Difference between revisions of "IPv6 Firewall: Persiapan Menggunakan netfilter6"
Onnowpurbo (talk | contribs) |
Onnowpurbo (talk | contribs) |
||
Line 1: | Line 1: | ||
− | Langkah ini hanya perlu dilakukan jika kernel dan netfilter bawaan distribusi tidak sesuai dengan kebutuhkan kita dan kita membutuhkan | + | Langkah ini hanya perlu dilakukan jika kernel dan netfilter bawaan distribusi tidak sesuai dengan kebutuhkan kita dan kita membutuhkan fitur baru yang belum built-in. |
− | + | ==Ambil Source== | |
− | |||
− | + | Ambil source dari | |
− | + | http://www.kernel.org | |
− | + | Amgil iptables terakhir (kernel patch) dari | |
− | + | http://www.netfilter.org/ | |
− | + | ==Extract sources== | |
+ | |||
+ | Pindah ke directory source | ||
# cd /path/to/src | # cd /path/to/src | ||
Line 23: | Line 24: | ||
Unpack iptables sources | Unpack iptables sources | ||
− | # tar z|jxf iptables-version.tar.gz|bz2 | + | # tar z|jxf iptables-version.tar.gz|bz2 |
==18.2.3. Apply latest iptables/IPv6-related patches to kernel source== | ==18.2.3. Apply latest iptables/IPv6-related patches to kernel source== | ||
Line 41: | Line 42: | ||
Say yes at following options (iptables-1.2.2) | Say yes at following options (iptables-1.2.2) | ||
− | + | * ah-esp.patch | |
− | + | * masq-dynaddr.patch (only needed for systems with dynamic IP assigned WAN connections like PPP or PPPoE) | |
− | + | * ipv6-agr.patch.ipv6 | |
− | + | * ipv6-ports.patch.ipv6 | |
− | + | * LOG.patch.ipv6 | |
− | + | * REJECT.patch.ipv6 | |
− | |||
− | |||
− | |||
− | |||
− | |||
Check IPv6 extensions | Check IPv6 extensions |
Revision as of 09:41, 5 July 2013
Langkah ini hanya perlu dilakukan jika kernel dan netfilter bawaan distribusi tidak sesuai dengan kebutuhkan kita dan kita membutuhkan fitur baru yang belum built-in.
Ambil Source
Ambil source dari
http://www.kernel.org
Amgil iptables terakhir (kernel patch) dari
http://www.netfilter.org/
Extract sources
Pindah ke directory source
# cd /path/to/src
Unpack and rename kernel sources
# tar z|jxf kernel-version.tar.gz|bz2 # mv linux linux-version-iptables-version+IPv6
Unpack iptables sources
# tar z|jxf iptables-version.tar.gz|bz2
Change to iptables directory
# cd iptables-version
Apply pending patches
# make pending-patches KERNEL_DIR=/path/to/src/linux-version-iptables-version/
Apply additional IPv6 related patches (still not in the vanilla kernel included)
# make patch-o-matic KERNEL_DIR=/path/to/src/linux-version-iptables-version/
Say yes at following options (iptables-1.2.2)
- ah-esp.patch
- masq-dynaddr.patch (only needed for systems with dynamic IP assigned WAN connections like PPP or PPPoE)
- ipv6-agr.patch.ipv6
- ipv6-ports.patch.ipv6
- LOG.patch.ipv6
- REJECT.patch.ipv6
Check IPv6 extensions
# make print-extensions
Extensions found: IPv6:owner IPv6:limit IPv6:mac IPv6:multiport
18.2.4. Configure, build and install new kernel
Change to kernel sources
# cd /path/to/src/linux-version-iptables-version/
Edit Makefile
- EXTRAVERSION = + EXTRAVERSION = -iptables-version+IPv6-try
Run configure, enable IPv6 related
Code maturity level options Prompt for development and/or incomplete code/drivers : yes Networking options Network packet filtering: yes The IPv6 protocol: module IPv6: Netfilter Configuration IP6 tables support: module All new options like following: limit match support: module MAC address match support: module Multiple port match support: module Owner match support: module netfilter MARK match support: module Aggregated address check: module Packet filtering: module REJECT target support: module LOG target support: module Packet mangling: module MARK target support: module
Configure other related to your system, too
Compilation and installing: see the kernel section here and other HOWTOs
18.2.5. Rebuild and install binaries of iptables
Make sure, that upper kernel source tree is also available at /usr/src/linux/
Rename older directory
# mv /usr/src/linux /usr/src/linux.old
Create a new softlink
# ln -s /path/to/src/linux-version-iptables-version /usr/src/linux
Rebuild SRPMS
# rpm --rebuild /path/to/SRPMS/iptables-version-release.src.rpm
Install new iptables packages (iptables + iptables-ipv6)
On RH 7.1 systems, normally, already an older version is installed, therefore use "freshen"
# rpm -Fhv /path/to/RPMS/cpu/iptables*-version-release.cpu.rpm
If not already installed, use "install"
# rpm -ihv /path/to/RPMS/cpu/iptables*-version-release.cpu.rpm
On RH 6.2 systems, normally, no kernel 2.4.x is installed, therefore the requirements don't fit. Use "--nodeps" to install it
# rpm -ihv --nodeps /path/to/RPMS/cpu/iptables*-version-release.cpu.rpm
Perhaps it's necessary to create a softlink for iptables libraries where iptables looks for them
# ln -s /lib/iptables/ /usr/lib/iptables