¸®´ª½º Ä¿³Î¿¡ iptables¿Í bridgeÆÐÄ¡¸¦ Çϰí ÄÄÆÄÀÏÀ» ÇÒ °ÍÀÌ´Ù. ¸ðµç ÀÛ¾÷Àº root·Î ÇÑ´Ù.
Ä¿³Î ¼Ò½º´Â /usr/src/linux ¿¡ Ç®¾î ³õ´Â´Ù.
# mv linux-2.4.19.tar.bz2 /usr/src #cd /usr/src /usr/src# tar vjxf linux-2.4.19.tar.bz2 ¾ÐÃàÀ» Ǭ´Ù. bunzip2 ÆÐŰÁö°¡ ÇÊ¿äÇÏ´Ù. /usr/src# ln -s linux-2.4.19 linux ¾ÐÃàÀÌ Ç®¸° µð·ºÅ丮¸¦ linux¶ó´Â À̸§À¸·Î ½Éº¼¸¯ ¸µÅ©¸¦ »ý¼ºÇÑ´Ù. |
bridge ÆÐÄ¡¸¦ ÆÐÄ¡ÇÑ´Ù.
# mv bridge-nf-0.0.7-against-2.4.19.diff /usr/src # cd /usr/src/linux /usr/src/linux# patch -p1 < ../bridge-nf-0.0.7-against-2.4.19.diff |
iptable ÆÐÄ¡´Â patch-o-matic À̶ó´Â ¹æ½ÄÀ¸·Î Ä¿³Î ÆÐÄ¡¸¦ ÇÑ´Ù.
# tar vjxf patch-o-matic-20030107.tar.bz2 # cd cd patch-o-matic-20030107 # ./runme extra Hey! KERNEL_DIR is not set. Where is your kernel? [/usr/src/linux] Ä¿³Î ¼Ò½º¸¦ /usr/src¿¡ Ç®¾î¼ linux¶ó°í ¸µÅ©¸¦ °É¾ú´Ù¸é ¿£Å͸¦ Ä£´Ù ¾Æ´Ï¸é ½ÇÁ¦ Ä¿³ÎÀÌ ÀÖ´Â °æ·Î¸¦ Àû¾îÁØ´Ù ´ÙÀ½°ú °°ÀÌ ³ª¿Ã °ÍÀÌ´Ù. Welcome to Rusty's Patch-o-matic! Each patch is a new feature: many have minimal impact, some do not. Almost every one has bugs, so I don't recommend applying them all! ------------------------------------------------------- Already applied: submitted/01_2.4.19 Testing... 02_2.4.20.patch NOT APPLIED ( 17 missing files) The submitted/02_2.4.20 patch: Authors: Various (see below) Status: Included in stock 2.4.20 kernel This big patch contains all netfilter/iptables changes between stock kernel versions 2.4.19 and 2.4.20. submitted/DSCP.patch + New DSCP target to mangle table (Harald Welte + Matthew G. Marsh) submitted/ECN.patch + New ECN target to mangle table (Harald Welte) submitted/REJECT_mark.patch + Don't copy nfmark value of old packet (Henrik Nordstrom) submitted/ahesp-static.patch + Fix static build of ahesp match (Paul P Komkoff Jr) submitted/conntrack+nat-helper-unregister.patch + Fix helper unregister in case of clashing ports (Harald Welte) submitted/conntrack.patch + Add new 'conntrack' match (Marc Boucher) submitted/dscp.patch + New 'dscp' match (Harald Welte) submitted/ecn.patch + New 'ecn' match (Harald Welte) submitted/helper.patch + New 'helper' match (Martin Josefsson, Harald Welte) submitted/ip6tables-exthdr-bug.patch.ipv6 + Fix broken ipv6 extensionheader parser (Andras Kis-Szabo) submitted/ipv6-agr.patch.ipv6 + New ip6tables 'eui64' match (Andras Kis-Szabo) submitted/length.patch.ipv6 + New ip6tables 'length' match (Imran Patel, James Morris) submitted/log-tunnel-fix.patch.ipv6 + Fix ip6tables 'LOG' target MAC address in case of tunnels (Peter Bieringer, Andras Kis-Szabo) submitted/nat-memoryleak-fix.patch + Fix memoryleak at iptable_nat unload time (zhongyu) submitted/ownercmd.patch + Extend 'owner' match to match cmdline (Marc Boucher) submitted/pkttype.patch + New 'pkttype' match (Michal Ludvig) submitted/ulog-nlgroup-shift-fix.patch + Fix error with shifting nlgroup in ULOG target (Harald Welte) submitted/ulog-sparc-bitops-fix.patch + Include linux/bitops.h instead of asm/bitops.h submitted/z-newnat16.patch + Redesign of conntrack and nat helper framework, for more info see http://cvs.netfilter.org/cgi-bin/cvsweb/netfilter/documentation/newnat-summary.txt (Harald Welte, Jozsef Kadlecsik, and others) submitted/z-newnat_assertfix.patch + Fix erroneously printed ASSERT messages when debugging of newnat enabled (Martin Josefsson) submitted/z-newnat_changeexpect-lockfix.patch + Fix locking bug in ip_conntrack_change_expect() (Martin Josefsson) Further changes, not previuosly in patch-o-matic: + ip6tables usage counter fix (Harald Welte) + ip_queue cleanup (James Morris) + minor spelling fixes + __constant_htons() macro changes + ipt_unclean: srcport _can_ be zero + yet another ipchains GFP_ATOMIC fix ----------------------------------------------------------------- Do you want to apply this patch [N/y/t/f/a/r/b/w/v/q/?] ¿£Å͸¦ Ä£´Ù |
iptableÆÐÄ¡¿¡´Â ³»¿ëÀÌ ¿©·¯ °¡Áö°¡ Á¸ÀçÇÑ´Ù. y¸¦ ´©¸£¸é ÆÐÄ¡°¡ µÈ´Ù. ±×·¯³ª ÀüºÎ ÆÐÄ¡¸¦ ÇÏ¸é ¾È µÈ´Ù. ³ªÁß¿¡ Ä¿³ÎÀ» ÄÄÆÄÀÏ ÇÏ¸é ¿¡·¯°¡ ³ª±â ¶§¹®¿¡ ²À ÇÊ¿äÇÑ °Í¸¸ y¸¦ ´·¯ ÆÐÄ¡ ÇÑ´Ù. b ¸¦ ´©¸£¸é µÚ·Î µ¹¾Æ°¥ ¼ö ÀÖ´Ù.
Áö±Ý ÆÐÄ¡ ÇÒ °ÍÀº ÆÐŶ¿¡¼ StringÀ» °Ë»öÇÏ¿© ÆÐŶÀ» ¹ö¸®°Å³ª °ÅºÎ ÇÏ´Â String match support ÀÌ´Ù. À̰ÍÀ» ÀÌ¿ëÇϸé Nimda, CodeRed µîÀÇ ¿úÀ̳ª ¹ÙÀÌ·¯½ºÀÇ ÆÐŶÀ» Â÷´Ü ÇÒ ¼ö ÀÖ´Ù.
°è¼Ó ¿£Å͸¦ Ãļ °¡´Ù º¸¸é ¾Æ·¡¿Í °°Àº ȸéÀÌ ³ª¿Ã°Í ÀÌ´Ù.
Welcome to Rusty's Patch-o-matic! Each patch is a new feature: many have minimal impact, some do not. Almost every one has bugs, so I don't recommend applying them all! ------------------------------------------------------- Already applied: submitted/01_2.4.19 Testing... string.patch NOT APPLIED ( 2 missing files) The extra/string patch: Author: Emmanuel Roger <winfield@freegates.be> Status: Working, not with kernel 2.4.9 This patch adds CONFIG_IP_NF_MATCH_STRING which allows you to match a string in a whole packet. THIS PATCH DOES NOT WORK WITH KERNEL 2.4.9 !!! ----------------------------------------------------------------- Do you want to apply this patch [N/y/t/f/a/r/b/w/v/q/?] ¿©±â¼ y¸¦ ´©¸£¸é String match°¡ ÆÐÄ¡ µÈ´Ù. °è¼Ó ¿£Å͸¦ Ä¡¸é ´Ù¸¥ ÆÐÄ¡µéÀÌ ³ª¿Â´Ù. ÇÊ¿äÇÑ °ÍµéÀÌ ÀÖÀ¸¸é ÆÐÄ¡ÇÑ´Ù. |
iptables ¿Í bridge±â´ÉÀ» »ç¿ëÇÒ ¼ö ÀÖ°Ô Ä¿³Î ¿É¼ÇÀ» ¼³Á¤ÇÑ´Ù. »ç¿ë ÇÒ ·£Ä«µå 2°³µµ ¼³Á¤À» ÇÒ °ÍÀÌ´Ù.
Ä¿³Î ¿É¼ÇÀº ´ÙÀ½°ú °°ÀÌ ¼³Á¤ÇÑ´Ù. menuconfig ¸¦ ÀÌ¿ëÇÏ·Á¸é µ¥ºñ¾È¿¡¼´Â libncurses5-dev ÆÐŰÁö°¡ ²À ÇÊ¿äÇÏ´Ù. µ¥ºñ¾È¿¡¼ ÆÐŰÁö´Â apt-get ³ª dselect¸¦ ÀÌ¿ëÇÏ¿© ¼³Ä¡ÇÑ´Ù. ´Ù¸¥ ¹èÆ÷ÆÇµµ ¸¶Âù°¡Áö ÀÌ´Ù. ´ëºÎºÐÀÇ ¹èÆ÷ÆÇ¿¡¼´Â ±âº»ÀûÀ¸·Î ¼³Ä¡µÇ¾î ÀÖÀ» °ÍÀÌ´Ù.
# cd /usr/src/linux /usr/src/linux# make menuconfig |
·£Ä«µå µå¶óÀ̹ö ¼³Á¤. º»ÀÎÀÌ »ç¿ëÇϰí ÀÖ´Â ·£Ä«µå´Â 3Com 590, Intel EtherPress/100 ÀÌ´Ù. °¢ÀÚ °¡Áö°í ÀÖ´Â ·£Ä«µå¸¦ ¼³Á¤ÇÏÀÚ.
Network device support ---> Ethernet (10 or 100Mbit) ---> [*] Ethernet (10 or 100Mbit) < > Sun Happy Meal 10/100baseT support < > Sun GEM support [*] 3COM cards < > 3c501 "EtherLink" support < > 3c503 "EtherLink II" support < > 3c505 "EtherLink Plus" support < > 3c507 "EtherLink 16" support (EXPERIMENTAL) < > 3c509/3c529 (MCA)/3c579 "EtherLink III" support < > 3c515 ISA "Fast EtherLink" <*> 3c590/3c900 series (592/595/597) "Vortex/Boomerang" support < > AMD LANCE and PCnet (AT1500 and NE2100) support [ ] Western Digital/SMC cards [ ] Racal-Interlan (Micom) NI cards < > AT1700/1720 support (EXPERIMENTAL) < > DEPCA, DE10x, DE200, DE201, DE202, DE422 support < > HP 10/100VG PCLAN (ISA, EISA, PCI) support [ ] Other ISA cards [*] EISA, VLB, PCI and on board controllers < > AMD PCnet32 PCI support < > Adaptec Starfire/DuraLAN support < > Ansel Communications EISA 3200 support (EXPERIMENTAL) < > Apricot Xen-II on board Ethernet < > CS89x0 support < > DECchip Tulip (dc21x4x) PCI support < > TOSHIBA TC35815 Ethernet support < > Generic DECchip & DIGITAL EtherWORKS PCI/EISA < > Digi Intl. RightSwitch SE-X support < > Davicom DM910x/DM980x support <*> EtherExpressPro/100 support < > Myson MTD-8xx PCI Ethernet support < > National Semiconductor DP8381x series PCI Ethernet support < > PCI NE2000 and clones support (see help) < > RealTek RTL-8139 C+ PCI Fast Ethernet Adapter support (EXPERIMENTAL) < > RealTek RTL-8139 PCI Fast Ethernet Adapter support < > SiS 900/7016 PCI Fast Ethernet Adapter support < > SMC EtherPower II < > Sundance Alta support < > TI ThunderLAN support < > VIA Rhine support < > Winbond W89c840 Ethernet support [ ] Pocket and portable adapters |
bridge ±â´ÉÀ» »ç¿ëÇϱâ À§ÇÑ ¼³Á¤
Networking options ---> <*> Packet socket [ ] Packet socket: mmapped IO < > Netlink device emulation [*] Network packet filtering (replaces ipchains) [ ] Network packet filtering debugging [*] Socket Filtering <*> Unix domain sockets [*] TCP/IP networking [*] IP: multicasting [ ] IP: advanced router [ ] IP: kernel level autoconfiguration < > IP: tunneling < > IP: GRE tunnels over IP [ ] IP: multicast routing [ ] IP: ARP daemon support (EXPERIMENTAL) [ ] IP: TCP Explicit Congestion Notification support [ ] IP: TCP syncookie support (disabled per default) IP: Netfilter Configuration ---> < > The IPv6 protocol (EXPERIMENTAL) < > Kernel httpd acceleration (EXPERIMENTAL) [ ] Asynchronous Transfer Mode (ATM) (EXPERIMENTAL) < > 802.1Q VLAN Support --- < > The IPX protocol < > Appletalk protocol support Appletalk devices ---> < > DECnet Support <*> 802.1d Ethernet Bridging [*] netfilter (firewalling) support < > CCITT X.25 Packet Layer (EXPERIMENTAL) < > LAPB Data Link Driver (EXPERIMENTAL) [ ] 802.2 LLC (EXPERIMENTAL) [ ] Frame Diverter (EXPERIMENTAL) < > Acorn Econet/AUN protocols (EXPERIMENTAL) < > WAN router [ ] Fast switching (read help!) [ ] Forwarding between high speed interfaces QoS and/or fair queueing ---> Network testing ---> |
iptables¿¡¼ »ç¿ë ÇÒ °¢°¢ÀÇ ±â´ÉµéÀ» ¸ðµâ·Î ¼³Á¤ÇÑ´Ù. ¸ðµâ ¼³Á¤Àº ½ºÆäÀ̽º ¹Ù·Î µÎ ¹ø ¼±ÅÃÇϸé MÀ̶ó°í Ç¥½ÃµÈ´Ù. À̰ÍÀÌ ¸ðµâ¼³Á¤ÀÌ´Ù. *·Î ¼³Á¤À» Çϸé Ä¿³Î·Î ¿ÏÀüÈ÷ Æ÷ÇԵȴÙ. ¸ðµâ·Î ¼³Á¤ÇÏ¸é ²À ÇÊ¿äÇÑ °Í¸¸ ¾µ ¼ö ÀÖ°Ô ÇϹǷΠ¸Þ¸ð¸® ³¶ºñ¸¦ ¸·À» ¼ö ÀÖ´Ù.
Networking options ---> IP: Netfilter Configuration ---> <M> Connection tracking (required for masq/NAT) <M> FTP protocol support <M> IRC protocol support <M> Userspace queueing via NETLINK (EXPERIMENTAL) <*> IP tables support (required for filtering/masq/NAT) <M> limit match support <M> MAC address match support <M> netfilter MARK match support <M> Multiple port match support <M> TOS match support <M> AH/ESP match support <M> LENGTH match support <M> TTL match support <M> tcpmss match support <M> Connection state match support <M> Unclean match support (EXPERIMENTAL) <M> String match support (EXPERIMENTAL) <M> Owner match support (EXPERIMENTAL) <M> Packet filtering <M> REJECT target support <M> MIRROR target support (EXPERIMENTAL) <M> Full NAT <M> MASQUERADE target support <M> REDIRECT target support [*] NAT of local connections (READ HELP) <M> Basic SNMP-ALG support (EXPERIMENTAL) |
ÀÌÁ¦ ÆÐÄ¡ÇÑ Ä¿³ÎÀ» ÄÄÆÄÀÏ ÇÒ Â÷·Ê ÀÌ´Ù.
¸®´ª½º ¹èÆ÷ÆÇÀÌ µ¥ºñ¾ÈÀÏ °æ¿ì Ä¿³Î ÆÐŰÁö¸¦ ¸¸µé¾î¼ Ä¿³ÎÀ» ¼³Ä¡ÇÏ´Â °ÍÀÌ ÆíÇÏ´Ù. kernel-package ¶ó´Â ÆÐŰÁö°¡ ÇÊ¿äÇÏ´Ù.
# cd /usr/src/linux /usr/src/linux# make-kpkg --revision=1.0 binary-arch ÀÌ·¸°Ô Çϸé /usr/src¿¡ Ä¿³Î Çì´õ¿Í Ä¿³Î À̹ÌÁö ÆÐŰÁö°¡ »ý¼ºµÈ´Ù. /usr/src/linux# cd .. /usr/src# ls -rw-r--r-- 1 root root 30158 Mar 27 20:39 bridge-nf-0.0.7-against-2.4.19.diff -rw-r--r-- 1 root src 3961230 Apr 9 22:58 kernel-headers-2.4.19_1.0_i386.deb Ä¿³Î Çì´õ -rw-r--r-- 1 root src 1274482 Apr 9 22:58 kernel-image-2.4.19_1.0_i386.deb Ä¿³Î À̹ÌÁö lrwxrwxrwx 1 root src 12 May 14 04:24 linux -> linux-2.4.19 drwxr-xr-x 15 573 573 888 Jun 29 06:38 linux-2.4.19 /usr/src# dpkg -i kernel-headers-2.4.19_1.0_i386.deb /usr/src# dpkg -i kernel-image-2.4.19_1.0_i386.deb Ä¿³Î À̹ÌÁö¸¦ ¼³Ä¡ ÇÒ ¶§ ºÎÆÃ µð½ºÅ©¸¦ ¸¸µé¶ó´Â °÷¿¡´Â NÀ¸·Î Ãë¼Ò¸¦ Çϰí /vmlinuz ¶ó°í ¸µÅ©¸¦ ¸¸µç´Ù°í ÇÒ ¶§´Â Y¸¦ ´·¯ ¸µÅ©¸¦ ¸¸µç´Ù ºÎÆ®·Î´õ·Î lilo¸¦ »ç¿ëÇÒ °æ¿ì # lilo Grub¸¦ »ç¿ëÇÒ °æ¿ì /boot/grub/menu.lst ÆÄÀÏÀ» ¼öÁ¤Çؼ »õ Ä¿³Î·Î ºÎÆÃ µÉ ¼ö ÀÖµµ·Ï ÇÑ´Ù |
µ¥ºñ¾ÈÀÌ ¾Æ´Ñ ¸®´ª½º ¹èÆ÷ÆÇÀÇ °æ¿ì
# cd /usr/src/linux /usr/src/linux# make dep && make bzImage && make modules && make modules_install /usr/src/linux# cd arch/i386/boot/ /usr/src/linux/arch/i386/boot# cp bzImage /boot/vmlinuz-2.4.19 ºÎÆ®·Î´õ¸¦ lilo¸¦ »ç¿ëÇÒ °æ¿ì /etc/lilo.conf ¼³Á¤À» º¯°æ ÇÑ´Ù. ¾Æ·¡¿Í °°Àº ºÎºÐÀÌ ÀÖÀ» °ÍÀÌ´Ù. image=/boot/vmlinuz-2.4.19 label=Linux ÀúÀåÀ» Çϰí # lilo Grub¸¦ »ç¿ëÇÒ °æ¿ì /boot/grub/menu.lst ¾Æ·¡¿Í °°Àº ºÎºÐÀÌ Àִµ¥ ÄÄÆÄÀÏÇÑ Ä¿³Î À̹ÌÁöÀÇ °æ·Î¸¦ Àû¾îÁØ´Ù. title Linux root (hd0,1)¤Ä kernel /boot/vmlinuz-2.4.19 root=/dev/hda2 |
bridge ±â´ÉÀ» »ç¿ëÇϱâ À§ÇÑ ÇÁ·Î±×·¥ ¼³Ä¡
bridge utils ¼Ò½º ÄÄÆÄÀÏ ¹× ¼³Ä¡
# tar vxzf bridge-utils-0.9.6.tar.gz # cd bridge-utils ~/bridge-utils# ./configure ~/bridge-utils# make ~/bridge-utils# make install |
ÆÐŶÁ¦¾î ¸í·ÉÀ» ³»¸®±âÀ§ÇÑ iptables¼³Ä¡
iptables ¼Ò½º ÄÄÆÄÀÏ ¹× ¼³Ä¡, KERNEL_DIR=/usr/src/linux ¿¡´Â Ä¿³Î ¼Ò½º°¡ ÀÖ´Â °æ·Î¸¦ Àû¾îÁØ´Ù.
# tar vjxf iptables-1.2.8.tar.bz2 # cd iptables-1.2.8 ~/iptables-1.2.8# make KERNEL_DIR=/usr/src/linux ~/iptables-1.2.8# make install KERNEL_DIR=/usr/src/linux ~/iptables-1.2.8# make install-devel |