1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.
  2. If you had a PIAF Forum account in the vBulletin days, log in with your old credentials. Otherwise, sign up again and we'll get you back in business as soon as we can.
  3. A serious FreePBX vulnerability has been reported. Update your Framework Module immediately. Click here for details.

Add IPtables GeoIP Extension for Country Blocking with Centos 5.5 / PIAF

Discussion in 'Add-On Install Instructions' started by kh40s, Dec 1, 2010.

  1. kh40s Guru

    These are instructions on how to build all of the necessary RPMs to get the geoip xtables extension working on Centos 5.5 / PIAF. Once these RPMs are built, actual installation is simple. We need to build the kernel source ourselves in order to be able to build xtables addons. A user would typically install the kernel directly from the elrepo repository, and the support for xtables from a set of binary RPMs.

    This solution uses the elrepo mainline kernel, which is the current kernel packaged by the ELRepo team expressly for RHEL 5, which as you know is compatible with Centos. The iptables rpm is an almost bog standard Fedora source rpm that is fully compatible with Centos. I have made sure that the init script exactly matches the current /etc/init.d/iptables script. The xtables source RPM is a modified version of a spec file posted on the net, altered in order to get it to build, package, install and run on Centos. The geoip source RPM comes from OpenSUSE and installs the geoip database and download and build scripts to rebuild the database as and when needed.

    Instructions for installation follow after the build instructions. Note that if you are building for a different processor architecture than the running kernel, you will need to substitute appropriately for `uname -m`

    WARNING: THIS SOLUTION USES A VERY RECENT KERNEL. IT MAY NOT BE APPROPRIATE FOR YOUR INSTALLATION. WHILE THE ELRepo kernel-ml HAS BEEN BUILT BY THE ELRepo TEAM, IT IS NOT THE KERNEL THAT SHIPS WITH CENTOS. USE AT YOUR OWN RISK.

    A. BUILDING THE RPMS FROM SOURCE

    1. Set up an rpmbuild environment

    Follow instructions here: http://wiki.centos.org/HowTos/SetupRpmBuildEnvironment

    2. Get the ELRepo kernel-ml source

    Code:
    
    cd ~/rpmbuild/SRPMS
    wget http://elrepo.org/linux/kernel/el5/SRPMS/kernel-ml-2.6.36-1.el5.elrepo.src.rpm
    sudo rpm -ivh kernel-ml-2.6.36-1.el5.elrepo.src.rpm 
    
    
    3. Compile and package the mainline kernel

    Code:
    
    cd ../SPECS
    rpmbuild -bb --target=`uname -m` kernel-ml-2.6.36.spec
    
    
    Go make some tea...

    3. Install the kernel

    Code:
    
    cd ../RPMS/`uname -m`
    sudo rpm -ivh kernel-ml-2.6.36-1.`uname -m`.rpm
    sudo rpm -ivh kernel-ml-devel-2.6.36-1.`uname -m`.rpm
    
    
    4. Patch rc.sysinit to fix the system clock issue

    See http://elrepo.org/tiki/kernel-ml

    Code:
    
    --- rc.sysinit.orig     2010-11-30 20:52:47.000000000 +0000
    +++ rc.sysinit  2010-11-30 22:08:41.000000000 +0000
    @@ -269,6 +269,20 @@
      echo
     fi
    
    +### ELREPO: See if the RTC driver is built-in, otherwise load it
    +if [ ! -f /proc/driver/rtc ]; then
    +    action $"Loading rtc_cmos driver: " /sbin/modprobe rtc_cmos
    +fi
    +
    +### ELREPO: Make the newer device nodes to accomodate hwclock
    +if /bin/grep -q "^251 rtc" /proc/devices; then
    +    if [ ! -e /dev/rtc]; then
    +        action $"Removing /dev/rtc: " rm -f /dev/rtc
    +    fi
    +    action $"Creating /dev/rtc0: " /bin/mknod /dev/rtc0 c 251 0
    +    action $"Creating /dev/rtc: " /bin/ln -sf /dev/rtc0 /dev/rtc
    +fi
    +
     # Set the system clock.
     update_boot_stage RCclock
     ARC=0
    ~  
    
    
    5. Edit /boot/grub/grub.conf

    Optionally alter the default kernel to boot

    6. Reboot

    7. Compile and install dahdi

    Code:
    
    cd /usr/src/dahdi
    sudo make all
    sudo make install
    
    
    8. Download, build and install the repackaged Fedora iptables 1.4.9 rpm

    This is fully compatible with Centos 5.5. The init script in the package is the same as the one distributed with Centos 5.5

    Code:
    
    cd ~/rpmbuild/SRPMS
    wget http://web.bethere.co.uk/ic/iptables-1.4.9-1.src.rpm
    rpm -ivh iptables-1.4.9-1.src.rpm
    cd ../SPECS
    rpmbuild -bb --target=`uname -m` iptables.spec
    cd ../RPMS/`uname -m`
    sudo rpm -Uvh iptables-1.4.9-1.`uname -m`.rpm iptables-ipv6-1.4.9-1.`uname -m`.rpm
    sudo rpm -Uvh iptables-devel-1.4.9-1.`uname -m`.rpm
    
    
    9. Install perl module needed by geoip

    Code:
    
    sudo yum install perl-Text-CSV_XS
    
    
    10. Download, build and install xtables-addons

    Code:
    
    cd ~/rpmbuild/SRPMS
    wget http://web.bethere.co.uk/ic/xtables-addons-1.31-1.src.rpm
    rpm -ivh xtables-addons-1.31-1.src.rpm
    cd ../SPECS
    rpmbuild -bb --target=`uname -m` xtables-addons-1.31.spec
    cd ../RPMS/`uname -m`
    sudo rpm -ivh xtables-addons-1.31-1.`uname -m`.rpm
    
    
    11. Download, build and install the geoip database

    Code:
    
    cd ~/rpmbuild/SRPMS
    wget http://web.bethere.co.uk/ic/xtables-geoip-2010.11-1.src.rpm
    rpm -ivh xtables-geoip-2010.11-1.src.rpm
    cd ../SPECS
    rpmbuild -bb geoip-xtables.spec
    cd ../RPMS/noarch
    sudo rpm -ivh xtables-geoip-2010.11-1.noarch.rpm
    
    
    And voila, you should have a working geoip installation, with the geoip database setup and installed

    B. INSTALLING XTABLES-ADDONS FROM BINARY RPMS

    Once these binary RPMS are available for the different architectures, a user will need to issue the following set of commands to install support (assuming for illustrative purposes a x86_64 architecture)

    Code:
    
    cd
    wget http://elrepo.org/linux/kernel/el5/x86_64/RPMS/kernel-ml-2.6.36-1.el5.elrepo.x86_64.rpm
    rpm -ivh kernel-ml-2.6.36-1.el5.elrepo.x86_64.rpm
    wget http://elrepo.org/linux/kernel/el5/x86_64/RPMS/kernel-ml-devel-2.6.36-1.el5.elrepo.x86_64.rpm
    rpm -ivh kernel-ml-devel-2.6.36-1.el5.elrepo.x86_64.rpm
    cd /etc
    patch < rc.sysinit.patch
    cd
    rpm -Uvh iptables-1.4.9-1.x86_64.rpm iptables-ipv6-1.4.9-1.x86_64.rpm
    rpm -Uvh iptables-devel-1.4.9-1.x86_64.rpm
    rpm -ivh xtables-addons-1.31-1.x86_64.rpm
    rpm -ivh xtables-geoip-2010.11-1.noarch.rpm
    reboot
    
    
    After rebooting, login as root then

    Code:
    
    cd /usr/src/dahdi
    make all
    make install
    service dahdi start
    amportal restart
    
    
  2. wardmundy Nerd Uno

    Posted by Request

    The following is posted at the request of the ElRepo Project Development Team:

  3. kh40s Guru

    Corrections made as requested...

Share This Page