Installing the Layer7 module for iptables

Layer7 is a firewall module on Linux, it can be implemented on the Iptables layer seven filter, can filter including electric donkey, MSN,QQ and other columns of software, we know that on Linux firewall is based on the kernel module implementation, So we have to remember to use the Layer7 module must compile the kernel, the following steps:

1. Need Source Package

    the 2.4 or 2.6 Linux kernel source (2.6 strongly preferred)   kernel source 2.4 or 2.6 version Code pack     the Iptables source  iptables Source Pack     L7-filter Kernel Version "package  lyer7 source Bundle       "Protocol Definitions" package (l7-protocols-yyyy-mm-dd.tar.gz)  lyer7 Rule Pack 2.  compile kernel  # tar zxvf linux-2.6.28.10.tar.gz -c /usr/src //  extract Kernel source package to/usr/scr# tar zxvf  netfilter-layer7-v2.22.tar.gz -c /usr/src//Decompression Layer7 Source package to/usr/src# ln–s /usr/src/linux-2.6.28.10/   /usr/src/linux//Unzip the kernel folder to the/usr/src/linux folder # cd/usr/src/linux/switch to/usr/srclinux folder # patch-p1  &LT;&NBSP, .... /netfilter-layer7-v2.22/kernel-2.6.25-2.6.28-layer7-2.22.patch  //Patch The kernel with Layer7 patches #cp/boot/ config-2.6.18-164.el5   /usr/src/linux/.config copy/boot/config-xx to. config as Blueprint # make  Menuconfig compile kernel enable the following modules in the following options Networking support→networking options→network packet filtering Framework→code NetFilter configurationü      &LT;M&GT;&NBSP;NETFILTER Connection Tracking supportü       <M>  "Layer7" Match supportü      <M>  " String "Match supportü      <M>  time"  match supportü       <M>  "IPRange"  match supportü      <M>  "Connlimit " match supportü      <M> " state " match supportü       <M>  "Conntrack"  connection match supportü      <m >  "Mac"  address match supportü      <M>   "Multiport" Multiple port match supportv      Networking support→networking options→network packet filter ing framework→ip:netfilter configurationü      <M> IPv4 conNection Tracking Support (required-NAT) ü      <M>   full natv       <M>     Masquerade Target support                                                                                        <M>     netmap Target support                                                                                    <M>     REDIRECT target support  add support option (LAYER7) to the kernel #make start compiling #make modules_install Install kernel module installed in/lib/modules/2.6.28.10/#make install new kernel edit grub to use the new kernel as the default boot kernel and restart      # cp/etc/rc.d/ Init.d/iptables ~/iptables copy/etc/rc.d/init.d/iptables to ~/iptables in order to be available with service Iptables # cp/etc/sysconfig/ Iptables.config /root Backup iptables config file       # rpm -e iptables-ipv6  Iptables iptstate --nodeps uninstalling the iptables     # tar jxvf iptables-1.4.6.tar.bz2–c under the current system &NBSP;/USR/SRC Decompression Iptables Source package to/usr/src     # cd/usr/src/iptables-1.4.6j switch to iptables folder #cp &NBSP;&NBSP, .... /netfilter-layer7-v2.22/iptables-1.4.3forward-for-kernel-2.6.20forward/libxt_layer7.*  ./extensions/the Layer7 in the iptables patch to Iptables source     ./configure --prefix=/usr -- With-ksource=/usr/src/linux configuration iptables default installation prefix is/USR kernel module under/usr/src/linux     #make compilation iptables      #make install  Installation iptables     # tar ZXVF l7-protocols-2009-05-28.tar.gz Installing Layer7      # CD l7-protocols-2009-05-28 switch to directory        # Make install Layer7 rule Pack       # MV ~/iptables /etc/rc.d/init.d/ Copy the previously backed-up ~/iptables back to the/etc/rc.d/init.d/directory # cp/root/iptables.config /etc/sysconfig/iptables.config  Copy back to iptables config file # vim/etc/rc.d/init.d/iptables write this filechange the path of $iptables to/usr/sbin/$iptables

650) this.width=650; "src=" Http://s3.51cto.com/wyfs02/M02/71/01/wKiom1XDCh3TOItPAADJqDgzHFo033.jpg "title=" Qq20150806151501.png "alt=" Wkiom1xdch3toitpaadjqdgzhfo033.jpg "/>

If you get an error when the firewall starts

Loading additional iptables modules:ip_conntrack_netbios_n[failed]

[email protected] ~]# Vi/etc/sysconfig/iptables-config

Comment out
#IPTABLES_MODULES = "Ip_conntrack_netbios_ns"

6. Using Layer7
#iptables-T nat-a postrouting-m layer7--17proto qq-j DROP
or
# iptables-t mangle-i postrouting-m layer7--l7proto msnmessenger-j DROP
# iptables-t mangle-i postrouting-m layer7--l7proto qq-j DROP

To view the current blocking situation:
# iptables-t Mangle-l postrouting-v
Chain postrouting (policy ACCEPT 386 packets, 41321 bytes)
pkts bytes Target prot opt in out source destination
0 0 DROP all – any anywhere anywhere LAYER7 L7proto aim
0 0 DROP all – any any anywhere anywhere LAYER7 L7proto BitTorrent

650) this.width=650; "src=" Http://s3.51cto.com/wyfs02/M01/70/FE/wKioL1XDDnCDldA0AAIfl-rIPk8581.jpg "title=" Qq20150806152505.png "alt=" Wkiol1xddncdlda0aaifl-ripk8581.jpg "/>

This article is from the "Supervisory Authority" blog, please be sure to keep this source http://shuoshuo234.blog.51cto.com/10531943/1682255

Installing the Layer7 module for iptables