether the iptables version is correct.
#6. Install l7-protocol
Cd/opt
Tar xzvf l7-protocols-2009-05-28.tar.gz
Cd l7-protocols-2008-11-23
Make install
In fact, it is to copy the response directory to/etc/l7-protocols/
What really calls is the file under/etc/l7-protocols/protocols/
You can open the following specific file, which contains some L7 program signaturesRegular ExpressionExpression Form
In this way, you can write your own signatures in this way.
The pattern software package is constantly updated, and the subsequent date is the update date. We recommend that you regularly select the latest package for updates.
# Install IPP2P
Cd/opt/ipp2p-0.99.16
Make
Make install
Cp ipt_ipp2p.ko/lib/modules/2.6.28.10/kernel/net/ipv4/netfilter/
Cp libipt_ipp2p.so/lib/iptables/
# Loading Module
ModprobeIpt_connlimit
Modprobe ipt_time
Modprobe ipt_ipp2p
Modprobe ipt_layer7
Lsmod| Grep x_tables
7. Test
$ Ipt-i FORWARD-p udp -- dport 53-m string -- string "tencent" -- algo bm-j DROP
$ Ipt-i FORWARD-p tcp-m multiport -- dport 80,443-m layer7 -- l7proto qq-j DROP
$ Ipt-i FORWARD-p udp -- dport 8000-j DROP
$ Ipt-i FORWARD-p tcp-m layer7 -- l7proto socks-j DROP
$ Ipt-i FORWARD-p udp -- dport 53-m string -- string "messenger" -- algo bm-j DROP
$ Ipt-i FORWARD-p tcp-m multiport -- dport 80,443-m layer7 -- l7proto msnmessenger-j DROP
$ Ipt-i FORWARD-p udp -- dport 1863-j DROP
$ EPT-t mangle-a prerouting-m layer7 -- l7proto qq-j DROP
$ Ipt-t mangle-a prerouting-m layer7 -- l7proto msnmessenger-j DROP
#===================================================== Layer7, time, ip2p2 ========================================
# Test layer7, time, ip2p2. You can use the above policy expression to test whether qq, msn, ipp2p, and xunlei are successfully disabled.
# $ Ipt-a FORWARD-m layer7 -- l7proto qq-m time -- timestart -- timestop -- days Mon, Tue, Wed, Thu, fri-m iprange -- src-range 192.168.1.5-192.168.1.239-m ipp2p -- ipp2p-m ipp2p -- xunlei-j DROP
# $ Ipt-a FORWARD-p tcp-m multiport -- dport 80,443-m layer7 -- l7proto qq-j DROP
#===================================================== Connlimit =============================================== =====
# The maximum number of connections allowed for a single IP address is 30
# $ Ipt-a FORWARD-p tcp -- dport 80-m connlimit -- connlimit-abve 30-j REJECT
# Control the number of new connections allowed by a single IP address within a certain period of time (such as 60 seconds)
# $ Ipt-a INPUT-p tcp -- dport 80-m recent -- name BAD_HTTP_ACCESS -- upDate-- Seconds 60 -- hitcount 30-j REJECT
# $ Ipt-a INPUT-p tcp -- dport 80-m recent -- name BAD_HTTP_ACCESS --Set-J ACCEPT
# Restrict the web services connected to the local machine. The number of concurrent connections of one IP segment C cannot exceed 100, and the number of connections exceeding the limit is denied.
$ Ipt-a INPUT-I $ INTERNET-p tcp-m multiport -- dports 80,443-m connlimit -- connlimit-abve 500 -- connlimit-mask 24-j REJECT
# Filter syn packets
$ Ipt-a INPUT-I $ INTERNET-p tcp -- tcp-flags SYN, ACK, FIN, rst syn-m limit -- limit 100/s -- limit-burst 150-m multiport -- dports 80,443-j DROP
$ Ipt-a INPUT-I $ INTERNET-p tcp -- syn-m multiport-dports 80,443-m connlimit -- connlimit-above 100 -- connlimit-mask 32-j DROP
#===================================================== Limit = ======
# Only one echo-request packet can be accepted per second
$ Ipt-nPingLimit
$ Ipt-a pinglimit-m limit-limit 1/s-limit-burst 1-j ACCEPT
$ Ipt-a pinglimit-j DROP
$ Ipt-a INPUT-p ICmp-Icmp-type echo-request-j pinglimit
# Only One icmp echo-request packet is allowed per second
$ Ipt-a INPUT-p icmp-type echo-request-m limit-limit 1/s-limit-burst 1-j ACCEPT
$ Ipt-a INPUT-p icmp-type echo-request-j DROP
# Prevent SYN-Flood fragment attacks (only 100 syn packets are accepted per second ,)
#-Limit 1/s indicates once per second; 1/m indicates once per minute; 1/h indicates once per hour
#-Limit-burst indicates the maximum number of limit triggering times (default: 5)
$ Ipt-n syn-flood
$ Ipt-a syn-flood-m limit-limit 100/s-limit-burst 150-j RETURN
$ Ipt-a syn-flood-j DROP
$ Ipt-i INPUT-j syn-flood
#================================================ String = ========================================================== ========
# Use ba for each wordIdU and google recognize the gbk encoding and UTF-8 encoding strings and seal them all.
/Usr/sbin/iptables-a forward-m string -- algo bm -- string "stock market"-j DROP
/Usr/sbin/iptables-a forward-m string -- algo bm -- string "% E8 % 82% A1 % E5 % B8 % 82"-j DROP
/Usr/sbin/iptables-a forward-m string -- algo bm -- string "% B9 % C9 % CA % D0"-j DROP
/Usr/sbin/iptables-a forward-m string -- algo bm -- string "fund"-j DROP
/Usr/sbin/iptables-a forward-m string -- algo bm -- string "% E5 % 9F % BA % E9 % 87% 91"-j DROP
/Usr/sbin/iptables-a forward-m string -- algo bm -- string "% BB % F9 % BD % F0"-j DROP
/Usr/sbin/iptables-a forward-m string -- algo bm -- string "stock"-j DROP
/Usr/sbin/iptables-a forward-m string -- algo bm -- string "% E8 % 82% A1 % E7 % A5 % A8"-j DROP
/Usr/sbin/iptables-a forward-m string -- algo bm -- string "% B9 % C9 % C6 % B1"-j DROP
/Usr/sbin/iptables-a forward-m string -- algo bm -- string "securities"-j DROP
/Usr/sbin/iptables-a forward-m string -- algo bm -- string "% E8 % AF % 81% E5 % 88% B8"-j DROP
/Usr/sbin/iptables-a forward-m string -- algo bm -- string "% D6 % A4 % C8 % AF"-j DROP
# Here are some pure English words, which are much more concise.
/Usr/sbin/iptables-a forward-m string -- algo bm -- string "fund"-j DROP
/Usr/sbin/iptables-a forward-m string -- algo bm -- string "finance"-j DROP
/Usr/sbin/iptables-a forward-m string -- algo bm -- string "business"-j DROP
/Usr/sbin/iptables-a forward-m string -- algo bm -- string "money"-j DROP
/Usr/sbin/iptables-a forward-m string -- algo bm -- string "stock"-j DROP
|
