Jun 082016
 

Here is how you can compile and install xtables-addons on CentOS 7.
first, Install Dependencies:

# yum install gcc gcc-c++ make automake unzip zip xz kernel-devel-`uname -r` wget unzip iptables-devel perl-Text-CSV_XS

download xtables-addons

# wget http://ufpr.dl.sourceforge.net/project/xtables-addons/Xtables-addons/xtables-addons-2.10.tar.xz

extract, compile and install

# tar -xJf xtables-addons-2.10.tar.xz
# cd xtables-addons-2.10
# configure
# make && make install

done!

and now for example we want to use geoip module, first of all install geoip database for xtables-addons.
still from xtables-addons-2.10 directory.

# cd geoip
# ./xt_geoip_dl
# ./xt_geoip_build GeoIPCountryWhois.csv
# mkdir -p /usr/share/xt_geoip
# cp -r {BE,LE} /usr/share/xt_geoip
# modprobe xt_geoip

if you want only allow ssh connection from certain country(ie. ID) and drop the rest here’s how to do it.

# iptables -I INPUT -p tcp --dport 22 -m geoip ! --src-cc ID -j DROP

  5 Responses to “CentOS 7, how to install xtables-addons”

Comments (5)
  1. Hi, thanks for your tutorial.
    Unfortunately, when i run make && install, i got lots of errors, like:

    /xtables-addons-2.10/extensions/xt_TARPIT.c: In function ‘tarpit_tcp4’:
    /xtables-addons-2.10/extensions/xt_TARPIT.c:295:3: warning: passing argument 3 of ‘NF_HOOK’ from incompatible pointer type [enabled by default]
    [….]
    make[4]: *** [/tmp/xtables-addons-2.10/extensions/xt_TARPIT.o] Error 1
    make[3]: *** [_module_/tmp/xtables-addons-2.10/extensions] Error 2
    make[3]: Leaving directory `/usr/src/kernels/3.10.0-327.36.1.el7.x86_64′
    make[2]: *** [modules] Error 2
    make[2]: Leaving directory `/tmp/xtables-addons-2.10/extensions’
    make[1]: *** [all-recursive] Error 1
    make[1]: Leaving directory `/tmp/xtables-addons-2.10′
    make: *** [all] Error 2

    any clue how to get this working?

  2. Its working, just the tarpit module faulty, as you see in the error log.
    Just comment out this two line:

    extension/Kbuild
    obj-${build_TARPIT} += xt_TARPIT.o

    extension/Mbuild
    obj-${build_TARPIT} += libxt_TARPIT.so

    It will compile and will work without the tarpit module. Its barely used anyway. The most important module the geoip will work fine.

  3. me too:

    /root/xtables-addons-2.11/extensions/xt_TARPIT.c: En la función ‘tarpit_tcp4’:
    /root/xtables-addons-2.11/extensions/xt_TARPIT.c:295:3: aviso: se pasa el argumento 3 de ‘NF_HOOK’ desde un tipo de puntero incompatible [activado por defecto]
    skb_dst(nskb)->dev, dst_output);
    ^
    In file included from include/uapi/linux/netfilter_ipv6.h:11:0,
    from include/linux/netfilter_ipv6.h:10,
    from /root/xtables-addons-2.11/extensions/xt_TARPIT.c:45:
    include/linux/netfilter.h:245:1: nota: se esperaba ‘struct sock *’ pero el argumento es de tipo ‘struct sk_buff *’
    NF_HOOK(uint8_t pf, unsigned int hook, struct sock *sk, struct sk_buff *skb,
    ^
    /root/xtables-addons-2.11/extensions/xt_TARPIT.c:295:3: aviso: se pasa el argumento 6 de ‘NF_HOOK’ desde un tipo de puntero incompatible [activado por defecto]
    skb_dst(nskb)->dev, dst_output);
    ^
    In file included from include/uapi/linux/netfilter_ipv6.h:11:0,
    from include/linux/netfilter_ipv6.h:10,
    from /root/xtables-addons-2.11/extensions/xt_TARPIT.c:45:
    include/linux/netfilter.h:245:1: nota: se esperaba ‘struct net_device *’ pero el argumento es de tipo ‘int (*)(struct sk_buff *)’
    NF_HOOK(uint8_t pf, unsigned int hook, struct sock *sk, struct sk_buff *skb,
    ^
    /root/xtables-addons-2.11/extensions/xt_TARPIT.c:295:3: error: faltan argumentos para la función ‘NF_HOOK’
    skb_dst(nskb)->dev, dst_output);
    ^
    In file included from include/uapi/linux/netfilter_ipv6.h:11:0,
    from include/linux/netfilter_ipv6.h:10,
    from /root/xtables-addons-2.11/extensions/xt_TARPIT.c:45:
    include/linux/netfilter.h:245:1: nota: se declara aquí
    NF_HOOK(uint8_t pf, unsigned int hook, struct sock *sk, struct sk_buff *skb,
    ^
    /root/xtables-addons-2.11/extensions/xt_TARPIT.c: En la función ‘tarpit_tcp6’:
    /root/xtables-addons-2.11/extensions/xt_TARPIT.c:418:10: aviso: se pasa el argumento 3 de ‘NF_HOOK’ desde un tipo de puntero incompatible [activado por defecto]
    skb_dst(nskb)->dev, dst_output);
    ^
    In file included from include/uapi/linux/netfilter_ipv6.h:11:0,
    from include/linux/netfilter_ipv6.h:10,
    from /root/xtables-addons-2.11/extensions/xt_TARPIT.c:45:
    include/linux/netfilter.h:245:1: nota: se esperaba ‘struct sock *’ pero el argumento es de tipo ‘struct sk_buff *’
    NF_HOOK(uint8_t pf, unsigned int hook, struct sock *sk, struct sk_buff *skb,
    ^
    /root/xtables-addons-2.11/extensions/xt_TARPIT.c:418:10: aviso: se pasa el argumento 6 de ‘NF_HOOK’ desde un tipo de puntero incompatible [activado por defecto]
    skb_dst(nskb)->dev, dst_output);
    ^
    In file included from include/uapi/linux/netfilter_ipv6.h:11:0,
    from include/linux/netfilter_ipv6.h:10,
    from /root/xtables-addons-2.11/extensions/xt_TARPIT.c:45:
    include/linux/netfilter.h:245:1: nota: se esperaba ‘struct net_device *’ pero el argumento es de tipo ‘int (*)(struct sk_buff *)’
    NF_HOOK(uint8_t pf, unsigned int hook, struct sock *sk, struct sk_buff *skb,
    ^
    /root/xtables-addons-2.11/extensions/xt_TARPIT.c:418:10: error: faltan argumentos para la función ‘NF_HOOK’
    skb_dst(nskb)->dev, dst_output);
    ^
    In file included from include/uapi/linux/netfilter_ipv6.h:11:0,
    from include/linux/netfilter_ipv6.h:10,
    from /root/xtables-addons-2.11/extensions/xt_TARPIT.c:45:
    include/linux/netfilter.h:245:1: nota: se declara aquí
    NF_HOOK(uint8_t pf, unsigned int hook, struct sock *sk, struct sk_buff *skb,
    ^
    make[4]: *** [/root/xtables-addons-2.11/extensions/xt_TARPIT.o] Error 1
    make[3]: *** [_module_/root/xtables-addons-2.11/extensions] Error 2
    make[3]: se sale del directorio `/usr/src/kernels/3.10.0-327.36.2.el7.x86_64′
    make[2]: *** [modules] Error 2
    make[2]: se sale del directorio `/root/xtables-addons-2.11/extensions’
    make[1]: *** [all-recursive] Error 1
    make[1]: se sale del directorio `/root/xtables-addons-2.11′
    make: *** [all] Error 2

  4. what is your kernel version?

  5. Here’s a little patch for this:
    diff -Nur xtables-addons-2.6/extensions/xt_TARPIT.c xtables-addons-2.6.mod/extensions/xt_TARPIT.c
    — xtables-addons-2.6/extensions/xt_TARPIT.c 2014-09-29 05:33:13.000000000 -0300
    +++ xtables-addons-2.6.mod/extensions/xt_TARPIT.c 2017-09-18 12:00:37.920029414 -0300
    @@ -279,8 +279,8 @@

    nf_ct_attach(nskb, oldskb);

    – NF_HOOK(NFPROTO_IPV4, NF_INET_LOCAL_OUT, nskb, NULL,
    – skb_dst(nskb)->dev, dst_output);
    + NF_HOOK(NFPROTO_IPV4, NF_INET_LOCAL_OUT, nskb->sk, nskb, NULL,
    + skb_dst(nskb)->dev, dst_output_sk);
    return;

    free_nskb:
    @@ -394,8 +394,8 @@

    nf_ct_attach(nskb, oldskb);

    – NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT, nskb, NULL,
    – skb_dst(nskb)->dev, dst_output);
    + NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT, nskb->sk, nskb, NULL,
    + skb_dst(nskb)->dev, dst_output_sk);
    return;

    free_nskb:

 Leave a Reply

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>

(required)

(required)

*

This site uses Akismet to reduce spam. Learn how your comment data is processed.