Iptables

Pessoal, to colocando aqui como instalar o patch layer7 no Kernel e iptables. Esse patch permite que o Netfilter consiga tratar a camada de aplicação possibilitando tratar os protocolos de aplicações como msn, jabber, p2p e vários outros.

Arquivos necessários:

1 – Fonte do Kernel: No caso vou usar o kernel 2.6.24

http://www.kernel.org

2 – Fonte do iptables: Vou usar a versão 1.4.0

http://www.netfilter.org

3 – Patch Layer 7 e Protocolos Layer7

http://sourceforge.net/projects/l7-filter/

Aqui são dois pacotes que estão nas opcões: l7-filter kernel version e Protocol definitions

– Aplicar o patch layer7 no kernel e recompila-lo:

Crie um diretório chamado layer7 dentro de root e guardes os pacotes ali:

# cd /root

# mkdir layer7

# cd layer7

Descompacte o pacote netfilter-layer7-v2.17.tar.gz

# tar xzvf netfilter-layer7-v2.17.tar.gz

Descompacte o fonte do kernel no diretório /usr/src e aplique o patch:

# cd /usr/src

# tar xjvf linux-2.6.24

# cd linux-2.6.24

# patch -p1 < /root/layer7/netfilter-layer7-v2.17/kernel-2.6.22-2.6.24-layer7-2.17.patch

Com o patch aplicado, para compilarmos o kernel, precisamos ter o pacote libncurses5-dev instalado:

# aptitude install libncurses5-dev

Agora podemos entrar no menu de gerenciamento do kernel:

# make menuconfig

Vou colocar aqui as opções que tem que ser selecionadas para o nosso iptables e o patch layer7 funcionar.

Networking –>
Networking options –>
[*] Network packet filtering framework (Netfilter) –>
[*] Bridged IP/ARP packets filtering
Core Netfilter Configuration —>
Netfilter netlink interface
Netfilter NFQUEUE over NFNETLINK interface
Netfilter LOG over NFNETLINK interface
Netfilter connection tracking support
-*- Connection tracking flow accounting
-*- Connection mark tracking support
[*] Connection tracking security mark support
[*] Connection tracking events (EXPERIMENTAL)
SCTP protocol connection tracking support (EXPERIMENTAL)
UDP-Lite protocol connection tracking support (EXPERIMENTAL)
Amanda backup protocol support
FTP protocol support
H.323 protocol support (EXPERIMENTAL)
IRC protocol support
NetBIOS name service protocol support (EXPERIMENTAL)
PPtP protocol support
SANE protocol support (EXPERIMENTAL)
SIP protocol support (EXPERIMENTAL)
TFTP protocol support
Connection tracking netlink interface (EXPERIMENTAL)
{M} Netfilter Xtables support (required for ip_tables)
“CLASSIFY” target support
“CONNMARK” target support
“DSCP” target support
“MARK” target support
“NFQUEUE” target Support
“NFLOG” target support
“NOTRACK” target support
“TRACE” target support
“SECMARK” target support
“CONNSECMARK” target support
“TCPMSS” target support
“comment” match support
“connbytes” per-connection counter match support
“connlimit” match support”
“connmark” connection mark match support
“conntrack” connection tracking match support
“DCCP” protocol match support
“DSCP” match support
“ESP” match support
“helper” match support
“length” match support
“limit” match support
“mac” address match support
“mark” match support
IPsec “policy” match support
Multiple port match support
“physdev” match support
“pkttype” packet type match support
“quota” match support
“realm” match support
“sctp” protocol match support (EXPERIMENTAL)
“state” match support
“layer7″ match support
[ ] Layer 7 debugging output
“statistic” match support
“string” match support
“tcpmss” match support
“time” match support
“u32″ match support
“hashlimit” match support

IP: Netfilter Configuration —>
IPv4 connection tracking support (required for NAT)
…… (Tem mais opções antes)
Full NAT
MASQUERADE target support
REDIRECT target support
NETMAP target support
SAME target support (OBSOLETE)
Basic SNMP-ALG support (EXPERIMENTAL)

Salve as configurações do Kernel e vamos iniciar a compilação:

# make

# make modules_install

Em seguida copiar a nossa nova imagem do kernel para o boot e gerar a imagem initrd.

# cp arch/i386/boot/bzImage /boot/vmlinuz-2.6.24

# mkinitramfs -o /boot/initrd.img-2.6.24 /lib/modules/2.6.24

E configurar no Grub:

# vi /boot/grub/menu.lst

title Debian kernel 2.6.24
root (hd0,0)
kernel /boot/vmlinuz-2.6.24 root=/dev/sda1 ro vga=792
initrd /boot/initrd.img-2.6.24
savedefault

Após isso podemos reinicializar a máquina com o nosso novo Kernel para continuarmos com o iptables

# init 6

Depois de reinicializar já com o novo Kernel, vamos descompactar o fonte do iptables e aplicar o patch do layer7

# cd /root/layer7

# tar xjvf iptables-1.4.0.tar.bz2

# cd iptables-1.4.0

# patch -p1 < /root/layer7/netfilter-layer7-v2.17/iptables-1.4-for-kernel-2.6.20forward-layer7-2.17.patch

# chmod 755 extension/.layer7-test

E em seguida aconselho a remover a versão antiga do iptalbes e compilar a nova versão:

# aptitude purge iptables

# make KERNEL_DIR=/usr/src/linux-2.6.24 BINDIR=/sbin LIBDIR=/lib

# make install KERNEL_DIR=/usr/src/linux-2.6.24 BINDIR=/sbin LIBDIR=/lib

Verifique se o iptables está funcionando;

# iptables -n -L

Veja que a biblioteca do layer7 já está em /lib/iptables:

# ls -l /lib/iptables/*layer7*

Para finalizar, instale os pacotes de protocolos do layer 7:

# cd /root/layer7

# tar xzvf l7-protocols-2008-01-16.tar.gz

# cd l7-protocols-2008-01-16

# make install

# ls /etc/l7-protocols/protocols

– Aplicando algumas regras com o layer7:

Bloquear Protocolos P2P

# iptables -I INPUT -m layer7 –l7proto fasttrack -j DROP
Bloquear Msn Messenger:

# iptables -A FORWARD -m layer7 –l7proto msnmessenger -j DROP

Visualize as regras:

# iptables -n -L

Agora é só aplicar isso e tentar outros protocolos. Boa sorte!

Referência: Cesar Domingos