debian 6上安裝l7 filter在應用層禁用xunlei

平臺：debian 6 x86_64，在linode裏選擇內核版本2.6.28，l7 filter官網說改版本內核可用
1,準備環境
apt-get update
apt-get upgrade -y
apt-get install -y build-essential libncurses5-dev gcc grub-legacy
2，下載相關安裝包
wget http://download.clearfoundation.com/l7-filter/netfilter-layer7-v2.22.tar.gz
wget http://download.clearfoundation.com/l7-filter/l7-protocols-2009-05-28.tar.gz
wget http://www.netfilter.org/projects/iptables/files/iptables-1.4.21.tar.bz2
wget https://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.28.tar.bz2
3，編譯新內核
tar xvf linux-2.6.28.tar.bz2 -C /usr/src
tar xvf netfilter-layer7-v2.22.tar.gz
cd /usr/src
ln -s linux-2.6.28 linux
cd linux
patch -p1 < /root/netfilter-layer7-v2.22/kernel-2.6.25-2.6.28-layer7-2.22.patch
zcat /proc/config.gz > .config
make oldconfig   #自選提示的新功能和驅動，基本上加上layer7模塊
make menuconfig    #選擇須要增長的模塊
Networking support → Networking Options → Network packet filtering framework → Core Netfilter Configuration
<M>  Netfilter connection tracking support
<M>  "connlimit"  match support
<M>  "conntrack"  connection  match support
<M>  "iprange"  match support
<M>  "mac"  address  match support
<M>  "multiport" Multiple port match support
<M>  "state"  match support
<M>  "layer7" match support
<M>  "string" match support
<M>  "time"  match support
Networking support → Networking Options →Network packet filtering framework → IP Netfilter Configuration
<M> IPv4 connection tracking support (required for NAT)
<M> Full NAT
<M> MASQUERADE target support
<M> NETMAP target support                            
<M> REDIRECT target support
make -j3 bzImage
make -j3 modules
make
make modules_install
make install
ls /boot檢查生成的文件vmlinuz-2.6.28
cd /boot
mkdir grub
cd grub
vi menu.lst
default 0
timeout 5
title           Custom Compiled, kernel 2.6.28
root            (hd0)
kernel          /boot/vmlinuz-2.6.28 root=/dev/xvda ro quite
linode manager裏對profile修改kernel爲pv-grub-x86_64
重啓後驗證
uname -a
4，升級iptables
apt-get remove iptables -y
tar xvf iptables-1.4.21.tar.bz2
cp netfilter-layer7-v2.22/iptables-1.4.3forward-for-kernel-2.6.20forward/libxt_layer7.* /root/iptables-1.4.21/extensions/
cd iptables-1.4.21
./configure --prefix=/usr --with-ksource=/usr/src/linux
make
make install
iptables -V  #查看版本是否正確
iptables -m layer7 --help  #查看幫助信息
5，安裝協議特徵包：
tar xvf l7-protocols-2009-05-28.tar.gz 
cd l7-protocols-2009-05-28
make install 
可查看支持的部分協議：
ls protocols/
6，設置iptables規則
iptables -t mangle -I POSTROUTING -m layer7 --l7proto xunlei -j DROP
iptables -t mangle -I PREROUTING -m layer7 --l7proto edonkey -j DROP
iptables -t mangle -I PREROUTING -m layer7 --l7proto bittorrent -j DROP
7，通過測試，xunlei仍然可用，呵呵
難道迅雷的信息都加密過嗎？小記折騰通過。