Iptables + L7 + squid implement firewall functions

Add the layer7 patch for iptables (Linux kernel 2.6.25)

######################################## ########################
System Environment: RHEL5 [2.6.18-8. el5xen]

Software environment:
Http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.25.19.tar.bz2
Http://www.netfilter.org/projects/iptables/files/iptables-1.4.2.tar.bz2

Http://ie.archive.ubuntu.com/sourceforge/l/l7/l7-filter/netfilter-layer7-v2.20.tar.gz
Http://ie.archive.ubuntu.com/sourceforge/l/l7/l7-filter/l7-protocols-2008-10-04.tar.gz

Target Features:
Add the layer7 patch for iptables to implement Application Layer filtering.

######################################## ########################

I. recompile the kernel

1. Merge kernel + layer7 Patches

Shell> tar jxvf linux-2.6.25.19.tar.gz2-C/usr/src/
Shell> tar zxvf netfilter-layer7-v2.20.tar.gz-C/usr/src/

Shell> cd/usr/src/linux-2.6.25.19/
Shell> patches-p1 </usr/src/netfilter-layer7-v2.20/kernel-2.6.25-layer7-2.20.patch

2. Configure the new kernel

Shell> cp/boot/config-2.6.18-8.el5. config // steal a lazy, follow the old Kernel configuration
Shell> make menuconfig

// When configuring the kernel, pay attention to the following two points in "Networking ---> Networking Options ---> Network Packet filtering framework (Netfilter:
1) ---> Code Netfilter Configuration
// Compile "Netfilter connection tracking suport (NEW)" into a module (M). Select this option to see the configuration supported by layer7.
// Set layer7, string, state, time, IPsec, iprange, connlimit ...... Compile it into a module.

2) ---> IP: Netfilter Configuration
// Compile "IPv4 connection tracking support (require for NAT)" into a module.
// Compile "MASQUERADE target support" and "REDIRECT target support" under "Full NAT" into a module.

3. Compile and install modules and new kernels

Shell> make & make modules_install & make install

// After compilation and installation, restart and choose to use the new kernel (2.6.25.19) to boot the system

Ii. recompile iptables

1. Uninstall existing iptables

Shell> rpm-e iptables iptstat -- nodeps

2. Merge iptables + layer7 Patches

Shell> tar jxvf iptables-1.4.2.tar.bz2-C/usr/src/
Shell> cd/usr/src/netfilter-layer7-v2.20/iptables-1.4.1.1-for-kernel-2.6.20forward/
Shell> cp libxt_layer7.c libxt_layer7.man/usr/src/iptables-1.4.2/extensions/

3. Compile and install

Shell> cd/usr/src/iptables-1.4.2/

Shell>./configure -- prefix =/-- with-ksource =/usr/src/linux-2.6.25.19
Shell> make & make install

4. Install the l7-protocols mode package

Shell> tar zxvf l7-protocols-2008-10-04.tar.gz-C/etc/
Shell> mv/etc/l7-protocols-2008-10-04/etc/l7-protocols

Iii. layer7 rule example

1. layer7 match

Shell> iptables-a forward-m layer7 -- l7proto qq-j DROP
Shell> iptables-a forward-m layer7 -- l7proto msnmessenger-j DROP
Shell> iptables-a forward-m layer7 -- l7proto msn-filetransfer-j DROP
Shell> iptables-a forward-m layer7 -- l7proto xunlei-j DROP
Shell> iptables-a forward-m layer7 -- l7proto edonkey-j DROP
Shell> iptables-a forward-m layer7 -- l7proto bittorrent-j DROP

2. string match

Shell> iptables-a forward-p udp -- dport 53-m string -- string "tencent" -- algo bm-j DROP
Shell> iptables-a forward-p udp -- dport 53-m string -- string "verycd" -- algo bm-j DROP
Shell> iptables-a forward-p tcp -- dport 80-m string -- string "sex" -- algo bm-j DROP

3. state match

Shell> iptables-a forward-m state -- state NEW-p tcp! -- Syn-j DROP
Shell> iptables-a forward-m state -- state ESTABLISHED, RELATED-j ACCEPT

4. connlimit match

Shell> iptables-a forward-p tcp -- syn-m connlimit -- connlimit-above 100 -- connlimit-mask 24-j DROP

5. time match

Shell> iptables-a forward-p tcp -- dport 80-m time -- timestart 8:00 -- timestop 17:00 -- weekdays Mon, Tue, Wed, Thu, Fri-j ACCEPT

 

Case

 

Three departments

Engineering Department 192.168.145.10-192.168.145.20

Software Department 192.168.145.21-192.168.145.30

Manager's office 192.168.145.31-192.168.145.40

During work hours of the Engineering Department, the ftp server is not allowed to chat. qq is not allowed to access the Internet over http.

Unlimited after work

Software Department start time http Sina Chinese website Unlimited

Music site www.552211.com restricted content [no sound]

Chat qq is not allowed

Unlimited after work

Manager Office start time http qq smtp pop3

Unlimited after work

 

Configuration

 

145.0 network segments can be accessed

 

Enable packet forwarding and enable the ftp Module

 

 

 

 

Disable forward

The engineering department can only use ftp during work hours

 

 

Back

 

Unlimited after work

 

Software Department

 

Allow access with squid

Address range

Vim/etc/squid. conf

 

Site access allowed

 

 

Start Time

 

Edit rule

 

Transparent proxy

 

 

Service squid restart

Port redirection

 

 

Domain name resolution

 

 

Manager's office

Restart the squid Server

Smtp pop3