I'm trying to get the ipt_time extension for netfilter/iptables to work on CentOS 5.3. It's a bloodbath.
First of all, the HOWTO I linked is the official Netfilter Extension HOWTO, but it's also horribly outdated: so outdated, actually, that not only the CVS repository mentioned here doesn't exist anymore, but the whole project gave up on using CVS long ago; current netfilter/iptables/patch-o-matic releases are to be obtained through GIT (which BTW is not packaged in CentOS, so you have to get it first...).
In order to compile the patch, you need the kernel sources... which really are a lot of fun to install in CentOS. If you by sheer luck and endless frustration manage to get them, you then need to use a silly patching tool called patch-o-matic to apply the patch both to the iptables source (which, of course, you must also download using GIT) and to the kernel.
When this is done, you need to recompile the kernel modules (which now include ipt_time
), and finally you can load this thing.
Then you need to compile and load the iptables extension for managing ipt_time
, libipt_time.so
.
This one just doesn't compile. Looks like there have been some (recent?) API changes in both netfilter and iptables, which broke it.
The questions:
- Is this patch mantained/supported by the developer anymore?
- Is it used at all by anyone?
- Has anyone managed to apply and use it?
- On which kernel/iptables versions does it work?
The rant:
HOW IN THE F**CKING WORLD IS IT POSSIBLE THAT THE MAIN FIREWALL SUBSYSTEM IN THE LINUX KERNEL IS SO LOUSILY MANTAINED THAT THE PROJECT SITE HOSTS LOTS OF INCOMPATIBLE THINGS WITHOUT ANY WARNING AND THE OFFICIAL EXTENSIONS HOWTO JUST DOESN'T BEAR ANY RESEMBLANCE TO REALITY?!?