3. ¼³Ä¡Çϱâ

¸®´ª½º Ä¿³Î¿¡ iptables¿Í bridgeÆÐÄ¡¸¦ Çϰí ÄÄÆÄÀÏÀ» ÇÒ °ÍÀÌ´Ù. ¸ðµç ÀÛ¾÷Àº root·Î ÇÑ´Ù.

3.1. ¸®´ª½º Ä¿³Î ÆÐÄ¡

Ä¿³Î ¼Ò½º´Â /usr/src/linux ¿¡ Ç®¾î ³õ´Â´Ù.
# mv linux-2.4.19.tar.bz2 /usr/src
#cd /usr/src
/usr/src# tar vjxf linux-2.4.19.tar.bz2            ¾ÐÃàÀ» Ǭ´Ù. bunzip2 ÆÐŰÁö°¡ ÇÊ¿äÇÏ´Ù.
/usr/src# ln -s linux-2.4.19 linux                 ¾ÐÃàÀÌ Ç®¸° µð·ºÅ丮¸¦ linux¶ó´Â À̸§À¸·Î ½Éº¼¸¯ ¸µÅ©¸¦ »ý¼ºÇÑ´Ù.

bridge ÆÐÄ¡¸¦ ÆÐÄ¡ÇÑ´Ù.
# mv bridge-nf-0.0.7-against-2.4.19.diff /usr/src
# cd /usr/src/linux
/usr/src/linux# patch -p1 < ../bridge-nf-0.0.7-against-2.4.19.diff

iptable ÆÐÄ¡´Â patch-o-matic À̶ó´Â ¹æ½ÄÀ¸·Î Ä¿³Î ÆÐÄ¡¸¦ ÇÑ´Ù.
# tar vjxf patch-o-matic-20030107.tar.bz2
# cd cd patch-o-matic-20030107
# ./runme extra
Hey! KERNEL_DIR is not set.
Where is your kernel? [/usr/src/linux]              Ä¿³Î ¼Ò½º¸¦ /usr/src¿¡ Ç®¾î¼­ linux¶ó°í ¸µÅ©¸¦ °É¾ú´Ù¸é ¿£Å͸¦ Ä£´Ù
                                                    ¾Æ´Ï¸é ½ÇÁ¦ Ä¿³ÎÀÌ ÀÖ´Â °æ·Î¸¦ Àû¾îÁØ´Ù
´ÙÀ½°ú °°ÀÌ ³ª¿Ã °ÍÀÌ´Ù.
Welcome to Rusty's Patch-o-matic!

Each patch is a new feature: many have minimal impact, some do not.
Almost every one has bugs, so I don't recommend applying them all!
-------------------------------------------------------
Already applied: submitted/01_2.4.19

Testing... 02_2.4.20.patch NOT APPLIED ( 17 missing files)
The submitted/02_2.4.20 patch:
   Authors: Various (see below)
   Status: Included in stock 2.4.20 kernel
   
   This big patch contains all netfilter/iptables changes between stock kernel
   versions 2.4.19 and 2.4.20.
   
   submitted/DSCP.patch
   + New DSCP target to mangle table (Harald Welte + Matthew G. Marsh)
   submitted/ECN.patch
   + New ECN target to mangle table (Harald Welte)
   submitted/REJECT_mark.patch
   + Don't copy nfmark value of old packet (Henrik Nordstrom)
   submitted/ahesp-static.patch
   + Fix static build of ahesp match (Paul P Komkoff Jr)
   submitted/conntrack+nat-helper-unregister.patch
   + Fix helper unregister in case of clashing ports (Harald Welte)
   submitted/conntrack.patch
   + Add new 'conntrack' match (Marc Boucher)
   submitted/dscp.patch
   + New 'dscp' match (Harald Welte)
   submitted/ecn.patch
   + New 'ecn' match (Harald Welte)
   submitted/helper.patch
   + New 'helper' match (Martin Josefsson, Harald Welte)
   submitted/ip6tables-exthdr-bug.patch.ipv6
   + Fix broken ipv6 extensionheader parser (Andras Kis-Szabo)
   submitted/ipv6-agr.patch.ipv6
   + New ip6tables 'eui64' match (Andras Kis-Szabo)
   submitted/length.patch.ipv6
   + New ip6tables 'length' match (Imran Patel, James Morris)
   submitted/log-tunnel-fix.patch.ipv6
   + Fix ip6tables 'LOG' target MAC address in case of tunnels
   (Peter Bieringer, Andras Kis-Szabo)
   submitted/nat-memoryleak-fix.patch
   + Fix memoryleak at iptable_nat unload time (zhongyu)
   submitted/ownercmd.patch
   + Extend 'owner' match to match cmdline (Marc Boucher)
   submitted/pkttype.patch
   + New 'pkttype' match (Michal Ludvig)
   submitted/ulog-nlgroup-shift-fix.patch
   + Fix error with shifting nlgroup in ULOG target (Harald Welte)
   submitted/ulog-sparc-bitops-fix.patch
   + Include linux/bitops.h instead of asm/bitops.h
   submitted/z-newnat16.patch
   + Redesign of conntrack and nat helper framework, for more info see http://cvs.netfilter.org/cgi-bin/cvsweb/netfilter/documentation/newnat-summary.txt
   (Harald Welte, Jozsef Kadlecsik, and others)
   submitted/z-newnat_assertfix.patch
   + Fix erroneously printed ASSERT messages when debugging of newnat
   enabled (Martin Josefsson)
   submitted/z-newnat_changeexpect-lockfix.patch
   + Fix locking bug in ip_conntrack_change_expect() (Martin Josefsson)
   Further changes, not previuosly in patch-o-matic:
   + ip6tables usage counter fix (Harald Welte)
   + ip_queue cleanup (James Morris)
   + minor spelling fixes
   + __constant_htons() macro changes
   + ipt_unclean: srcport _can_ be zero
   + yet another ipchains GFP_ATOMIC fix
-----------------------------------------------------------------
Do you want to apply this patch [N/y/t/f/a/r/b/w/v/q/?]
¿£Å͸¦ Ä£´Ù

iptableÆÐÄ¡¿¡´Â ³»¿ëÀÌ ¿©·¯ °¡Áö°¡ Á¸ÀçÇÑ´Ù. y¸¦ ´©¸£¸é ÆÐÄ¡°¡ µÈ´Ù. ±×·¯³ª ÀüºÎ ÆÐÄ¡¸¦ ÇÏ¸é ¾È µÈ´Ù. ³ªÁß¿¡ Ä¿³ÎÀ» ÄÄÆÄÀÏ ÇÏ¸é ¿¡·¯°¡ ³ª±â ¶§¹®¿¡ ²À ÇÊ¿äÇÑ °Í¸¸ y¸¦ ´­·¯ ÆÐÄ¡ ÇÑ´Ù. b ¸¦ ´©¸£¸é µÚ·Î µ¹¾Æ°¥ ¼ö ÀÖ´Ù.

Áö±Ý ÆÐÄ¡ ÇÒ °ÍÀº ÆÐŶ¿¡¼­ StringÀ» °Ë»öÇÏ¿© ÆÐŶÀ» ¹ö¸®°Å³ª °ÅºÎ ÇÏ´Â String match support ÀÌ´Ù. À̰ÍÀ» ÀÌ¿ëÇϸé Nimda, CodeRed µîÀÇ ¿úÀ̳ª ¹ÙÀÌ·¯½ºÀÇ ÆÐŶÀ» Â÷´Ü ÇÒ ¼ö ÀÖ´Ù.

°è¼Ó ¿£Å͸¦ Ãļ­ °¡´Ù º¸¸é ¾Æ·¡¿Í °°Àº È­¸éÀÌ ³ª¿Ã°Í ÀÌ´Ù.
Welcome to Rusty's Patch-o-matic!

Each patch is a new feature: many have minimal impact, some do not.
Almost every one has bugs, so I don't recommend applying them all!
-------------------------------------------------------
Already applied: submitted/01_2.4.19

Testing... string.patch NOT APPLIED ( 2 missing files)
The extra/string patch:
   Author: Emmanuel Roger <winfield@freegates.be>
   Status: Working, not with kernel 2.4.9
   
   This patch adds CONFIG_IP_NF_MATCH_STRING which allows you to
   match a string in a whole packet.
   
   THIS PATCH DOES NOT WORK WITH KERNEL 2.4.9 !!!
   
-----------------------------------------------------------------
Do you want to apply this patch [N/y/t/f/a/r/b/w/v/q/?] 

¿©±â¼­ y¸¦ ´©¸£¸é String match°¡ ÆÐÄ¡ µÈ´Ù.

°è¼Ó ¿£Å͸¦ Ä¡¸é ´Ù¸¥ ÆÐÄ¡µéÀÌ ³ª¿Â´Ù. ÇÊ¿äÇÑ °ÍµéÀÌ ÀÖÀ¸¸é ÆÐÄ¡ÇÑ´Ù.

3.2. Ä¿³Î ¿É¼Ç ¼³Á¤Çϱâ

iptables ¿Í bridge±â´ÉÀ» »ç¿ëÇÒ ¼ö ÀÖ°Ô Ä¿³Î ¿É¼ÇÀ» ¼³Á¤ÇÑ´Ù. »ç¿ë ÇÒ ·£Ä«µå 2°³µµ ¼³Á¤À» ÇÒ °ÍÀÌ´Ù.

Ä¿³Î ¿É¼ÇÀº ´ÙÀ½°ú °°ÀÌ ¼³Á¤ÇÑ´Ù. menuconfig ¸¦ ÀÌ¿ëÇÏ·Á¸é µ¥ºñ¾È¿¡¼­´Â libncurses5-dev ÆÐŰÁö°¡ ²À ÇÊ¿äÇÏ´Ù. µ¥ºñ¾È¿¡¼­ ÆÐŰÁö´Â apt-get ³ª dselect¸¦ ÀÌ¿ëÇÏ¿© ¼³Ä¡ÇÑ´Ù. ´Ù¸¥ ¹èÆ÷ÆÇµµ ¸¶Âù°¡Áö ÀÌ´Ù. ´ëºÎºÐÀÇ ¹èÆ÷ÆÇ¿¡¼­´Â ±âº»ÀûÀ¸·Î ¼³Ä¡µÇ¾î ÀÖÀ» °ÍÀÌ´Ù.
# cd /usr/src/linux
/usr/src/linux# make menuconfig

·£Ä«µå µå¶óÀ̹ö ¼³Á¤. º»ÀÎÀÌ »ç¿ëÇϰí ÀÖ´Â ·£Ä«µå´Â 3Com 590, Intel EtherPress/100 ÀÌ´Ù. °¢ÀÚ °¡Áö°í ÀÖ´Â ·£Ä«µå¸¦ ¼³Á¤ÇÏÀÚ.
Network device support  --->
  Ethernet (10 or 100Mbit)  --->
    [*] Ethernet (10 or 100Mbit)                                                                    
    < >   Sun Happy Meal 10/100baseT support                                                            
    < >   Sun GEM support                                                                               
    [*]   3COM cards                                                                                
    < >     3c501 "EtherLink" support                                                                   
    < >     3c503 "EtherLink II" support                                                                
    < >     3c505 "EtherLink Plus" support                                                              
    < >     3c507 "EtherLink 16" support (EXPERIMENTAL)                                                 
    < >     3c509/3c529 (MCA)/3c579 "EtherLink III" support                                             
    < >     3c515 ISA "Fast EtherLink"                                                                  
    <*>     3c590/3c900 series (592/595/597) "Vortex/Boomerang" support                                 
    < >   AMD LANCE and PCnet (AT1500 and NE2100) support                                               
    [ ]   Western Digital/SMC cards                                                                 
    [ ]   Racal-Interlan (Micom) NI cards                                                           
    < >   AT1700/1720 support (EXPERIMENTAL)                                                            
    < >   DEPCA, DE10x, DE200, DE201, DE202, DE422 support                                              
    < >   HP 10/100VG PCLAN (ISA, EISA, PCI) support                                                    
    [ ]   Other ISA cards                                                                           
    [*]   EISA, VLB, PCI and on board controllers                                                   
    < >     AMD PCnet32 PCI support                                                                     
    < >     Adaptec Starfire/DuraLAN support                                                            
    < >     Ansel Communications EISA 3200 support (EXPERIMENTAL)                                       
    < >     Apricot Xen-II on board Ethernet                                                            
    < >     CS89x0 support                                                                              
    < >     DECchip Tulip (dc21x4x) PCI support                                                         
    < >     TOSHIBA TC35815 Ethernet support                                                            
    < >     Generic DECchip & DIGITAL EtherWORKS PCI/EISA                                               
    < >     Digi Intl. RightSwitch SE-X support                                                         
    < >     Davicom DM910x/DM980x support                                                               
    <*>     EtherExpressPro/100 support                                                                 
    < >     Myson MTD-8xx PCI Ethernet support                                                          
    < >     National Semiconductor DP8381x series PCI Ethernet support                                  
    < >     PCI NE2000 and clones support (see help)                                                    
    < >     RealTek RTL-8139 C+ PCI Fast Ethernet Adapter support (EXPERIMENTAL)                        
    < >     RealTek RTL-8139 PCI Fast Ethernet Adapter support                                          
    < >     SiS 900/7016 PCI Fast Ethernet Adapter support                                              
    < >     SMC EtherPower II                                                                           
    < >     Sundance Alta support                                                                       
    < >     TI ThunderLAN support                                                                       
    < >     VIA Rhine support                                                                           
    < >     Winbond W89c840 Ethernet support                                                            
    [ ]   Pocket and portable adapters

bridge ±â´ÉÀ» »ç¿ëÇϱâ À§ÇÑ ¼³Á¤
Networking options  --->
  <*> Packet socket                                                                        
    [ ]   Packet socket: mmapped IO                                                          
    < > Netlink device emulation                                                             
    [*] Network packet filtering (replaces ipchains)                                         
    [ ]   Network packet filtering debugging                                                   
    [*] Socket Filtering                                                                     
    <*> Unix domain sockets                                                                  
    [*] TCP/IP networking                                                                    
    [*]   IP: multicasting                                                                   
    [ ]   IP: advanced router                                                                
    [ ]   IP: kernel level autoconfiguration                                                 
    < >   IP: tunneling                                                                        
    < >   IP: GRE tunnels over IP                                                            
    [ ]   IP: multicast routing                                                              
    [ ]   IP: ARP daemon support (EXPERIMENTAL)                                              
    [ ]   IP: TCP Explicit Congestion Notification support                                     
    [ ]   IP: TCP syncookie support (disabled per default)                                     
      IP: Netfilter Configuration  --->                                                        
    < >   The IPv6 protocol (EXPERIMENTAL)                                                     
    < >   Kernel httpd acceleration (EXPERIMENTAL)                                             
    [ ] Asynchronous Transfer Mode (ATM) (EXPERIMENTAL)                                        
    < > 802.1Q VLAN Support                                                                    
    ---                                                                                        
    < > The IPX protocol                                                                       
    < > Appletalk protocol support                                                           
    Appletalk devices  --->
    < > DECnet Support                                                                         
    <*> 802.1d Ethernet Bridging                                                             
    [*]   netfilter (firewalling) support                                                    
    < > CCITT X.25 Packet Layer (EXPERIMENTAL)                                               
    < > LAPB Data Link Driver (EXPERIMENTAL)                                                 
    [ ] 802.2 LLC (EXPERIMENTAL)                                                             
    [ ] Frame Diverter (EXPERIMENTAL)                                                        
    < > Acorn Econet/AUN protocols (EXPERIMENTAL)                                            
    < > WAN router                                                                           
    [ ] Fast switching (read help!)                                                          
    [ ] Forwarding between high speed interfaces                                             
    QoS and/or fair queueing  --->                                                           
    Network testing  --->

iptables¿¡¼­ »ç¿ë ÇÒ °¢°¢ÀÇ ±â´ÉµéÀ» ¸ðµâ·Î ¼³Á¤ÇÑ´Ù. ¸ðµâ ¼³Á¤Àº ½ºÆäÀ̽º ¹Ù·Î µÎ ¹ø ¼±ÅÃÇϸé MÀ̶ó°í Ç¥½ÃµÈ´Ù. À̰ÍÀÌ ¸ðµâ¼³Á¤ÀÌ´Ù. *·Î ¼³Á¤À» Çϸé Ä¿³Î·Î ¿ÏÀüÈ÷ Æ÷ÇԵȴÙ. ¸ðµâ·Î ¼³Á¤ÇÏ¸é ²À ÇÊ¿äÇÑ °Í¸¸ ¾µ ¼ö ÀÖ°Ô ÇϹǷΠ¸Þ¸ð¸® ³¶ºñ¸¦ ¸·À» ¼ö ÀÖ´Ù.
Networking options  --->
  IP: Netfilter Configuration  --->
    <M> Connection tracking (required for masq/NAT)                                             
    <M>   FTP protocol support                                                                  
    <M>   IRC protocol support                                                                  
    <M> Userspace queueing via NETLINK (EXPERIMENTAL)                                           
    <*> IP tables support (required for filtering/masq/NAT)                                     
    <M>   limit match support                                                                   
    <M>   MAC address match support                                                             
    <M>   netfilter MARK match support                                                          
    <M>   Multiple port match support                                                           
    <M>   TOS match support                                                                     
    <M>   AH/ESP match support                                                                  
    <M>   LENGTH match support                                                                  
    <M>   TTL match support                                                                     
    <M>   tcpmss match support                                                                  
    <M>   Connection state match support                                                        
    <M>   Unclean match support (EXPERIMENTAL)                                                  
    <M>   String match support (EXPERIMENTAL)                                                   
    <M>   Owner match support (EXPERIMENTAL)                                                    
    <M>   Packet filtering                                                                      
    <M>     REJECT target support                                                               
    <M>     MIRROR target support (EXPERIMENTAL)                                                
    <M>   Full NAT                                                                              
    <M>     MASQUERADE target support                                                           
    <M>     REDIRECT target support                                                             
    [*]     NAT of local connections (READ HELP)                                            
    <M>     Basic SNMP-ALG support (EXPERIMENTAL)

3.3. Ä¿³Î ÄÄÆÄÀÏ

ÀÌÁ¦ ÆÐÄ¡ÇÑ Ä¿³ÎÀ» ÄÄÆÄÀÏ ÇÒ Â÷·Ê ÀÌ´Ù.

¸®´ª½º ¹èÆ÷ÆÇÀÌ µ¥ºñ¾ÈÀÏ °æ¿ì Ä¿³Î ÆÐŰÁö¸¦ ¸¸µé¾î¼­ Ä¿³ÎÀ» ¼³Ä¡ÇÏ´Â °ÍÀÌ ÆíÇÏ´Ù. kernel-package ¶ó´Â ÆÐŰÁö°¡ ÇÊ¿äÇÏ´Ù.
# cd /usr/src/linux
/usr/src/linux# make-kpkg --revision=1.0 binary-arch              ÀÌ·¸°Ô Çϸé /usr/src¿¡ Ä¿³Î Çì´õ¿Í Ä¿³Î À̹ÌÁö ÆÐŰÁö°¡ »ý¼ºµÈ´Ù.
/usr/src/linux# cd ..
/usr/src# ls
-rw-r--r--    1 root     root        30158 Mar 27 20:39 bridge-nf-0.0.7-against-2.4.19.diff
-rw-r--r--    1 root     src       3961230 Apr  9 22:58 kernel-headers-2.4.19_1.0_i386.deb            Ä¿³Î Çì´õ
-rw-r--r--    1 root     src       1274482 Apr  9 22:58 kernel-image-2.4.19_1.0_i386.deb              Ä¿³Î À̹ÌÁö
lrwxrwxrwx    1 root     src            12 May 14 04:24 linux -> linux-2.4.19
drwxr-xr-x   15 573      573           888 Jun 29 06:38 linux-2.4.19
/usr/src# dpkg -i kernel-headers-2.4.19_1.0_i386.deb
/usr/src# dpkg -i kernel-image-2.4.19_1.0_i386.deb

Ä¿³Î À̹ÌÁö¸¦ ¼³Ä¡ ÇÒ ¶§ ºÎÆÃ µð½ºÅ©¸¦ ¸¸µé¶ó´Â °÷¿¡´Â NÀ¸·Î Ãë¼Ò¸¦ Çϰí /vmlinuz ¶ó°í ¸µÅ©¸¦ ¸¸µç´Ù°í ÇÒ ¶§´Â Y¸¦ ´­·¯
¸µÅ©¸¦ ¸¸µç´Ù

ºÎÆ®·Î´õ·Î lilo¸¦ »ç¿ëÇÒ °æ¿ì
# lilo
Grub¸¦ »ç¿ëÇÒ °æ¿ì /boot/grub/menu.lst ÆÄÀÏÀ» ¼öÁ¤Çؼ­ »õ Ä¿³Î·Î ºÎÆÃ µÉ ¼ö ÀÖµµ·Ï ÇÑ´Ù

µ¥ºñ¾ÈÀÌ ¾Æ´Ñ ¸®´ª½º ¹èÆ÷ÆÇÀÇ °æ¿ì
# cd /usr/src/linux
/usr/src/linux# make dep && make bzImage && make modules && make modules_install
/usr/src/linux# cd arch/i386/boot/
/usr/src/linux/arch/i386/boot# cp bzImage /boot/vmlinuz-2.4.19

ºÎÆ®·Î´õ¸¦ lilo¸¦ »ç¿ëÇÒ °æ¿ì
/etc/lilo.conf ¼³Á¤À» º¯°æ ÇÑ´Ù. ¾Æ·¡¿Í °°Àº ºÎºÐÀÌ ÀÖÀ» °ÍÀÌ´Ù.
image=/boot/vmlinuz-2.4.19
        label=Linux
ÀúÀåÀ» Çϰí
# lilo

Grub¸¦ »ç¿ëÇÒ °æ¿ì
/boot/grub/menu.lst ¾Æ·¡¿Í °°Àº ºÎºÐÀÌ Àִµ¥ ÄÄÆÄÀÏÇÑ Ä¿³Î À̹ÌÁöÀÇ °æ·Î¸¦ Àû¾îÁØ´Ù.
title Linux
root (hd0,1)¤Ä
kernel /boot/vmlinuz-2.4.19 root=/dev/hda2

3.4. Bridge utils ¼³Ä¡

bridge ±â´ÉÀ» »ç¿ëÇϱâ À§ÇÑ ÇÁ·Î±×·¥ ¼³Ä¡

bridge utils ¼Ò½º ÄÄÆÄÀÏ ¹× ¼³Ä¡
# tar vxzf bridge-utils-0.9.6.tar.gz
# cd bridge-utils
~/bridge-utils# ./configure
~/bridge-utils# make
~/bridge-utils# make install

3.5. iptables ¼³Ä¡

ÆÐŶÁ¦¾î ¸í·ÉÀ» ³»¸®±âÀ§ÇÑ iptables¼³Ä¡

iptables ¼Ò½º ÄÄÆÄÀÏ ¹× ¼³Ä¡, KERNEL_DIR=/usr/src/linux ¿¡´Â Ä¿³Î ¼Ò½º°¡ ÀÖ´Â °æ·Î¸¦ Àû¾îÁØ´Ù.
# tar vjxf iptables-1.2.8.tar.bz2
# cd iptables-1.2.8
~/iptables-1.2.8# make KERNEL_DIR=/usr/src/linux
~/iptables-1.2.8# make install KERNEL_DIR=/usr/src/linux
~/iptables-1.2.8# make install-devel