Kernel and Iptables patches created and installed

# uname-r2.6.32-504.el6.x86_64

Download kernel-2.6.32-504.el6.src.rpm and iptables-1.4.7-14.el6.src.rpm

http://ftp.redhat.com/redhat/linux/enterprise/6Server/en/os/SRPMS/

Download iptables-1.4.20.tar.bz2

Ftp://ftp.netfilter.org/pub/iptables

Download netfilter-layer7-v2.22.tar.gz

http://l7-filter.sourceforge.net/

iptables-1.4.7-14.el6.src.rpm and iptables-1.4.20.tar.bz2, just use one.

Patching the kernel and recompiling the kernel:

# useradd Mockbuild #不创建的话下面会警告 # rpm-i kernel-2.6.32-504.el6.src.rpm# CP rpmbuild/sources/linux-2.6.32-504.el6  . tar.bz2 linux-2.6.32-504.el6.tar.bz2# Tar xf linux-2.6.32-504.el6.tar.bz2-c/usr/src #一般在/usr/src operating Core # cd/usr/src/# Lsdebug kernels linux-2.6.32-504.el6 vboxhost-4.3.26# ln-sv linux-2.6.32-504.el6 #linux很多应用程序用的到源码的话会到/usr/src Find Linux Instead of LINUX-2.6.32-504.EL6, create a link "Linux", "Linux-2.6.32-504.el6" # CD linux# cp/boot/config-2.6.32-504.el6.x86_64 . config replication generates a. config file

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M01/5D/CD/wKioL1UkoA_TSQACAAEEIs9Z2FI469.jpg "style=" float: none; "title=" 01.png "alt=" Wkiol1ukoa_tsqacaaeeis9z2fi469.jpg "/>

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M01/5D/D1/wKiom1UknsehuVG1AACrhs1ieBo388.jpg "style=" float: none; "title=" 02.png "alt=" Wkiom1uknsehuvg1aacrhs1iebo388.jpg "/>

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M02/5D/CD/wKioL1UkoA-A4icTAAEBnXJ1tbQ391.jpg "style=" float: none; "title=" 03.png "alt=" Wkiol1ukoa-a4ictaaebnxj1tbq391.jpg "/>

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M01/5D/D1/wKiom1UknsjSGGc1AACPktSu8CI944.jpg "style=" float: none; "title=" 04.png "alt=" Wkiom1uknsjsggc1aacpktsu8ci944.jpg "/>

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M02/5D/CD/wKioL1UkoBDSIxQnAACgxGZ5SmY869.jpg "style=" float: none; "title=" 05.png "alt=" Wkiol1ukobdsixqnaacgxgz5smy869.jpg "/>

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M02/5D/D1/wKiom1UknsizY1HdAAA11EJuggA214.jpg "style=" float: none; "title=" 06.png "alt=" Wkiom1uknsizy1hdaaa11ejugga214.jpg "/>

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M00/5D/CD/wKioL1UkoBCTBjJbAABJomtrcWk725.jpg "style=" float: none; "title=" 07.png "alt=" Wkiol1ukobctbjjbaabjomtrcwk725.jpg "/>

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M00/5D/D1/wKiom1Uknsjip_-qAACEzLQH-E0523.jpg "style=" float: none; "title=" 08.png "alt=" Wkiom1uknsjip_-qaacezlqh-e0523.jpg "/>

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M01/5D/CD/wKioL1UkoBDyftzbAADhNxV9uE0506.jpg "style=" float: none; "title=" 09.png "alt=" Wkiol1ukobdyftzbaadhnxv9ue0506.jpg "/>

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M02/5D/D1/wKiom1UknsmAIhcTAABuXhk-EiU706.jpg "style=" float: none; "title=" 10.png "alt=" Wkiom1uknsmaihctaabuxhk-eiu706.jpg "/>

Exit, Exit, save

# cd# Tar xf netfilter-layer7-v2.23.tar.gz-c/usr/src/# cd/usr/src/linux# patch-p1 < ... /netfilter-layer7-v2.23/kernel-2.6.32-layer7-2.23.patch # make menuconfig# yum-y install screen# screen# make

Press CTRL + A, release, press D, back to terminal

# Screen-lsthere is a screen on:11241.pts-0.www (Detached) 1 Socket in/var/run/screen/s-root.# screen-r 11241

This error may occur at the time of installation

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M00/5D/CD/wKioL1UkoHTQtDMgAALL5PxEPYk415.jpg "title=" 11.png "alt=" Wkiol1ukohtqtdmgaall5pxepyk415.jpg "/>

Workaround

# Make Clean

# Make Menuconfig

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M02/5D/D2/wKiom1Ukn1Wx4y8pAACFrwZ41sk290.jpg "style=" float: none; "title=" 12.png "alt=" Wkiom1ukn1wx4y8paacfrwz41sk290.jpg "/>

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M02/5D/CD/wKioL1UkoJ3DZcXZAACi9kO9RGE752.jpg "style=" float: none; "title=" 13.png "alt=" Wkiol1ukoj3dzcxzaaci9ko9rge752.jpg "/>

This closure

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M00/5D/CD/wKioL1UkoJ2znZilAABriARBY-4237.jpg "style=" float: none; "title=" 14.png "alt=" Wkiol1ukoj2znzilaabriarby-4237.jpg "/>

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M00/5D/D2/wKiom1Ukn1bT8XlxAABWdLQHbLk635.jpg "style=" float: none; "title=" 15.png "alt=" Wkiom1ukn1bt8xlxaabwdlqhblk635.jpg "/>

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M01/5D/CD/wKioL1UkoJ6Bfpd9AAC2t95MT2s479.jpg "style=" float: none; "title=" 16.png "alt=" Wkiol1ukoj6bfpd9aac2t95mt2s479.jpg "/>

This closure

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M01/5D/D2/wKiom1Ukn1eA0zSmAACXhOrpLKQ202.jpg "style=" float: none; "title=" 17.png "alt=" Wkiom1ukn1ea0zsmaacxhorplkq202.jpg "/>

# make# make modules_install# make install# shutdown-r now# uname-r2.6.32-l7.1

Installation of iptables:

1, download iptables source code, patching, and then compile;

2, download src.rpm format package, installation, patching, and then re-production into RPM package;

Installation Method 1

# tar XF iptables-1.4.20.tar.bz2 # Cp/usr/src/netfilter-layer7-v2.23/iptables-1.4.3forward-for-kernel-2.6.20forward /libxt_layer7.* iptables-1.4.20/extensions/

And then compile and install it.

Installation Method 2

# RPM-IVH iptables-1.4.7-14.el6.src.rpm # CD rpmbuild/sources/iptables-1.4.7/extensions# cp/usr/src/ netfilter-layer7-v2.23/iptables-1.4.3forward-for-kernel-2.6.20forward/libxt_layer7.*./# CD. # RM-RF iptables-1.4.7.tar.bz2 # tar jcf iptables-1.4.7.tar.bz2 iptables-1.4.7/*# rm-rf iptables-1.4.7/# CD. /specs/# lsiptables.spec kernel.spec# vim iptables.spec release:15%{?dist}14-->15 #把自己的数字加1就好--with-kernel=/us R/src/linux--with-kbuild=/usr/src/linux--with-ksource=/usr/src/linux# rpmbuild-bb iptables.spec #要等kernel安装完成才行

I'm using method 2:

# rpmbuild -bb iptables.spec# cd&nbsp, .... # lsbuild  buildroot  rpms  sources  specs  srpms#  cd RPMS/x86_64/# lsiptables-1.4.7-15.el6.x86_64.rpm             iptables-devel-1.4.7-15.el6.x86_64.rpmiptables-debuginfo-1.4.7-15.el6.x86_64.rpm   iptables-ipv6-1.4.7-15.el6.x86_64.rpm# rpm -qa | grep  iptablesiptables-1.4.7-14.el6.x86_64iptables-ipv6-1.4.7-14.el6.x86_64# rpm -uvh  iptables-1.4.7-15.el6.x86_64.rpm iptables-ipv6-1.4.7-15.el6.x86_64.rpm              #升级这两个rpm包就可以, upgrade is complete, then iptables can use layer7# tar xf  l7-protocols-2009-05-28.tar.gz      #使layer7可以识别相关协议 # cd  l7-protocols-2009-05-28# make install# cd /etc/l7-protocols/protocols/

The functionality of the Acct can be enabled or disabled on demand in the kernel parameters.

NET.NETFILTER.NF_CONNTRACK_ACCT = 1

# Sysctl-a | grep Acctkernel.acct = 4230net.netfilter.nf_conntrack_acct = 0# sysctl-w net.netfilter.nf_conntrack_acct= 1net.netfilter.nf_conntrack_acct = iptables-a forward-m layer7--l7proto ssh-j REJECT #现在ssh不能使用

This article is from the "three elder brother" blog, please be sure to keep this source http://523958392.blog.51cto.com/9871195/1629964

Kernel and Iptables patches created and installed