关于iptables模块的问题！！！

murong

root@linux ~]# iptables -m ipp2p --help
iptables v1.3.5

Usage: iptables -[AD] chain rule-specification [options]
       iptables -[RI] chain rulenum rule-specification [options]
       iptables -D chain rulenum [options]
       iptables -[LFZ] [chain] [options]
       iptables -[NX] chain
       iptables -E old-chain-name new-chain-name
       iptables -P chain target [options]
       iptables -h (print this help information)

Commands:
Either long or short options are allowed.
  --append  -A chain    Append to chain
  --delete  -D chain    Delete matching rule from chain
  --delete  -D chain rulenum
      Delete rule rulenum (1 = first) from chain
  --insert  -I chain [rulenum]
      Insert in chain as rulenum (default 1=first)
  --replace -R chain rulenum
      Replace rule rulenum (1 = first) in chain
  --list    -L [chain]  List the rules in a chain or all chains
  --flush   -F [chain]  Delete all rules in  chain or all chains
  --zero    -Z [chain]  Zero counters in chain or all chains
  --new     -N chain    Create a new user-defined chain
  --delete-chain
            -X [chain]  Delete a user-defined chain
  --policy  -P chain target
      Change policy on chain to target
  --rename-chain
            -E old-chain new-chain
      Change chain name, (moving any references)
Options:
  --proto     -p [!] proto      protocol: by number or name, eg. `tcp'
  --source    -s [!] address[/mask]
      source specification
  --destination -d [!] address[/mask]
      destination specification
  --in-interface -i [!] input name[+]
      network interface name ([+] for wildcard)
  --jump      -j target
      target for rule (may load target extension)
  --goto      -g chain
                              jump to chain with no return
  --match     -m match
      extended match (may load extension)
  --numeric   -n        numeric output of addresses and ports
  --out-interface -o [!] output name[+]
      network interface name ([+] for wildcard)
  --table     -t table table to manipulate (default: `filter')
  --verbose   -v        verbose mode
  --line-numbers        print line numbers when listing
  --exact     -x        expand numbers (display exact values)
[!] --fragment  -f      match second or further fragments only
  --modprobe=<command>  try to insert modules using this command
  --set-counters PKTS BYTES     set the counter during insert/append
[!] --version -V        print package version.

IPP2P v0.7.2 options:
--ipp2p      Grab all known p2p packets
--ipp2p-data Identify all known p2p download commands (obsolete)

--edk        [TCP&UDP] All known eDonkey/eMule/Overnet packets
--dc   [TCP]          All known Direct Connect packets
--kazaa      [TCP&UDP]         All known KaZaA packets
--gnu        [TCP&UDP] All known Gnutella packets
--bit        [TCP&UDP] All known BitTorrent packets
--apple      [TCP]     All known AppleJuice packets (beta - just a few tests until now)
--winmx      [TCP]     All known WinMX (beta - need feedback)
--soul       [TCP]     All known SoulSeek (beta - need feedback!)
--ares       [TCP]     All known Ares - use with DROP only (beta - need feedback!)

--edk-data   [TCP]     eDonkey/eMule/Overnet download commands (obsolete)
--dc-data    [TCP]     Direct Connect download command (obsolete)
--kazaa-data [TCP]     KaZaA download command (obsolete)
--gnu-data   [TCP]     Gnutella download command (obsolete)

Note that the follwing options will have the same meaning:
'--ipp2p' is equal to '--edk --dc --kazaa --gnu'
'--ipp2p-data' is equal to '--edk-data --dc-data --kazaa-data --gnu-data'

IPP2P was intended for TCP only. Due to increasing usage of UDP we needed to change this.
You can now use -p udp to search UDP packets only or without -p switch to search UDP and TCP packets.

See README included with this package for more details or visit http://www.ipp2p.org

Examples:
iptables -A FORWARD -m ipp2p --ipp2p -j MARK --set-mark 0x01
iptables -A FORWARD -p udp -m ipp2p --kazaa --bit -j DROP
iptables -A FORWARD -p tcp -m ipp2p --edk --soul -j DROP

[root@linux ~]# iptables -A FORWARD -m ipp2p --ipp2p -j MARK --set-mark 0x01
iptables: Unknown error 4294967295
[root@linux ~]#  iptables -A FORWARD -p udp -m ipp2p --kazaa --bit -j DROP
iptables: Unknown error 4294967295
[root@linux ~]#  iptables -A FORWARD -p tcp -m ipp2p --edk --soul -j DROP
iptables: Unknown error 4294967295
[root@linux ~]#

请问这些问题出在那里啊
[root@linux ~]# uname -r
2.6.15-1.1830_FC4
[root@linux ~]# iptables -V
iptables v1.3.5
[root@linux ~]#

seamonkey

4294967295这个数字好像很熟，好像是很多文件系统的最大文件限制，即2的32次方-1，就是4G。

murong

Post by seamonkey
4294967295这个数字好像很熟，好像是很多文件系统的最大文件限制，即2的32次方-1，就是4G。

那这个到底是怎么回事啊
iptables -m ipp2p --help可以成功显示信息
但是
modprobe ipt_ipp2p 就是出错了

晨想

把内核重新编译一次。试试。

murong

我编辑的步骤是这样的
我安装的系统是FC4的
然后用yum install kerne 把内核升级成2.6.15-1.1830_FC4
1.
下载最新的内核代码2.6.15和iptables1.3.5,还有iptables补丁
2.
#cd /usr/src
#tar 开所有的包
#ln -s kernel-2.6.15 linux
#ln -s iptables-1.3.5 iptables
3.
#cd /usr/src/linux
#make mrproper
#make menuconfig(什么都不做,保存退出)
4.
#cd patch-o-match-ng-*
#KERNEL_DIR=/usr/src/linux IPTABLES_DIR=/usr/src/iptables ./runme ipp2p
#KERNEL_DIR=/usr/src/linux IPTABLES_DIR=/usr/src/iptables ./runme time
5.
#cd /usr/src/linux
#make menuconfig (选择ipp2p和time模块,其他的默认,保存退出)
#make modules_prepare
#make M=net/ipv4/netfilter
#cp /usr/src/linux/net/ipv4/netfilter ipt_ipp2p.ko /lib/modules/2.6.15-1.1830_FC4/kernel/net/ipv4/netfilter
#cp /usr/src/linux/net/ipv4/netfilter ipt_time.ko /lib/modules/2.6.15-1.1830_FC4/kernel/net/ipv4/netfilter
#chmod +x /lib/modules/2.6.15-1.1830_FC4/kernel/net/ipv4/netfilter/ipt_ipp2p.ko
#chmod +x /lib/modules/2.6.15-1.1830_FC4/kernel/net/ipv4/netfilter/ipt_time.ko
#depmod -a
6.
#cd /usr/src/iptables
#export KERNEL_DIR=/usr/src/linux
#export IPTABLES_DIR=/usr/src/iptables
#make BINDIR=/sbin LIBDIR=/lib MANDIR=/usr/share/man install

完成,现在开始测试:
#iptables --version
iptables-1.3.5
#iptables -nL (正常)
#iptables -t nat --list (正常)
#iptables -m ipp2p --help (正常)
但是输入下面命令时有问题
[root@linux ~]# iptables -A FORWARD -m ipp2p --ipp2p -j MARK --set-mark 0x01
iptables: Unknown error 4294967295
[root@linux ~]#  iptables -A FORWARD -p udp -m ipp2p --kazaa --bit -j DROP
iptables: Unknown error 4294967295
[root@linux ~]#  iptables -A FORWARD -p tcp -m ipp2p --edk --soul -j DROP
iptables: Unknown error 4294967295
[root@linux ~]#

希望高手能够帮帮忙,谢谢!!!!

bend

iptables -A FORWARD -m ipp2p --ipp2p -j MARK --set-mark 0x01
这句我觉得有问题.只有mangle链才可以对包进行标记.
你换成
iptables -t mangle -A FORWARD -m ipp2p --ipp2p -j MARK --set-mark 0x01
试试

晨想

应该没这个问题的吧。至少example里边都是这么写的阿。

blackwhite

amd64 ~ # iptables -A FORWARD -m ipp2p --ipp2p -j MARK --set-mark 0x01
iptables: Unknown error 18446744073709551615
amd64 ~ # iptables -A FORWARD -p udp -m ipp2p --kazaa --bit -j DROP
amd64 ~ # iptables -A FORWARD -p tcp -m ipp2p --edk --soul -j DROP
amd64 ~ #
第一个有问题。下面的没有问题。
我就用下面的这个，没有过滤什么。
  $IPTABLES -A INPUT -m ipp2p --ipp2p -j ACCEPT