ReadyNasOs 6.0.x Kernel, module compilation for iptables

[fflash]

Hello,

I have a Ultra2 Nas under ReadyNas OS 6.0.8. I would like to compile some specific kernel modules required by iptable as they are not available in the OS. However all the tutorials I found are for 4.x.x version and I'm unable to find the kernel folder in the GLP source files of the 6.0.8 OS available here: http://www.downloads.netgear.com/files/GPL/ReadyNASOS_V6.0.8_WW_src.zip

Does someone can help me or is there a tutorial somewhere for the 6.0.x OS for kernel/module compilation ?

Thank you.

[mdgm-ntgr]

The folder for the kernel is the linux-3.0.79 folder.

Welcome to the forum!

[fflash]

I took a look for a linux folder, but I missed it...

Thank you.

[fflash]

Hello, so after some trying I was unable to make iptables modules working. What I did:

Download ReadyNasOS 6.0.8 at http://www.downloads.netgear.com/files/GPL/ReadyNASOS_V6.0.8_WW_src.zip
Unzip in /home/admin/readynasos
Symlink /usr/src/linux to /home/admin/readynasos (I don't really know what is for ?)
Then move to the /usr/src/linux/linux-3.0.79/ (I just see that maybe the symlink /usr/src/linux should point on the linux-3.0.79 folder and not readynasos... ?)
Recompile the clean downloaded kernel (read somewhere that it could be require):

#> make oldconfig
#> make all

Select the modules:

#> make menuconfig

I choose the iptable and pppt modules and compiled modules

#> make modules
#> make modules_install

Also with depmod -a, I read that make modules_install could fail sometime.

#> depmod -a

If I do lsmod, I get only:

Module                  Size  Used by    Tainted: P  
pvgpio                 11624  0 
vpd                    10344  0 

But with modprobe -l:

kernel/net/xfrm/xfrm_ipcomp.ko
kernel/net/netfilter/xt_u32.ko
kernel/net/netfilter/xt_time.ko
kernel/net/netfilter/xt_tcpmss.ko
kernel/net/netfilter/xt_string.ko
kernel/net/netfilter/xt_statistic.ko
kernel/net/netfilter/xt_state.ko
kernel/net/netfilter/xt_sctp.ko
kernel/net/netfilter/xt_recent.ko
kernel/net/netfilter/xt_realm.ko
kernel/net/netfilter/xt_rateest.ko
kernel/net/netfilter/xt_quota.ko
kernel/net/netfilter/xt_policy.ko
kernel/net/netfilter/xt_pkttype.ko
kernel/net/netfilter/xt_physdev.ko
kernel/net/netfilter/xt_owner.ko
kernel/net/netfilter/xt_osf.ko
kernel/net/netfilter/xt_multiport.ko
kernel/net/netfilter/xt_mark.ko
kernel/net/netfilter/xt_mac.ko
kernel/net/netfilter/xt_limit.ko
kernel/net/netfilter/xt_length.ko
kernel/net/netfilter/xt_iprange.ko
kernel/net/netfilter/xt_hl.ko
kernel/net/netfilter/xt_helper.ko
kernel/net/netfilter/xt_hashlimit.ko
kernel/net/netfilter/xt_esp.ko
kernel/net/netfilter/xt_dscp.ko
kernel/net/netfilter/xt_devgroup.ko
kernel/net/netfilter/xt_dccp.ko
kernel/net/netfilter/xt_cpu.ko
kernel/net/netfilter/xt_conntrack.ko
kernel/net/netfilter/xt_connmark.ko
kernel/net/netfilter/xt_connlimit.ko
kernel/net/netfilter/xt_connbytes.ko
kernel/net/netfilter/xt_comment.ko
kernel/net/netfilter/xt_cluster.ko
kernel/net/netfilter/xt_addrtype.ko
kernel/net/netfilter/xt_TEE.ko
kernel/net/netfilter/xt_TCPMSS.ko
kernel/net/netfilter/xt_RATEEST.ko
kernel/net/netfilter/xt_NFQUEUE.ko
kernel/net/netfilter/xt_NFLOG.ko
kernel/net/netfilter/xt_IDLETIMER.ko
kernel/net/netfilter/xt_HL.ko
kernel/net/netfilter/xt_CLASSIFY.ko
kernel/net/netfilter/nfnetlink_queue.ko
kernel/net/netfilter/nfnetlink_log.ko
kernel/net/netfilter/nfnetlink.ko
kernel/net/netfilter/nf_conntrack_tftp.ko
kernel/net/netfilter/nf_conntrack_snmp.ko
kernel/net/netfilter/nf_conntrack_sip.ko
kernel/net/netfilter/nf_conntrack_sane.ko
kernel/net/netfilter/nf_conntrack_proto_udplite.ko
kernel/net/netfilter/nf_conntrack_proto_sctp.ko
kernel/net/netfilter/nf_conntrack_proto_gre.ko
kernel/net/netfilter/nf_conntrack_proto_dccp.ko
kernel/net/netfilter/nf_conntrack_pptp.ko
kernel/net/netfilter/nf_conntrack_netlink.ko
kernel/net/netfilter/nf_conntrack_netbios_ns.ko
kernel/net/netfilter/nf_conntrack_irc.ko
kernel/net/netfilter/nf_conntrack_h323.ko
kernel/net/netfilter/nf_conntrack_ftp.ko
kernel/net/netfilter/nf_conntrack_broadcast.ko
kernel/net/netfilter/nf_conntrack_amanda.ko
kernel/net/netfilter/nf_conntrack.ko
kernel/net/netfilter/ipset/ip_set_list_set.ko
kernel/net/netfilter/ipset/ip_set_hash_netport.ko
kernel/net/netfilter/ipset/ip_set_hash_net.ko
kernel/net/netfilter/ipset/ip_set_hash_ipportnet.ko
kernel/net/netfilter/ipset/ip_set_hash_ipportip.ko
kernel/net/netfilter/ipset/ip_set_hash_ipport.ko
kernel/net/netfilter/ipset/ip_set_hash_ip.ko
kernel/net/netfilter/ipset/ip_set_bitmap_port.ko
kernel/net/netfilter/ipset/ip_set_bitmap_ipmac.ko
kernel/net/netfilter/ipset/ip_set_bitmap_ip.ko
kernel/net/netfilter/ipset/ip_set.ko
kernel/net/llc/llc.ko
kernel/net/ipv6/netfilter/nf_defrag_ipv6.ko
kernel/net/ipv6/netfilter/nf_conntrack_ipv6.ko
kernel/net/ipv6/netfilter/ip6table_security.ko
kernel/net/ipv6/netfilter/ip6table_raw.ko
kernel/net/ipv6/netfilter/ip6table_mangle.ko
kernel/net/ipv6/netfilter/ip6table_filter.ko
kernel/net/ipv6/netfilter/ip6t_rt.ko
kernel/net/ipv6/netfilter/ip6t_mh.ko
kernel/net/ipv6/netfilter/ip6t_ipv6header.ko
kernel/net/ipv6/netfilter/ip6t_hbh.ko
kernel/net/ipv6/netfilter/ip6t_frag.ko
kernel/net/ipv6/netfilter/ip6t_eui64.ko
kernel/net/ipv6/netfilter/ip6t_ah.ko
kernel/net/ipv6/netfilter/ip6t_REJECT.ko
kernel/net/ipv6/netfilter/ip6t_LOG.ko
kernel/net/ipv6/netfilter/ip6_tables.ko
kernel/net/ipv4/xfrm4_tunnel.ko
kernel/net/ipv4/xfrm4_mode_tunnel.ko
kernel/net/ipv4/xfrm4_mode_transport.ko
kernel/net/ipv4/xfrm4_mode_beet.ko
kernel/net/ipv4/tunnel4.ko
kernel/net/ipv4/netfilter/nf_nat_tftp.ko
kernel/net/ipv4/netfilter/nf_nat_snmp_basic.ko
kernel/net/ipv4/netfilter/nf_nat_sip.ko
kernel/net/ipv4/netfilter/nf_nat_proto_udplite.ko
kernel/net/ipv4/netfilter/nf_nat_proto_sctp.ko
kernel/net/ipv4/netfilter/nf_nat_proto_gre.ko
kernel/net/ipv4/netfilter/nf_nat_proto_dccp.ko
kernel/net/ipv4/netfilter/nf_nat_pptp.ko
kernel/net/ipv4/netfilter/nf_nat_irc.ko
kernel/net/ipv4/netfilter/nf_nat_h323.ko
kernel/net/ipv4/netfilter/nf_nat_ftp.ko
kernel/net/ipv4/netfilter/nf_nat_amanda.ko
kernel/net/ipv4/netfilter/nf_nat.ko
kernel/net/ipv4/netfilter/nf_defrag_ipv4.ko
kernel/net/ipv4/netfilter/nf_conntrack_ipv4.ko
kernel/net/ipv4/netfilter/iptable_security.ko
kernel/net/ipv4/netfilter/iptable_raw.ko
kernel/net/ipv4/netfilter/iptable_nat.ko
kernel/net/ipv4/netfilter/iptable_mangle.ko
kernel/net/ipv4/netfilter/iptable_filter.ko
kernel/net/ipv4/netfilter/ipt_ecn.ko
kernel/net/ipv4/netfilter/ipt_ah.ko
kernel/net/ipv4/netfilter/ipt_ULOG.ko
kernel/net/ipv4/netfilter/ipt_REJECT.ko
kernel/net/ipv4/netfilter/ipt_REDIRECT.ko
kernel/net/ipv4/netfilter/ipt_NETMAP.ko
kernel/net/ipv4/netfilter/ipt_MASQUERADE.ko
kernel/net/ipv4/netfilter/ipt_LOG.ko
kernel/net/ipv4/netfilter/ipt_ECN.ko
kernel/net/ipv4/netfilter/ipt_CLUSTERIP.ko
kernel/net/ipv4/netfilter/ip_tables.ko
kernel/net/ipv4/netfilter/ip_queue.ko
kernel/net/ipv4/netfilter/arptable_filter.ko
kernel/net/ipv4/netfilter/arpt_mangle.ko
kernel/net/ipv4/netfilter/arp_tables.ko
kernel/net/ipv4/ipip.ko
kernel/net/ipv4/ipcomp.ko
kernel/net/bridge/netfilter/ebtables.ko
kernel/net/bridge/netfilter/ebtable_nat.ko
kernel/net/bridge/netfilter/ebtable_filter.ko
kernel/net/bridge/netfilter/ebtable_broute.ko
kernel/net/bridge/netfilter/ebt_vlan.ko
kernel/net/bridge/netfilter/ebt_stp.ko
kernel/net/bridge/netfilter/ebt_snat.ko
kernel/net/bridge/netfilter/ebt_redirect.ko
kernel/net/bridge/netfilter/ebt_pkttype.ko
kernel/net/bridge/netfilter/ebt_nflog.ko
kernel/net/bridge/netfilter/ebt_mark_m.ko
kernel/net/bridge/netfilter/ebt_mark.ko
kernel/net/bridge/netfilter/ebt_log.ko
kernel/net/bridge/netfilter/ebt_limit.ko
kernel/net/bridge/netfilter/ebt_ip6.ko
kernel/net/bridge/netfilter/ebt_ip.ko
kernel/net/bridge/netfilter/ebt_dnat.ko
kernel/net/bridge/netfilter/ebt_arpreply.ko
kernel/net/bridge/netfilter/ebt_arp.ko
kernel/net/bridge/netfilter/ebt_among.ko
kernel/net/bridge/netfilter/ebt_802_3.ko
kernel/net/bridge/bridge.ko
kernel/net/802/stp.ko
kernel/net/802/psnap.ko
kernel/net/802/p8022.ko
kernel/lib/ts_kmp.ko
kernel/lib/ts_fsm.ko
kernel/lib/ts_bm.ko
kernel/lib/crc-ccitt.ko
kernel/drivers/scsi/scsi_wait_scan.ko
kernel/drivers/net/tun.ko
kernel/drivers/net/slhc.ko
kernel/drivers/net/pppox.ko
kernel/drivers/net/pppoe.ko
kernel/drivers/net/ppp_synctty.ko
kernel/drivers/net/ppp_mppe.ko
kernel/drivers/net/ppp_generic.ko
kernel/drivers/net/ppp_deflate.ko
kernel/drivers/net/ppp_async.ko
kernel/drivers/net/bsd_comp.ko
kernel/crypto/zlib.ko
kernel/crypto/lzo.ko
kernel/crypto/deflate.ko

But if I try:

iptables -t nat -L | grep -q "MASQUERADE"

I get:

iptables v1.4.14: can't initialize iptables table `nat': Table does not exist (do you need to insmod?)
Perhaps iptables or your kernel needs to be upgraded.

And dmesg:

nf_conntrack: disagrees about version of symbol register_sysctl_paths
nf_conntrack: Unknown symbol register_sysctl_paths (err -22)
nf_conntrack: disagrees about version of symbol skb_copy_bits
nf_conntrack: Unknown symbol skb_copy_bits (err -22)
nf_conntrack: disagrees about version of symbol seq_open_net
nf_conntrack: Unknown symbol seq_open_net (err -22)
nf_conntrack: disagrees about version of symbol nf_afinfo
nf_conntrack: Unknown symbol nf_afinfo (err -22)
nf_conntrack: Unknown symbol nf_conntrack_destroy (err 0)
nf_conntrack: Unknown symbol nf_ct_destroy (err 0)
nf_conntrack: disagrees about version of symbol register_pernet_subsys
nf_conntrack: Unknown symbol register_pernet_subsys (err -22)
nf_conntrack: disagrees about version of symbol unregister_sysctl_table
nf_conntrack: Unknown symbol unregister_sysctl_table (err -22)
nf_conntrack: disagrees about version of symbol init_net
nf_conntrack: Unknown symbol init_net (err -22)
nf_conntrack: disagrees about version of symbol seq_release_net
nf_conntrack: Unknown symbol seq_release_net (err -22)
nf_conntrack: disagrees about version of symbol register_net_sysctl_table
nf_conntrack: Unknown symbol register_net_sysctl_table (err -22)
nf_conntrack: disagrees about version of symbol nla_put
nf_conntrack: Unknown symbol nla_put (err -22)
nf_conntrack: disagrees about version of symbol proc_net_remove
nf_conntrack: Unknown symbol proc_net_remove (err -22)
nf_conntrack: disagrees about version of symbol unregister_pernet_subsys
nf_conntrack: Unknown symbol unregister_pernet_subsys (err -22)
nf_conntrack: disagrees about version of symbol nf_log_packet
nf_conntrack: Unknown symbol nf_log_packet (err -22)
nf_conntrack: disagrees about version of symbol proc_net_fops_create
nf_conntrack: Unknown symbol proc_net_fops_create (err -22)
nf_conntrack: Unknown symbol ip_ct_attach (err 0)
nf_conntrack: disagrees about version of symbol unregister_net_sysctl_table
nf_conntrack: Unknown symbol unregister_net_sysctl_table (err -22)
nf_conntrack: disagrees about version of symbol register_sysctl_paths
nf_conntrack: Unknown symbol register_sysctl_paths (err -22)
nf_conntrack: disagrees about version of symbol skb_copy_bits
nf_conntrack: Unknown symbol skb_copy_bits (err -22)
nf_conntrack: disagrees about version of symbol seq_open_net
nf_conntrack: Unknown symbol seq_open_net (err -22)
nf_conntrack: disagrees about version of symbol nf_afinfo
nf_conntrack: Unknown symbol nf_afinfo (err -22)
nf_conntrack: Unknown symbol nf_conntrack_destroy (err 0)
nf_conntrack: Unknown symbol nf_ct_destroy (err 0)
nf_conntrack: disagrees about version of symbol register_pernet_subsys
nf_conntrack: Unknown symbol register_pernet_subsys (err -22)
nf_conntrack: disagrees about version of symbol unregister_sysctl_table
nf_conntrack: Unknown symbol unregister_sysctl_table (err -22)
nf_conntrack: disagrees about version of symbol init_net
nf_conntrack: Unknown symbol init_net (err -22)
nf_conntrack: disagrees about version of symbol seq_release_net
nf_conntrack: Unknown symbol seq_release_net (err -22)
nf_conntrack: disagrees about version of symbol register_net_sysctl_table
nf_conntrack: Unknown symbol register_net_sysctl_table (err -22)
nf_conntrack: disagrees about version of symbol nla_put
nf_conntrack: Unknown symbol nla_put (err -22)
nf_conntrack: disagrees about version of symbol proc_net_remove
nf_conntrack: Unknown symbol proc_net_remove (err -22)
nf_conntrack: disagrees about version of symbol unregister_pernet_subsys
nf_conntrack: Unknown symbol unregister_pernet_subsys (err -22)
nf_conntrack: disagrees about version of symbol nf_log_packet
nf_conntrack: Unknown symbol nf_log_packet (err -22)
nf_conntrack: disagrees about version of symbol proc_net_fops_create
nf_conntrack: Unknown symbol proc_net_fops_create (err -22)
nf_conntrack: Unknown symbol ip_ct_attach (err 0)
nf_conntrack: disagrees about version of symbol unregister_net_sysctl_table
nf_conntrack: Unknown symbol unregister_net_sysctl_table (err -22)

I read in http://www.readynas.com/forum/viewtopic.php?f=35&t=63015#p358242 that iptables modules require probably to recompile the kernel and not only modules and install the kernel in the system because some modules need some modification in the kernel itself. But the guy seem to be in trouble once the kernel replaced...

So is there any way to make iptables working on readynas OS 6.0.x ?

Thank you for you help.

[wouterds]

Bump. I have the same issue.

[mdgm-ntgr]

Perhaps update to 6.2. I think there is better iptables support in that.

[wouterds]

6.2 beta 3 still doesn't support iptables nat.

[michaelvec]

I have to agree with many other forum members: We need a full implementation (kernel) of iptables which includes nat, conntrack, state and other features. This hamstrung iptables implementation is very rudimentary and doesn't align with current security standards and practices.
Downloading the source and modding the code might be an option but it seems backwards and is counter-productive to the extensive dev-test-release cycle NETGEAR is already spending.

I have tried to implement squid3 as a proxy using 6.2.2 and due to the limitation of iptables I cannot succeed because the nat option is not supported.

NETGEAR: Lets get ahead of the "security-curve" and do a full iptables implementation so we can make it the best NAS available.

Mike

[alouch47]

michaelvec wrote:
I have tried to implement squid3 as a proxy using 6.2.2 and due to the limitation of iptables I cannot succeed because the nat option is not supported. NETGEAR: Lets get ahead of the "security-curve" and do a full iptables implementation so we can make it the best NAS available. Mike

Hello, I'm in the same situation while trying to achieve the same setup.
Did someone manage to successfully compil the required modules ?

Netgear, please hear us and do something about this, that would be really great.
Thanks

[thomasmebes]

Liebe Leser!

Habe ein ReadyNAS RN 102.

Dem Thema habe ich mich hier angenommen da auch ich gerne ein vollwertiges iptables einsetzen möchte.

Die Anleitung für das CrossCompile System basiert auf ein frisch installiert Debian 8 (Jessie) - 64 Bit.

Viel Spass mit der Anleitung! Ganz unten sind noch Download-Links!



#Arbeitsverzeichnis erstellen und hineinspringen
mkdir -p /usr/src/netgear
cd /usr/src/netgear

#Pakete zum übersetzen des Quellcodes installieren (libc6-i386 benötigen wir nur bei einer nicht 32-Bit-Umgebung)
apt-get install make libncurses5-dev gcc u-boot-tools libc6-i386

#Crosscompile Umgebung downloaden, entpacken und Archiv-Datei löschen
wget "http://heanet.dl.sourceforge.net/project/dsgpl/DSM%205.0%20Tool%20Chains/Marvell%20armada%20370%20Li...
tar -zxf gcc464_glibc215_hard_armada-GPL.tgz
rm gcc464_glibc215_hard_armada-GPL.tgz

#Umgebungsvariable temporär für die Crosscompile Umgebung setzen
export PATH=$PATH:/usr/src/netgear/arm-marvell-linux-gnueabi/bin/


#Sourcen-Verzeichnis anlegen und hinein wechseln
mkdir -p /usr/src/netgear/ReadyNASOS_V6.2.5_WW_src
cd /usr/src/netgear/ReadyNASOS_V6.2.5_WW_src

#ReadyNasOS Sourcen 6.2.5 downloaden
wget http://www.readynas.com/download/GPL/readynasos/6.2.5/ReadyNASOS_V6.2.5_WW_src.zip

#Aus den Sourcen entpacken wir nur das Kernelverzeichnis und löschen danach das Archiv
unzip ReadyNASOS_V6.2.5_WW_src.zip 'linux-3.0.101-0.46/*'
rm ReadyNASOS_V6.2.5_WW_src.zip

#In dieses Verzeichnis installieren wir nachher unsere Module, wir legen es nun an
mkdir -p /usr/src/netgear/kernelModules

#In das Kernel-Source Verzeichnis wechseln
cd /usr/src/netgear/ReadyNASOS_V6.2.5_WW_src/linux-3.0.101-0.46

#Die originale Kernel Konfiguration von Netgear nehmen und die iptables Module aktivieren welche man benötigt
http://www.readynas.com/download/GPL/readynasos/6.2.5/readynas_armada370_defconfig
#oder meine (readynas_rn103_kernel_config_iptables_nat) nehmen, das ist auch die Originale, nur hier sind alle iptables Module bereits aktiviert
https://drive.google.com/uc?id=0B6PbXf80b4b7U05mRW41WTlLbUU&export=download

#Diese Datei packt ihr dann nach (die vorhandene kann überschrieben werden)
/usr/src/netgear/ReadyNASOS_V6.2.5_WW_src/linux-3.0.101-0.46/.config

#Konfiguration einlesen
make oldconfig ARCH=arm

#ggf Module anpassen
make menuconfig ARCH=arm

#Kernel übersetzen
make ARCH=arm

#uImage erstellen
#Den Kernel findet ihr danach hier: /usr/src/netgear/ReadyNASOS_V6.2.5_WW_src/linux-3.0.101-0.46/arch/arm/boot/uImage
make uImage ARCH=arm

#Module compilieren
make modules ARCH=arm

#Module installieren nach /usr/src/netgear/kernelModules
#Und die Module findet ihr danach hier: /usr/src/netgear/kernelModules/lib/modules
make modules_install INSTALL_MOD_PATH=/usr/src/netgear/kernelModules ARCH=arm


#Das Verzeichnis "/lib/modules/3.0.101.RN_ARM.4" auf eurem NAS (bei mir RN102) verschiebt ihr am besten, damit ihr noch ein Backup habt
mv /lib/modules/3.0.101.RN_ARM.4 /lib/modules/3.0.101.RN_ARM.4_BACKUP

#dann holt ihr euch das Verzeichnis "/usr/src/netgear/kernelModules/lib/modules/3.0.101.RN_ARM.4" von eurer CrossCompile Umgebung und schiebt es auf
#das NAS "/lib/modules/3.0.101.RN_ARM.4"

#Zudem müsst ihr euch das uImage ("/usr/src/netgear/ReadyNASOS_V6.2.5_WW_src/linux-3.0.101-0.46/arch/arm/boot/uImage") holen von der CrossCompile Umgebung
#und auf dem NAS nach /tmp/ kopieren


#Nun müsst ihr das uImage auf den Flashspeicher schreiben
#Dazu benötigt ihr noch das Debian-Paket mtd-utils
apt-get install mtd-utils
#Nun flashen wir und löschen dafür das alte
flash_erase /dev/mtd2 0 0
nandwrite -p /dev/mtd2 /tmp/uImage

#Nun starten wir das System neu und hoffen, dass alles gut ging!

Viel Spass damit!

Thomas

pps. Ich hatte einiges Arbeit damit, deshalb verschont mich bitte mit Kommentaren "das hätte man viel besser machen können".
Da kann ich nur sagen "dann machts besser!". Wobei ich nett gemeinte Tipps gerne annehme! 🙂

Und ein kleines Dankeschön für den, dem es half wäre auch super.


Downloads:
Zudem habe ich das was ich kompiliert (Module und uImage) habe auch hochgeladen, ihr könnt es hier downloaden:
https://drive.google.com/folderview?id=0B6PbXf80b4b7WjdQZzFOOS10Tmc&usp=sharing

Falls wer keine Lust, Ahnung oder Zeit hat sich diese CrossCompile Umgebung selbst zu erstellen, kann gerne meine VMware Maschine nutzen:
https://drive.google.com/folderview?id=0B6PbXf80b4b7U0l3TzRRRUxfd00&usp=sharing


Bzw. hier nochmal alles einzeln durchzuklicken:
https://drive.google.com/folderview?id=0B6PbXf80b4b7TjdTQkl2TWs1a2c