RTFM.WIKI

Эта страница только для чтения. Вы можете посмотреть её исходный текст, но не можете его изменить. Сообщите администратору, если считаете, что это неправильно.
====== Установка xtables-addons для блокирования стран через GeoIP ======

  * http://www.blockacountry.com/
  * http://www.spamhaus.org/drop/
  * http://www.ipdeny.com/ipblocks/

https://0-web.ru/server/403-blokiruem-strany-v-iptables.html

{{:linux:iptables:xtables.png|}}

[[http://xtables-addons.sourceforge.net/modules.php|Список модулей]]

http://mironenko.pp.ua/2013/07/iptables.html?m=1

http://i-notes.org/centos-6-iptables-ustanovka-xtables-addons-geoip-filtering/

http://blog.ls20.com/iptables-geoip-port-knocking-and-port-scan-detection/

http://it-korolkov.ru/blog/index.php?id=20

===== Установка xtables-addons в CentOS 6 =====

Информация о системе

<code>
# cat /etc/centos-release 
CentOS release 6.8 (Final)
# uname -r
2.6.32-642.4.2.el6.i686
</code>

Устанавливаем devel пакеты

<code>
# yum install kernel-devel-`uname -r` iptables-devel kernel-headers-`uname -r`
</code>

Устанавливаем gcc и всё необходимое для сборки

<code>
# yum install gcc gcc-c++ make automake unzip zip perl perl-Text-CSV_XS xz 
</code>

Устанавливаем xtables-addons

<code>
# wget http://downloads.sourceforge.net/project/xtables-addons/Xtables-addons/xtables-addons-1.47.1.tar.xz
# tar xvf xtables-addons-1.47.1.tar.xz
# xtables-addons-1.47.1
# ./configure
# make
# make instal
</code>

Также бытует мнение, что некоторые модули следует исключить из сборки. Поэтому комментируем следующие строки

<code>
# nano mconfig

build_RAWNAT=m
build_SYSRQ=m
build_length2=m

</code>

Бонус. Увеличиваем количество стран в одном правиле для iptables

<code>
sed -i "s#XT_GEOIP_MAX = 15#XT_GEOIP_MAX = 50#g" ./extensions/xt_geoip.h
</code>

На ''make'' шаге всё закончится ошибкой

<code>
# make
make  all-recursive
make[1]: Entering directory `/root/xtables-addons-1.47.1'
Making all in extensions
make[2]: Entering directory `/root/xtables-addons-1.47.1/extensions'
Xtables-addons 1.47.1 - Linux 2.6.32-642.4.2.el6.i686
if [ -n "/lib/modules/2.6.32-642.4.2.el6.i686/build" ]; then make -C /lib/modules/2.6.32-642.4.2.el6.i686/build M=/root/xtables-addons-1.47.1/extensions modules; fi;
make[3]: Entering directory `/usr/src/kernels/2.6.32-642.4.2.el6.i686'
  CC [M]  /root/xtables-addons-1.47.1/extensions/compat_xtables.o
/root/xtables-addons-1.47.1/extensions/compat_xtables.c: In function 'xtnu_ipv6_find_hdr':
/root/xtables-addons-1.47.1/extensions/compat_xtables.c:633: error: too few arguments to function 'ipv6_find_hdr'
make[4]: *** [/root/xtables-addons-1.47.1/extensions/compat_xtables.o] Error 1
make[3]: *** [_module_/root/xtables-addons-1.47.1/extensions] Error 2
make[3]: Leaving directory `/usr/src/kernels/2.6.32-642.4.2.el6.i686'
make[2]: *** [modules] Error 2
make[2]: Leaving directory `/root/xtables-addons-1.47.1/extensions'
make[1]: *** [all-recursive] Error 1
make[1]: Leaving directory `/root/xtables-addons-1.47.1'
make: *** [all] Error 2
</code>

Кто виноват и что делать

Ошибка **compat_xtables.c:633: error: too few arguments to function 'ipv6_find_hdr'**

https://gist.github.com/namikawa/8677d8742994e3c19ee1

<code>
Thu May 30 2013 Jarod Wilson <jarod@redhat.com> [2.6.32-384.el6]

- [net] ipv6: improve ipv6_find_hdr() to skip empty routing headers (Thomas Graf) [923212]
- [net] ipv6: Move ipv6_find_hdr() out of Netfilter code (Thomas Graf) [923212]
- [net] netfilter: ip6_tables: add flags parameter to ipv6_find_hdr() (Thomas Graf) [923212]
</code>

http://www.spinics.net/lists/netfilter-devel/msg24187.html

<code>
[PATCH] netfilter: move ipv6_find_hdr to net/ipv6/netfilter.c and rename it

IPVS uses ipv6_find_hdr, but this function is defined in ip6_tables.c,
to avoid such a dependency, move the function definition to the
generic IPv6 netfilter infrastructure.

This patch also renames the function to nf_ip6_find_hdr.
</code>

Удаляем в файле ''extensions/compat_xtables.c'' строки между ''EXPORT_SYMBOL_GPL(HX_memmem);'' и ''MODULE_LICENSE("GPL");''

Ниже код, который следует удалить

Тем самым мы отключили поддержку IPv6.

<code>
EXPORT_SYMBOL_GPL(HX_memmem);

#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 3, 0) && defined(WITH_IPV6)
int xtnu_ipv6_skip_exthdr(const struct sk_buff *skb, int start,
    uint8_t *nexthdrp, __be16 *fragoffp)
{
        return ipv6_skip_exthdr(skb, start, nexthdrp);
}
EXPORT_SYMBOL_GPL(xtnu_ipv6_skip_exthdr);
#endif

#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 5, 0) && defined(WITH_IPV6)
int xtnu_ipv6_find_hdr(const struct sk_buff *skb, unsigned int *offset,
    int target, unsigned short *fragoff, int *fragflg)
{
        return ipv6_find_hdr(skb, offset, target, fragoff);
}
EXPORT_SYMBOL_GPL(xtnu_ipv6_find_hdr);
#endif

MODULE_LICENSE("GPL");
</code>

Альтернативный метод

<code>
# nano /lib/modules/`uname -r`/build/include/linux/autoconf.h
</code>

Строку

<code>
#define CONFIG_IP6_NF_IPTABLES_MODULE 1
</code>

Заменяем на

<code>
/*#define CONFIG_IP6_NF_IPTABLES_MODULE 1*/
</code>

Создаём базу данных GeoIP

<code>
# cd geoip/
# ./xt_geoip_dl
# ./xt_geoip_build GeoIPCountryWhois.csv
# mkdir -p /usr/share/xt_geoip/
# cp -r {BE,LE} /usr/share/xt_geoip/
</code>

Загружаем модуль

<code>
# modprobe xt_geoip
# lsmod |grep xt
</code>

https://www.remoteshaman.com/forum/centos/66-compat-xtables-c-633-error-too-few-arguments-to-function-ipv6-find-hdr

http://blog.centralserv.co.uk/centos-redhat-6-5-xtables-addons-installation-puppet-xtables-addons/

https://www.google.com/search?q=checking+kernel+version+that+we+will+build+against...+make%3A+***+%2Flib%2Fmodules%2F2.6.32-431.el6.i686%2Fbuild%3A+No+such+file+or+directory.++Stop.&ie=utf-8&oe=utf-8

===== Установка xtables-addons в Debian 7 =====

  * http://devsysadmin.net/?p=389
  * https://open-admin.de/howto/laender-mittels-iptables-aussperren/
  * https://0-web.ru/server/403-blokiruem-strany-v-iptables.html
  * https://terminal28.com/how-to-block-countries-using-iptables-debian/#5_ISO_3166Country_Codes

===== Установка xtables-addons в Debian 8 =====

http://unix.rocks/2016/a-better-iptables-with-maxmind-geoip-geolocation-data/

http://stackoverflow.com/questions/15979233/make-lib-modules-2-6-32-279-el6-x86-64-build-no-such-file-or-directory-s

<code>
apt-get install libtext-csv-xs-perl module-assistant geoip-database libgeoip1
</code>

7
<code>
sudo module-assistant --verbose --text-mode auto-install xtables-addons
</code>

8
<code>
apt-get install install libtext-csv-xs-perl xtables-addons-common
</code>

<code>

</code>

<code>

</code>

===== ISO 3166 Country Codes =====

<hidden>
<code>
Country                                         A 2     A 3     Number
----------------------------------------------------------------------
AALAND ISLANDS                                  AX      ALA     248
AFGHANISTAN                                     AF      AFG     004
ALBANIA                                         AL      ALB     008
ALGERIA                                         DZ      DZA     012
AMERICAN SAMOA                                  AS      ASM     016
ANDORRA                                         AD      AND     020
ANGOLA                                          AO      AGO     024
ANGUILLA                                        AI      AIA     660
ANTARCTICA                                      AQ      ATA     010
ANTIGUA AND BARBUDA                             AG      ATG     028
ARGENTINA                                       AR      ARG     032
ARMENIA                                         AM      ARM     051
ARUBA                                           AW      ABW     533
AUSTRALIA                                       AU      AUS     036
AUSTRIA                                         AT      AUT     040
AZERBAIJAN                                      AZ      AZE     031
BAHAMAS                                         BS      BHS     044
BAHRAIN                                         BH      BHR     048
BANGLADESH                                      BD      BGD     050
BARBADOS                                        BB      BRB     052
BELARUS                                         BY      BLR     112
BELGIUM                                         BE      BEL     056
BELIZE                                          BZ      BLZ     084
BENIN                                           BJ      BEN     204
BERMUDA                                         BM      BMU     060
BHUTAN                                          BT      BTN     064
BOLIVIA                                         BO      BOL     068
BOSNIA AND HERZEGOWINA                          BA      BIH     070
BOTSWANA                                        BW      BWA     072
BOUVET ISLAND                                   BV      BVT     074
BRAZIL                                          BR      BRA     076
BRITISH INDIAN OCEAN TERRITORY                  IO      IOT     086
BRUNEI DARUSSALAM                               BN      BRN     096
BULGARIA                                        BG      BGR     100
BURKINA FASO                                    BF      BFA     854
BURUNDI                                         BI      BDI     108
CAMBODIA                                        KH      KHM     116
CAMEROON                                        CM      CMR     120
CANADA                                          CA      CAN     124
CAPE VERDE                                      CV      CPV     132
CAYMAN ISLANDS                                  KY      CYM     136
CENTRAL AFRICAN REPUBLIC                        CF      CAF     140
CHAD                                            TD      TCD     148
CHILE                                           CL      CHL     152
CHINA                                           CN      CHN     156
CHRISTMAS ISLAND                                CX      CXR     162
COCOS (KEELING) ISLANDS                         CC      CCK     166
COLOMBIA                                        CO      COL     170
COMOROS                                         KM      COM     174
CONGO, Democratic Republic of (was Zaire)       CD      COD     180
CONGO, Republic of                              CG      COG     178
COOK ISLANDS                                    CK      COK     184
COSTA RICA                                      CR      CRI     188
COTE D'IVOIRE                                   CI      CIV     384
CROATIA (local name: Hrvatska)                  HR      HRV     191
CUBA                                            CU      CUB     192
CYPRUS                                          CY      CYP     196
CZECH REPUBLIC                                  CZ      CZE     203
DENMARK                                         DK      DNK     208
DJIBOUTI                                        DJ      DJI     262
DOMINICA                                        DM      DMA     212
DOMINICAN REPUBLIC                              DO      DOM     214
ECUADOR                                         EC      ECU     218
EGYPT                                           EG      EGY     818
EL SALVADOR                                     SV      SLV     222
EQUATORIAL GUINEA                               GQ      GNQ     226
ERITREA                                         ER      ERI     232
ESTONIA                                         EE      EST     233
ETHIOPIA                                        ET      ETH     231
FALKLAND ISLANDS (MALVINAS)                     FK      FLK     238
FAROE ISLANDS                                   FO      FRO     234
FIJI                                            FJ      FJI     242
FINLAND                                         FI      FIN     246
FRANCE                                          FR      FRA     250
FRENCH GUIANA                                   GF      GUF     254
FRENCH POLYNESIA                                PF      PYF     258
FRENCH SOUTHERN TERRITORIES                     TF      ATF     260
GABON                                           GA      GAB     266
GAMBIA                                          GM      GMB     270
GEORGIA                                         GE      GEO     268
GERMANY                                         DE      DEU     276
GHANA                                           GH      GHA     288
GIBRALTAR                                       GI      GIB     292
GREECE                                          GR      GRC     300
GREENLAND                                       GL      GRL     304
GRENADA                                         GD      GRD     308
GUADELOUPE                                      GP      GLP     312
GUAM                                            GU      GUM     316
GUATEMALA                                       GT      GTM     320
GUINEA                                          GN      GIN     324
GUINEA-BISSAU                                   GW      GNB     624
GUYANA                                          GY      GUY     328
HAITI                                           HT      HTI     332
HEARD AND MC DONALD ISLANDS                     HM      HMD     334
HONDURAS                                        HN      HND     340
HONG KONG                                       HK      HKG     344
HUNGARY                                         HU      HUN     348
ICELAND                                         IS      ISL     352
INDIA                                           IN      IND     356
INDONESIA                                       ID      IDN     360
IRAN (ISLAMIC REPUBLIC OF)                      IR      IRN     364
IRAQ                                            IQ      IRQ     368
IRELAND                                         IE      IRL     372
ISRAEL                                          IL      ISR     376
ITALY                                           IT      ITA     380
JAMAICA                                         JM      JAM     388
JAPAN                                           JP      JPN     392
JORDAN                                          JO      JOR     400
KAZAKHSTAN                                      KZ      KAZ     398
KENYA                                           KE      KEN     404
KIRIBATI                                        KI      KIR     296
KOREA, DEMOCRATIC PEOPLE'S REPUBLIC OF          KP      PRK     408
KOREA, REPUBLIC OF                              KR      KOR     410
KUWAIT                                          KW      KWT     414
KYRGYZSTAN                                      KG      KGZ     417
LAO PEOPLE'S DEMOCRATIC REPUBLIC                LA      LAO     418
LATVIA                                          LV      LVA     428
LEBANON                                         LB      LBN     422
LESOTHO                                         LS      LSO     426
LIBERIA                                         LR      LBR     430
LIBYAN ARAB JAMAHIRIYA                          LY      LBY     434
LIECHTENSTEIN                                   LI      LIE     438
LITHUANIA                                       LT      LTU     440
LUXEMBOURG                                      LU      LUX     442
MACAU                                           MO      MAC     446
MACEDONIA, THE FORMER YUGOSLAV REPUBLIC OF      MK      MKD     807
MADAGASCAR                                      MG      MDG     450
MALAWI                                          MW      MWI     454
MALAYSIA                                        MY      MYS     458
MALDIVES                                        MV      MDV     462
MALI                                            ML      MLI     466
MALTA                                           MT      MLT     470
MARSHALL ISLANDS                                MH      MHL     584
MARTINIQUE                                      MQ      MTQ     474
MAURITANIA                                      MR      MRT     478
MAURITIUS                                       MU      MUS     480
MAYOTTE                                         YT      MYT     175
MEXICO                                          MX      MEX     484
MICRONESIA, FEDERATED STATES OF                 FM      FSM     583
MOLDOVA, REPUBLIC OF                            MD      MDA     498
MONACO                                          MC      MCO     492
MONGOLIA                                        MN      MNG     496
MONTSERRAT                                      MS      MSR     500
MOROCCO                                         MA      MAR     504
MOZAMBIQUE                                      MZ      MOZ     508
MYANMAR                                         MM      MMR     104
NAMIBIA                                         NA      NAM     516
NAURU                                           NR      NRU     520
NEPAL                                           NP      NPL     524
NETHERLANDS                                     NL      NLD     528
NETHERLANDS ANTILLES                            AN      ANT     530
NEW CALEDONIA                                   NC      NCL     540
NEW ZEALAND                                     NZ      NZL     554
NICARAGUA                                       NI      NIC     558
NIGER                                           NE      NER     562
NIGERIA                                         NG      NGA     566
NIUE                                            NU      NIU     570
NORFOLK ISLAND                                  NF      NFK     574
NORTHERN MARIANA ISLANDS                        MP      MNP     580
NORWAY                                          NO      NOR     578
OMAN                                            OM      OMN     512
PAKISTAN                                        PK      PAK     586
PALAU                                           PW      PLW     585
PALESTINIAN TERRITORY, Occupied                 PS      PSE     275
PANAMA                                          PA      PAN     591
PAPUA NEW GUINEA                                PG      PNG     598
PARAGUAY                                        PY      PRY     600
PERU                                            PE      PER     604
PHILIPPINES                                     PH      PHL     608
PITCAIRN                                        PN      PCN     612
POLAND                                          PL      POL     616
PORTUGAL                                        PT      PRT     620
PUERTO RICO                                     PR      PRI     630
QATAR                                           QA      QAT     634
REUNION                                         RE      REU     638
ROMANIA                                         RO      ROU     642
RUSSIAN FEDERATION                              RU      RUS     643
RWANDA                                          RW      RWA     646
SAINT HELENA                                    SH      SHN     654
SAINT KITTS AND NEVIS                           KN      KNA     659
SAINT LUCIA                                     LC      LCA     662
SAINT PIERRE AND MIQUELON                       PM      SPM     666
SAINT VINCENT AND THE GRENADINES                VC      VCT     670
SAMOA                                           WS      WSM     882
SAN MARINO                                      SM      SMR     674
SAO TOME AND PRINCIPE                           ST      STP     678
SAUDI ARABIA                                    SA      SAU     682
SENEGAL                                         SN      SEN     686
SERBIA AND MONTENEGRO                           CS      SCG     891
SEYCHELLES                                      SC      SYC     690
SIERRA LEONE                                    SL      SLE     694
SINGAPORE                                       SG      SGP     702
SLOVAKIA                                        SK      SVK     703
SLOVENIA                                        SI      SVN     705
SOLOMON ISLANDS                                 SB      SLB     090
SOMALIA                                         SO      SOM     706
SOUTH AFRICA                                    ZA      ZAF     710
SOUTH GEORGIA AND THE SOUTH SANDWICH ISLANDS    GS      SGS     239
SPAIN                                           ES      ESP     724
SRI LANKA                                       LK      LKA     144
SUDAN                                           SD      SDN     736
SURINAME                                        SR      SUR     740
SVALBARD AND JAN MAYEN ISLANDS                  SJ      SJM     744
SWAZILAND                                       SZ      SWZ     748
SWEDEN                                          SE      SWE     752
SWITZERLAND                                     CH      CHE     756
SYRIAN ARAB REPUBLIC                            SY      SYR     760
TAIWAN                                          TW      TWN     158
TAJIKISTAN                                      TJ      TJK     762
TANZANIA, UNITED REPUBLIC OF                    TZ      TZA     834
THAILAND                                        TH      THA     764
TIMOR-LESTE                                     TL      TLS     626
TOGO                                            TG      TGO     768
TOKELAU                                         TK      TKL     772
TONGA                                           TO      TON     776
TRINIDAD AND TOBAGO                             TT      TTO     780
TUNISIA                                         TN      TUN     788
TURKEY                                          TR      TUR     792
TURKMENISTAN                                    TM      TKM     795
TURKS AND CAICOS ISLANDS                        TC      TCA     796
TUVALU                                          TV      TUV     798
UGANDA                                          UG      UGA     800
UKRAINE                                         UA      UKR     804
UNITED ARAB EMIRATES                            AE      ARE     784
UNITED KINGDOM                                  GB      GBR     826
UNITED STATES                                   US      USA     840
UNITED STATES MINOR OUTLYING ISLANDS            UM      UMI     581
URUGUAY                                         UY      URY     858
UZBEKISTAN                                      UZ      UZB     860
VANUATU                                         VU      VUT     548
VATICAN CITY STATE (HOLY SEE)                   VA      VAT     336
VENEZUELA                                       VE      VEN     862
VIET NAM                                        VN      VNM     704
VIRGIN ISLANDS (BRITISH)                        VG      VGB     092
VIRGIN ISLANDS (U.S.)                           VI      VIR     850
WALLIS AND FUTUNA ISLANDS                       WF      WLF     876
WESTERN SAHARA                                  EH      ESH     732
YEMEN                                           YE      YEM     887
ZAMBIA                                          ZM      ZMB     894
ZIMBABWE                                        ZW      ZWE     716
</code>
</hidden>

\\

yum install xtables-addons perl-Text-CSV_XS

cd /usr/share/doc/xtables-addons-1.47.1/geoip/
mkdir /usr/share/xt_geoip
chmod +x xt_geoip_dl
chmod +x xt_geoip_build
./xt_geoip_dl
./xt_geoip_build -D /usr/share/xt_geoip *.csv