海运的博客

通常增加Iptables模块需重新编译内核及Iptables，通过Xtables-Addons安装其支持的模块可免编译安装。
Xtables-Addons支持模块：

build_ACCOUNT=m
build_CHAOS=m
build_CHECKSUM=
build_DELUDE=m
build_DHCPMAC=m
build_DNETMAP=m
build_ECHO=
build_IPMARK=m
build_LOGMARK=m
build_RAWNAT=m
build_STEAL=m
build_SYSRQ=m
build_TARPIT=m
build_TEE=
build_condition=m
build_fuzzy=m
build_geoip=m
build_gradm=m
build_iface=m
build_ipp2p=m
build_ipset4=m
build_ipset6=
build_ipv4options=m
build_length2=m
build_lscan=m
build_pknock=m
build_psd=m
build_quota2=m

Xtables-Addons安装要求：

iptables >= 1.4.3
kernel-source >= 2.6.29

CentOS安装支持组件：

rpm -ivh http://mirrors.ustc.edu.cn/fedora/epel/6/i386/epel-release-6-7.noarch.rpm
yum install gcc gcc-c++ make automake kernel-devel iptables-devel perl-Text-CSV_XS xz

安装Xtables-Addons：

wget http://sourceforge.net/projects/xtables-addons/files/Xtables-addons/1.42/xtables-addons-1.42.tar.xz
xz -d xtables-addons-1.42.tar.xz 
tar xvf xtables-addons-1.42.tar 
cd xtables-addons-1.42
./configure 
make 
make install
#可修改mconfig选择要安装的模块

下载Geoip数据库：

cd geoip
./xt_geoip_dl
./xt_geoip_build GeoIPCountryWhois.csv
mkdir /usr/share/xt_geoip
cp -r {BE,LE}  /usr/share/xt_geoip/

应用举例：

iptables -I INPUT -m geoip --src-cc US-j DROP
#拒绝美国IP连接