How to build iptables extensions

[michael249478]

Hi

Someone could help me, for building an iptables extension on asusmerlin firmware ?

I downloaded firmware source and the toolchain (via docker), i am able to build the firmware with thoses commands:

source /home/docker/envs/bcm-hnd-ax-4.19.sh
cd /build/release/src-rt-5.04axhnd.675x/
make gt-*****

I want to include an additionnel iptables module in the firmware .

i see ".h" and ".c" files those location
/build/release/src-rt-5.04axhnd.675x/kernel/linux-4.19/net/netfilter/xt_rateest.c and /build/var/lib/docker/volumes/asusmerlin/release/src-rt-5.04axhnd.675x/kernel/linux-4.19/include/net/netfilter/xt_rateest.h.

but how to tell make command to build those modules ?

Thanks in advance for help

Best regards

 

[dave14305]

Look for RATEEST in the kernel config.base file for your model of router. Example (where it is disabled/commented out):

asuswrt-merlin.ng/release/src-rt-5.04axhnd.675x/kernel/linux-4.19/config_base.6a.4912 at 3006.102-wifi6 · RMerl/asuswrt-merlin.ng

Third party firmware for Asus routers (newer codebase) - RMerl/asuswrt-merlin.ng

github.com

 

[michael249478]

Thanks very much for the help.
I succefully build this netfilter module.

But the module is in .so format (i think user space module)
When i try to measure interface bandwitch with netfilter, i see only some Kb traffic while i download at 1 Gbps (pehaps, because the rateest module is build, for user space .so)

It's a way to create a .ko module to have a kernel space module ?

Best Regards

 

[dave14305]

When i try to measure interface bandwitch with netfilter, i see only some Kb traffic while i download at 1 Gbps

It probably demonstrates how HW acceleration is bypassing netfilter after the initial connection processing.