Add IPtables GeoIP Extension for Country Blocking with Centos 5.5 / PIAF

[kh40s]

These are instructions on how to build all of the necessary RPMs to get the geoip xtables extension working on Centos 5.5 / PIAF. Once these RPMs are built, actual installation is simple. We need to build the kernel source ourselves in order to be able to build xtables addons. A user would typically install the kernel directly from the elrepo repository, and the support for xtables from a set of binary RPMs.

This solution uses the elrepo mainline kernel, which is the current kernel packaged by the ELRepo team expressly for RHEL 5, which as you know is compatible with Centos. The iptables rpm is an almost bog standard Fedora source rpm that is fully compatible with Centos. I have made sure that the init script exactly matches the current /etc/init.d/iptables script. The xtables source RPM is a modified version of a spec file posted on the net, altered in order to get it to build, package, install and run on Centos. The geoip source RPM comes from OpenSUSE and installs the geoip database and download and build scripts to rebuild the database as and when needed.

Instructions for installation follow after the build instructions. Note that if you are building for a different processor architecture than the running kernel, you will need to substitute appropriately for `uname -m`

WARNING: THIS SOLUTION USES A VERY RECENT KERNEL. IT MAY NOT BE APPROPRIATE FOR YOUR INSTALLATION. WHILE THE ELRepo kernel-ml HAS BEEN BUILT BY THE ELRepo TEAM, IT IS NOT THE KERNEL THAT SHIPS WITH CENTOS. USE AT YOUR OWN RISK.

A. BUILDING THE RPMS FROM SOURCE

1. Set up an rpmbuild environment

Follow instructions here: http://wiki.centos.org/HowTos/SetupRpmBuildEnvironment

2. Get the ELRepo kernel-ml source

cd ~/rpmbuild/SRPMS
wget http://elrepo.org/linux/kernel/el5/SRPMS/kernel-ml-2.6.36-1.el5.elrepo.src.rpm
sudo rpm -ivh kernel-ml-2.6.36-1.el5.elrepo.src.rpm

3. Compile and package the mainline kernel

cd ../SPECS
rpmbuild -bb --target=`uname -m` kernel-ml-2.6.36.spec

Go make some tea...

3. Install the kernel

cd ../RPMS/`uname -m`
sudo rpm -ivh kernel-ml-2.6.36-1.`uname -m`.rpm
sudo rpm -ivh kernel-ml-devel-2.6.36-1.`uname -m`.rpm

4. Patch rc.sysinit to fix the system clock issue

See http://elrepo.org/tiki/kernel-ml

--- rc.sysinit.orig     2010-11-30 20:52:47.000000000 +0000
+++ rc.sysinit  2010-11-30 22:08:41.000000000 +0000
@@ -269,6 +269,20 @@
  echo
 fi

+### ELREPO: See if the RTC driver is built-in, otherwise load it
+if [ ! -f /proc/driver/rtc ]; then
+    action $"Loading rtc_cmos driver: " /sbin/modprobe rtc_cmos
+fi
+
+### ELREPO: Make the newer device nodes to accomodate hwclock
+if /bin/grep -q "^251 rtc" /proc/devices; then
+    if [ ! -e /dev/rtc]; then
+        action $"Removing /dev/rtc: " rm -f /dev/rtc
+    fi
+    action $"Creating /dev/rtc0: " /bin/mknod /dev/rtc0 c 251 0
+    action $"Creating /dev/rtc: " /bin/ln -sf /dev/rtc0 /dev/rtc
+fi
+
 # Set the system clock.
 update_boot_stage RCclock
 ARC=0
~

5. Edit /boot/grub/grub.conf

Optionally alter the default kernel to boot

6. Reboot

7. Compile and install dahdi

cd /usr/src/dahdi
sudo make all
sudo make install

8. Download, build and install the repackaged Fedora iptables 1.4.9 rpm

This is fully compatible with Centos 5.5. The init script in the package is the same as the one distributed with Centos 5.5

cd ~/rpmbuild/SRPMS
wget http://web.bethere.co.uk/ic/iptables-1.4.9-1.src.rpm
rpm -ivh iptables-1.4.9-1.src.rpm
cd ../SPECS
rpmbuild -bb --target=`uname -m` iptables.spec
cd ../RPMS/`uname -m`
sudo rpm -Uvh iptables-1.4.9-1.`uname -m`.rpm iptables-ipv6-1.4.9-1.`uname -m`.rpm
sudo rpm -Uvh iptables-devel-1.4.9-1.`uname -m`.rpm

9. Install perl module needed by geoip

sudo yum install perl-Text-CSV_XS

10. Download, build and install xtables-addons

cd ~/rpmbuild/SRPMS
wget http://web.bethere.co.uk/ic/xtables-addons-1.31-1.src.rpm
rpm -ivh xtables-addons-1.31-1.src.rpm
cd ../SPECS
rpmbuild -bb --target=`uname -m` xtables-addons-1.31.spec
cd ../RPMS/`uname -m`
sudo rpm -ivh xtables-addons-1.31-1.`uname -m`.rpm

11. Download, build and install the geoip database

cd ~/rpmbuild/SRPMS
wget http://web.bethere.co.uk/ic/xtables-geoip-2010.11-1.src.rpm
rpm -ivh xtables-geoip-2010.11-1.src.rpm
cd ../SPECS
rpmbuild -bb geoip-xtables.spec
cd ../RPMS/noarch
sudo rpm -ivh xtables-geoip-2010.11-1.noarch.rpm

And voila, you should have a working geoip installation, with the geoip database setup and installed

B. INSTALLING XTABLES-ADDONS FROM BINARY RPMS

Once these binary RPMS are available for the different architectures, a user will need to issue the following set of commands to install support (assuming for illustrative purposes a x86_64 architecture)

cd
wget http://elrepo.org/linux/kernel/el5/x86_64/RPMS/kernel-ml-2.6.36-1.el5.elrepo.x86_64.rpm
rpm -ivh kernel-ml-2.6.36-1.el5.elrepo.x86_64.rpm
wget http://elrepo.org/linux/kernel/el5/x86_64/RPMS/kernel-ml-devel-2.6.36-1.el5.elrepo.x86_64.rpm
rpm -ivh kernel-ml-devel-2.6.36-1.el5.elrepo.x86_64.rpm
cd /etc
patch < rc.sysinit.patch
cd
rpm -Uvh iptables-1.4.9-1.x86_64.rpm iptables-ipv6-1.4.9-1.x86_64.rpm
rpm -Uvh iptables-devel-1.4.9-1.x86_64.rpm
rpm -ivh xtables-addons-1.31-1.x86_64.rpm
rpm -ivh xtables-geoip-2010.11-1.noarch.rpm
reboot

After rebooting, login as root then

cd /usr/src/dahdi
make all
make install
service dahdi start
amportal restart

 

[wardmundy]

Posted by Request

The following is posted at the request of the ElRepo Project Development Team:

I am one of the co-founders of the ELRepo Project http://elrepo.org and the lead of the kernel-ml build team therein.

On December 2nd, 2010, our attention was drawn to a posing in your forum http://pbxinaflash.com/community/th...ry-blocking-with-centos-5-5-piaf.8839/?t=8839 which contains factual inaccuracies.

The errors that require correction are as follows:

1 which is the current kernel packaged by the Centos team expressly for Centos.

2 WHILE THE ELREPO KERNEL HAS BEEN BUILT BY THE CENTOS TEAM

3 Get the Centos mainline kernel source

Please edit that forum posting so that those three areas are corrected to read:

1 which is the current kernel packaged by the ELRepo team expressly for RHEL 5.

2 WHILE THE ELRepo kernel-ml HAS BEEN BUILT BY THE ELRepo TEAM

3 Get the ELRepo kernel-ml source

Please note that:

1 There is no connection between the ELRepo Project and the CentOS Project.

2 CentOS developers were not / are not the builders of the ELRepo Project's kernel-ml packages.

3 The ELRepo Project's kernel-ml packages are built for use with RHEL 5. As the CentOS Project's product attempts to be a 100% binary compatible clone of Red Hat's product, the ELRepo Project's kernel-ml can be used with CentOS 5.

Your earliest attention to this issue will be appreciated.

Alan.

Dr A J Bartlett, Co-founder Administrator, The ELRepo Project.

 

[kh40s]

Corrections made as requested...