|
Packit |
99347c |
This is the ipset source tree. Follow the next steps to install ipset.
|
|
Packit |
99347c |
If you upgrade from an earlier 5.x release, please read the UPGRADE
|
|
Packit |
99347c |
instructions too.
|
|
Packit |
99347c |
|
|
Packit |
99347c |
0. You need the source tree of your kernel (version >= 2.6.32)
|
|
Packit |
99347c |
and it have to be configured with ip6tables support enabled,
|
|
Packit |
99347c |
modules compiled. For kernel versions < 2.6.39 please apply
|
|
Packit |
99347c |
the netlink.patch against your kernel tree, which adds the
|
|
Packit |
99347c |
new subsystem identifier for ipset.
|
|
Packit |
99347c |
|
|
Packit |
99347c |
Recompile and install the patched kernel and its modules. Please note,
|
|
Packit |
99347c |
you have to run the patched kernel for ipset to work.
|
|
Packit |
99347c |
|
|
Packit |
99347c |
The ipset source code depends on the libmnl library so the library
|
|
Packit |
99347c |
must be installed. You can download the libmnl library from
|
|
Packit |
99347c |
|
|
Packit |
99347c |
git://git.netfilter.org/libmnl.git
|
|
Packit |
99347c |
|
|
Packit |
99347c |
1. Initialize the compiling environment for ipset. The packages automake,
|
|
Packit |
99347c |
autoconf, pkg-config and libtool are required.
|
|
Packit |
99347c |
|
|
Packit |
99347c |
% ./autogen.sh
|
|
Packit |
99347c |
|
|
Packit |
99347c |
2. Run `./configure` and then compile the ipset binary and the kernel
|
|
Packit |
99347c |
modules.
|
|
Packit |
99347c |
|
|
Packit |
99347c |
Configure parameters can be used to to override the default path
|
|
Packit |
99347c |
to the kernel source tree (/lib/modules/`uname -r`/build),
|
|
Packit |
99347c |
the maximum number of sets (256), the default hash sizes (1024).
|
|
Packit |
99347c |
See `./configure --help`.
|
|
Packit |
99347c |
|
|
Packit |
99347c |
% ./configure
|
|
Packit |
99347c |
% make
|
|
Packit |
99347c |
% make modules
|
|
Packit |
99347c |
|
|
Packit |
99347c |
3. Install the binary and the kernel modules
|
|
Packit |
99347c |
|
|
Packit |
99347c |
# make install
|
|
Packit |
99347c |
# make modules_install
|
|
Packit |
99347c |
|
|
Packit |
99347c |
After installing the modules, you can run the testsuite as well.
|
|
Packit |
99347c |
Please note, several assumptions must be met for the testsuite:
|
|
Packit |
99347c |
|
|
Packit |
99347c |
- no sets defined
|
|
Packit |
99347c |
- iptables/ip6tables rules are not set up
|
|
Packit |
99347c |
- the destination for kernel logs is /var/log/kern.log
|
|
Packit |
99347c |
- the networks 10.255.255.0/24 and 1002:1002:1002:1002::/64
|
|
Packit |
99347c |
are not in use
|
|
Packit |
99347c |
- sendip utility is installed
|
|
Packit |
99347c |
|
|
Packit |
99347c |
# make tests
|
|
Packit |
99347c |
|
|
Packit |
99347c |
4. Cleanup the source tree
|
|
Packit |
99347c |
|
|
Packit |
99347c |
% make clean
|
|
Packit |
99347c |
% make modules_clean
|
|
Packit |
99347c |
|
|
Packit |
99347c |
That's it!
|
|
Packit |
99347c |
|
|
Packit |
99347c |
Read the ipset(8) and iptables(8), ip6tables(8) manpages on how to use
|
|
Packit |
99347c |
ipset and its match and target from iptables.
|
|
Packit |
99347c |
|
|
Packit |
99347c |
Compatibilities and incompatibilities:
|
|
Packit |
99347c |
|
|
Packit |
99347c |
- The ipset 6.x userspace utility contains a backward compatibility
|
|
Packit |
99347c |
interface to support the commandline syntax of ipset 4.x.
|
|
Packit |
99347c |
The commandline syntax of ipset 6.x is fully compatible with 5.x.
|
|
Packit |
99347c |
- The ipset 6.x userspace utility can't talk to the kernel part of ipset 5.x
|
|
Packit |
99347c |
or 4.x.
|
|
Packit |
99347c |
- The ipset 6.x kernel part can't talk to the userspace utility from
|
|
Packit |
99347c |
ipset 5.x or 4.x.
|
|
Packit |
99347c |
- The ipset 6.x kernel part can work together with the set match and SET
|
|
Packit |
99347c |
target from iptables 1.4.7 and below, however if you need the IPv6 support
|
|
Packit |
99347c |
from ipset 6.x, then you have to use iptables 1.4.9 or above.
|
|
Packit |
99347c |
|
|
Packit |
99347c |
The ipset 6.x can interpret the commandline syntax of ipset 4.x, however
|
|
Packit |
99347c |
some internal changes mean different behaviour:
|
|
Packit |
99347c |
|
|
Packit |
99347c |
- The "--matchunset" flag for the macipmap type is ignored and not used
|
|
Packit |
99347c |
anymore.
|
|
Packit |
99347c |
- The "--probes" and "--resize" parameters of the hash types are ignored
|
|
Packit |
99347c |
and not used anymore.
|
|
Packit |
99347c |
- The "--from", "--to" and "--network" parameters of the ipporthash,
|
|
Packit |
99347c |
ipportiphash and ipportnethash types are ignored and not used anymore.
|
|
Packit |
99347c |
- The hash types are not resized when new entries are added by the SET
|
|
Packit |
99347c |
target. If you use a set together with the SET target, create it with
|
|
Packit |
99347c |
the proper size because it won't be resized automatically.
|
|
Packit |
99347c |
- The iptree, iptreemap types are not implemented in ipset 6.x. The types
|
|
Packit |
99347c |
are automatically substituted with the hash:ip type.
|