Difference between revisions of "IPv6 Firewall: Persiapan Menggunakan netfilter6"
Jump to navigation
Jump to search
Onnowpurbo (talk | contribs) (New page: 18.2. Preparation This step is only needed if distributed kernel and netfilter doesn't fit your requirements and new features are available but still not built-in. 18.2.1. Get sources Ge...) |
Onnowpurbo (talk | contribs) |
||
| Line 10: | Line 10: | ||
Source tarball (for kernel patches): http://www.netfilter.org/ | Source tarball (for kernel patches): http://www.netfilter.org/ | ||
| − | 18.2.2. Extract sources | + | ==18.2.2. Extract sources== |
Change to source directory: | Change to source directory: | ||
| − | # cd /path/to/src | + | # cd /path/to/src |
Unpack and rename kernel sources | Unpack and rename kernel sources | ||
| − | # tar z|jxf kernel-version.tar.gz|bz2 | + | # tar z|jxf kernel-version.tar.gz|bz2 |
| − | # mv linux linux-version-iptables-version+IPv6 | + | # mv linux linux-version-iptables-version+IPv6 |
Unpack iptables sources | Unpack iptables sources | ||
| Line 25: | Line 25: | ||
# tar z|jxf iptables-version.tar.gz|bz2 | # tar z|jxf iptables-version.tar.gz|bz2 | ||
| − | 18.2.3. Apply latest iptables/IPv6-related patches to kernel source | + | ==18.2.3. Apply latest iptables/IPv6-related patches to kernel source== |
Change to iptables directory | Change to iptables directory | ||
| − | # cd iptables-version | + | # cd iptables-version |
Apply pending patches | Apply pending patches | ||
| − | # make pending-patches KERNEL_DIR=/path/to/src/linux-version-iptables-version/ | + | # make pending-patches KERNEL_DIR=/path/to/src/linux-version-iptables-version/ |
Apply additional IPv6 related patches (still not in the vanilla kernel included) | Apply additional IPv6 related patches (still not in the vanilla kernel included) | ||
| − | # make patch-o-matic KERNEL_DIR=/path/to/src/linux-version-iptables-version/ | + | # make patch-o-matic KERNEL_DIR=/path/to/src/linux-version-iptables-version/ |
Say yes at following options (iptables-1.2.2) | Say yes at following options (iptables-1.2.2) | ||
| Line 55: | Line 55: | ||
Check IPv6 extensions | Check IPv6 extensions | ||
| − | # make print-extensions | + | # make print-extensions |
| + | |||
Extensions found: IPv6:owner IPv6:limit IPv6:mac IPv6:multiport | Extensions found: IPv6:owner IPv6:limit IPv6:mac IPv6:multiport | ||
| − | 18.2.4. Configure, build and install new kernel | + | ==18.2.4. Configure, build and install new kernel== |
Change to kernel sources | Change to kernel sources | ||
| − | # cd /path/to/src/linux-version-iptables-version/ | + | # cd /path/to/src/linux-version-iptables-version/ |
Edit Makefile | Edit Makefile | ||
| − | - EXTRAVERSION = | + | - EXTRAVERSION = |
| − | + EXTRAVERSION = -iptables-version+IPv6-try | + | + EXTRAVERSION = -iptables-version+IPv6-try |
Run configure, enable IPv6 related | Run configure, enable IPv6 related | ||
| Line 94: | Line 95: | ||
Compilation and installing: see the kernel section here and other HOWTOs | Compilation and installing: see the kernel section here and other HOWTOs | ||
| − | 18.2.5. Rebuild and install binaries of iptables | + | |
| + | ==18.2.5. Rebuild and install binaries of iptables== | ||
Make sure, that upper kernel source tree is also available at /usr/src/linux/ | Make sure, that upper kernel source tree is also available at /usr/src/linux/ | ||
| Line 100: | Line 102: | ||
Rename older directory | Rename older directory | ||
| − | # mv /usr/src/linux /usr/src/linux.old | + | # mv /usr/src/linux /usr/src/linux.old |
Create a new softlink | Create a new softlink | ||
| − | # ln -s /path/to/src/linux-version-iptables-version /usr/src/linux | + | # ln -s /path/to/src/linux-version-iptables-version /usr/src/linux |
Rebuild SRPMS | Rebuild SRPMS | ||
| − | # rpm --rebuild /path/to/SRPMS/iptables-version-release.src.rpm | + | # rpm --rebuild /path/to/SRPMS/iptables-version-release.src.rpm |
Install new iptables packages (iptables + iptables-ipv6) | Install new iptables packages (iptables + iptables-ipv6) | ||
| Line 114: | Line 116: | ||
On RH 7.1 systems, normally, already an older version is installed, therefore use "freshen" | On RH 7.1 systems, normally, already an older version is installed, therefore use "freshen" | ||
| − | # rpm -Fhv /path/to/RPMS/cpu/iptables*-version-release.cpu.rpm | + | # rpm -Fhv /path/to/RPMS/cpu/iptables*-version-release.cpu.rpm |
If not already installed, use "install" | If not already installed, use "install" | ||
| − | # rpm -ihv /path/to/RPMS/cpu/iptables*-version-release.cpu.rpm | + | # rpm -ihv /path/to/RPMS/cpu/iptables*-version-release.cpu.rpm |
On RH 6.2 systems, normally, no kernel 2.4.x is installed, therefore the requirements don't fit. Use "--nodeps" to install it | On RH 6.2 systems, normally, no kernel 2.4.x is installed, therefore the requirements don't fit. Use "--nodeps" to install it | ||
| − | # rpm -ihv --nodeps /path/to/RPMS/cpu/iptables*-version-release.cpu.rpm | + | # rpm -ihv --nodeps /path/to/RPMS/cpu/iptables*-version-release.cpu.rpm |
Perhaps it's necessary to create a softlink for iptables libraries where iptables looks for them | Perhaps it's necessary to create a softlink for iptables libraries where iptables looks for them | ||
| − | # ln -s /lib/iptables/ /usr/lib/iptables | + | # ln -s /lib/iptables/ /usr/lib/iptables |
Revision as of 09:34, 5 July 2013
18.2. Preparation
This step is only needed if distributed kernel and netfilter doesn't fit your requirements and new features are available but still not built-in. 18.2.1. Get sources
Get the latest kernel source: http://www.kernel.org/
Get the latest iptables package:
Source tarball (for kernel patches): http://www.netfilter.org/
18.2.2. Extract sources
Change to source directory:
# cd /path/to/src
Unpack and rename kernel sources
# tar z|jxf kernel-version.tar.gz|bz2 # mv linux linux-version-iptables-version+IPv6
Unpack iptables sources
- tar z|jxf iptables-version.tar.gz|bz2
Change to iptables directory
# cd iptables-version
Apply pending patches
# make pending-patches KERNEL_DIR=/path/to/src/linux-version-iptables-version/
Apply additional IPv6 related patches (still not in the vanilla kernel included)
# make patch-o-matic KERNEL_DIR=/path/to/src/linux-version-iptables-version/
Say yes at following options (iptables-1.2.2)
ah-esp.patch
masq-dynaddr.patch (only needed for systems with dynamic IP assigned WAN connections like PPP or PPPoE)
ipv6-agr.patch.ipv6
ipv6-ports.patch.ipv6
LOG.patch.ipv6
REJECT.patch.ipv6
Check IPv6 extensions
# make print-extensions
Extensions found: IPv6:owner IPv6:limit IPv6:mac IPv6:multiport
18.2.4. Configure, build and install new kernel
Change to kernel sources
# cd /path/to/src/linux-version-iptables-version/
Edit Makefile
- EXTRAVERSION = + EXTRAVERSION = -iptables-version+IPv6-try
Run configure, enable IPv6 related
Code maturity level options
Prompt for development and/or incomplete code/drivers : yes
Networking options
Network packet filtering: yes
The IPv6 protocol: module
IPv6: Netfilter Configuration
IP6 tables support: module
All new options like following:
limit match support: module
MAC address match support: module
Multiple port match support: module
Owner match support: module
netfilter MARK match support: module
Aggregated address check: module
Packet filtering: module
REJECT target support: module
LOG target support: module
Packet mangling: module
MARK target support: module
Configure other related to your system, too
Compilation and installing: see the kernel section here and other HOWTOs
18.2.5. Rebuild and install binaries of iptables
Make sure, that upper kernel source tree is also available at /usr/src/linux/
Rename older directory
# mv /usr/src/linux /usr/src/linux.old
Create a new softlink
# ln -s /path/to/src/linux-version-iptables-version /usr/src/linux
Rebuild SRPMS
# rpm --rebuild /path/to/SRPMS/iptables-version-release.src.rpm
Install new iptables packages (iptables + iptables-ipv6)
On RH 7.1 systems, normally, already an older version is installed, therefore use "freshen"
# rpm -Fhv /path/to/RPMS/cpu/iptables*-version-release.cpu.rpm
If not already installed, use "install"
# rpm -ihv /path/to/RPMS/cpu/iptables*-version-release.cpu.rpm
On RH 6.2 systems, normally, no kernel 2.4.x is installed, therefore the requirements don't fit. Use "--nodeps" to install it
# rpm -ihv --nodeps /path/to/RPMS/cpu/iptables*-version-release.cpu.rpm
Perhaps it's necessary to create a softlink for iptables libraries where iptables looks for them
# ln -s /lib/iptables/ /usr/lib/iptables