升级内核
centos7默认的3.10内核无法使用，需要更新为较高版本内核!
添加源
rpm -import https://www.elrepo.org/RPM-GPG-KEY-elrepo.org
rpm -Uvh http://www.elrepo.org/elrepo-release-7.0-2.el7.elrepo.noarch.rpm安装长期支持版内核后重启
yum -y --enablerepo=elrepo-kernel install kernel-lt.x86_64
reboot修改启动默认内核
grub2-editenv list ##查看当前内核
grep ^menu /boot/grub2/grub.cfg ##搜索以及安装的内核
##设置默认启动内核，注意：按照上面查看的内核顺序，找到数字为 lt 内核所在的位置，注意位置是从 0 开始算。
grub2-set-default 0
grub2-editenv list #查看是否设置成功
saved_entry=0 ##设置成功
reboot ##重启
uname -r ##查看内核是否更换，设置正确会输出下面结果
5.4.144-1.el7.elrepo.x86_64查看当前内核与相关的编译模块有哪些，将原来 3.10 相关的 devel 和 header 等全部删掉，安装剩下的 lt 模块
rpm -qa | grep kernel
yum remove -y kernel-tools-3.10.0-514.26.2.el7.x86_64 ##不要照抄
yum -y --enablerepo=elrepo-kernel install kernel-lt-devel.x86_64 kernel-lt-headers.x86_64 kernel-lt-tools.x86_64 ##安装剩下的 lt 模块安装依赖
yum update && yum upgrade
yum install gcc gcc-c++ autoconf autogen libmnl libmnl-devel libtool-devel libtool -y
yum install centos-release-scl -y
yum install devtoolset-8-gcc* -y
scl enable devtoolset-8 bash更换Firewalld为iptables
systemctl disable firewalld
systemctl stop firewalld
yum -y install iptables-services
systemctl enable iptables
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
service iptables save
systemctl start iptables下载源代码后开始编译
下载源代码
yum install git
cd /root/
git clone git://git.netfilter.org/libnftnl.git
git clone git://git.netfilter.org/iptables.git
git clone https://github.com/Chion82/netfilter-full-cone-nat.git编译libnftnl
yum install libmnl-devel -y
cd libnftnl
git checkout a71599dc0ae1a808e970e96850ea83d77f452994
sh autogen.sh
./configure
make
make install编译netfilter-full-cone-nat
cd /root/netfilter-full-cone-nat
make
modprobe nf_nat
insmod xt_FULLCONENAT.ko编译iptables 1.8.4
cp /root/netfilter-full-cone-nat/libipt_FULLCONENAT.c /root/iptables/extensions/
cd /root/iptables
git checkout 2b506c6681c7b01803f06b258a39e9da9012e5c5
ln -sfv /usr/sbin/xtables-multi /usr/bin/iptables-xml
./autogen.sh
PKG_CONFIG_PATH=/usr/local/lib/pkgconfig
export PKG_CONFIG_PATH
./configure
make
make install更新iptables
#先关闭iptables
systemctl stop iptables
#删除原来的iptables
rm -rf /sbin/iptables
rm -rf /sbin/iptables-restore
rm -rf /sbin/iptables-save
#复制你自己编译的iptables
cd /usr/local/sbin
cp /usr/local/sbin/iptables /sbin/
cp /usr/local/sbin/iptables-restore /sbin/
cp /usr/local/sbin/iptables-save /sbin/
#检验iptables版本
iptables -V设置开机自动加载Fullcone模块
设置模块
kernel=`uname -r`
cp /root/netfilter-full-cone-nat/xt_FULLCONENAT.ko /lib/modules/$kernel/
depmod
echo "modprobe xt_FULLCONENAT" > /etc/sysconfig/modules/xt_FULLCONENAT.modules
chmod 755 /etc/sysconfig/modules/xt_FULLCONENAT.modules
reboot检查是否加载成功
lsmod | grep xt_FULLCONENAT如果有输出类似于下面则成功：
xt_FULLCONENAT 40960 2
nf_nat 40960 3 xt_FULLCONENAT,iptable_nat,xt_MASQUERADE
nf_conntrack 147456 4 xt_conntrack,nf_nat,xt_FULLCONENAT,xt_MASQUERADE设置FullCone的iptables转发规则
iptables -t nat -A POSTROUTING -o eth0 -j FULLCONENAT #same as MASQUERADE
iptables -t nat -A PREROUTING -i eth0 -j FULLCONENAT #automatically restore NAT for inbound packets
service iptables save检查NAT类型
yum -y install python3 ##安装python3和pip3
pip3 install pystun3 ##安装pystun3
pystun3 ##检查输出
NAT Type: Full Cone ##成功更换
External IP:
External Port: