Skip to main content

Ubuntu 20 启用 iptables fullconenat

安装编译所需依赖程序​

  • 安装依赖程序

    apt install git gcc autoconf autogen libtool pkg-config libgmp3-dev build-essential autoconf bison flex libnftnl-dev libmnl-dev -y

  • 安装内核头文件

    apt install linux-headers-$(uname -r)

克隆程序源码并进行编译​

  • 创建目录并克隆源码

    mkdir /tmp/fullcone
    cd /tmp/fullcone
    git clone git://git.netfilter.org/libmnl
    git clone git://git.netfilter.org/libnftnl.git
    git clone  git://git.netfilter.org/iptables.git
    git clone https://github.com/Chion82/netfilter-full-cone-nat.git

  • 编译libmnl

    cd /tmp/fullcone/libmnl
    sh autogen.sh
    ./configure
    make
    make install

  • 编译libnftnl

    cd /tmp/fullcone/libnftnl
    sh autogen.sh
    ./configure
    make
    make install

  • 编译并临时启用netfilter-full-cone-nat

    cd /tmp/fullcone/netfilter-full-cone-nat
    make
    modprobe nf_nat
    insmod xt_FULLCONENAT.ko

  • 编译并替换iptables

    cd /tmp/fullcone/iptables
    git checkout 54c262605c54a18a1c30cd41d47decaca5e7182e
    cp /tmp/fullcone/netfilter-full-cone-nat/libipt_FULLCONENAT.c /tmp/fullcone/iptables/extensions/
    ./autogen.sh
    ./configure
    make
    make install

    cp /usr/local/sbin/iptables /sbin/ 
    cp /usr/local/sbin/iptables-restore /sbin/
    cp /usr/local/sbin/iptables-save /sbin/

检测结果​

  • 检查xt_FULLCONENAT模块是否已加载

    lsmod | grep xt_FULLCONENAT

  • 测试fullconenat是否能正常使用

    iptables -A POSTROUTING -t nat -o eth0 -j FULLCONENAT
    iptables -D POSTROUTING -t nat -o eth0 -j FULLCONENAT

配置开机自动加载模块​

  • 在/etc/modules-load.d/fullconenat.conf文件中添加相关内容
    echo "xt_FULLCONENAT" >> /etc/modules-load.d/fullconenat.conf
  • 复制相关库文件到指定目录
    mv /tmp/fullcone/netfilter-full-cone-nat/xt_FULLCONENAT.ko  /lib/modules/$(uname -r)/