Re-edit Linux kernel

Objective-C/usr/srcroot # ta

Download netfilter-layer7-v2.22.tar.gzand linux-2.6.28.8tar.bz2 to the Internet

 

1. decompress and release the netfilter-layer7 and Linux kernel source code, and use patches to merge patch files

Root # tar zxvf netfilter-layer7-v2.22.tar.gz-C/usr/src

Root # tar jxvf linux-2.6.28.8tar.bz2-C/usr/src

2. enter the decompressed directory.

Root # cd/usr/src/linux-2.6.28.8

Root@linux-2.6.28.8 # patch-p1 <../netfilter-layer7-v2.22/kernel-2.6.25-layer7.patch

3. reconfigure the kernel editing difference. Add the state mechanism to layer7

1) run the make menuconfig command to enter the kernel configuration menu interface.

2) code netfilter configuration network filter code configuration

Expand networking ---> networking options ----> network packer filtering framework

---> Code netfilter configuration --> configuration menu, use spaces to select netfilter connection

Tracking support. Find "layer7" match suppor, "string" match support, "time" match support, "iprange" address range match supper, "connlimit" match support, "state" match support

You can also choose connection tracking security mark suppor, connection tracking events, connmark connection match suppor, conntrack conncetion tracking match suppor, mac address match support, ipsec policy match support according to your situation.

3) "ip: netfilter configuration" ip packet filtering

Expand networking ---> networking options ----> network packer filtering framework --> ip: netfilter configuration --> configuration menu, use spaces to select MASQUERADE target support and REDIRECT target support for ipv4 connection tracking support and Full NAT.

4. compile the new kernel, install the new kernel file, and copy the module file.

Root # make

Root # make modules_install

Root # make install

5. adjust the GRUB boot menu. by default, the system starts the system with a new kernel and then restarts the host.

Root @ vi/boot/groub. conf change default = 1 to default = 0 and restart the host.

 

 

This article is from the "Mengxue Liuguang" blog