Iptableslinuxtcp/ipINPUTOUTPUTFORWARDPOSTROUTINGPREROUTINGiptablesnetfilter
natpostroutingsnatpreroutingdnat
filterinputoutputforward
mangleTOSQOS
Input
OUTput
Forward
Postrouting
Prerouting
iptablesL7squid
192.168.20.10—192.168.20.20
192.168.20.21-192.168.20.30
192.168.20.31-192.168.20.40
--- 082000
192.168.102.10ftpqq
squidsina 3
dmz
iptableslayer7
1kernellayer7
tar jxvf linux-2.6.25.19.tar.gz2 -C /usr/src/
tar zxvf netfilter-layer7-v2.20.tar.gz -C /usr/src/
cd /usr/src/linux-2.6.25.19/
patch -p1 < /usr/src/netfilter-layer7-v2.20/kernel-2.6.25-layer7-2.20.patch
2
cp /boot/config-2.6.18-8.el5 .config//
make menuconfig
//Networking ---> Networking Options ---> Network Packet filtering framework (Netfilter) ---> Core Netfilter ConfigurationNetfilter connection tracking suport (NEW)(M)layer7
//layer7stringstatetimeIPseciprangeconnlimit---> IP: Netfilter ConfigurationIPv4 connection tracking support (require for NAT)Full NATMASQUERADE target supportREDIRECT target support
3
make && make modules_install && make install
2.6.25.19
1iptables
rpm -e iptables iptstat --nodeps
2iptableslayer7
tar jxvf iptables-1.4.2.tar.bz2 -C /usr/src/
cd /usr/src/netfilter-layer7-v2.20/iptables-1.4.1.1-for-kernel-2.6.20forward/
cp libxt_layer7.c libxt_layer7.man /usr/src/iptables-1.4.2/extensions/
3
cd /usr/src/iptables-1.4.2/
./configure --prefix=/ --with-ksource=/usr/src/linux-2.6.25.19
make && make install
4l7-protocols
tar zxvf l7-protocols-2008-10-04.tar.gz -C /etc/
mv /etc/l7-protocols-2008-10-04 /etc/l7-protocols
squid
[root@localhost Server]# rpm -ivh squid-2.6.STABLE21-3.el5.i386.rpm
[root@localhost ~]# iptables -L
Chain INPUT (policy ACCEPT)
targetprot opt sourcedestination
Chain FORWARD (policy ACCEPT)
targetprot opt sourcedestination
Chain OUTPUT (policy ACCEPT)
targetprot opt sourcedestination
[root@localhost ~]# iptables -t filter -A INPUT -s 192.168.20.129 -p tcp --dport 22 -j ACCEPT
[root@localhost ~]# iptables -t filter -A OUTPUT -d 192.168.20.129 -p tcp --sport 22 -j ACCEPT
[root@localhost ~]# iptables -P INPUT DROP
[root@localhost ~]# iptables -P OUTPUT DROP
[root@localhost ~]# iptables -P FORWARD DROP
POSTROUTINGeth3
[root@localhost ~]# iptables -t nat -A POSTROUTING -s 192.168.20.0/24 -o eth3 -j MASQUERADE
ftp
[root@localhost ~]# iptables -t filter -A FORWARD -m iprange --src-range 192.168.20.10-192.168.20.20 -m time --timestart 08:00 --timestop 20:00 --weekdays Mon,Tue,Wed,Thu,Fri -p tcp --dport 21 -j ACCEPT
[root@localhost ~]# iptables -t filter -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
192.168.102.10ftp
[root@localhost ~]# iptables -t filter -R FORWARD 1 -m iprange --src-range 192.168.20.10-192.168.20.20 -m time --timestart 08:00 --timestop 20:00 -d 192.168.102.10 -o eth3 --weekdays Mon,Tue,Wed,Thu,Fri -p tcp --dport 21 -j ACCEPT
