patch-o-matic

emerge -pv iptables
[ebuild R ] net-firewall/iptables-1.3.8-r1 USE="extensions -imq -ipv6 -l7filter -static" 0 kB

__________________________________
Главное не забыть mount /dev/hands

Preconfigure Portage

Create (if necessary) or edit /etc/portage/package.keywords and change the following:
File: /etc/portage/package.keywords
net-firewall/iptables
sys-kernel/genkernel

This will grab the latest test versions. As far as these packages are concerned this is usually a good idea.
Get the software
# emerge gentoo-sources iptables genkernel gentoolkit

You might also want to
# emerge -a links

If it's already installed, just answer no to the question.
Next, download the following files in a temporary directory such as /tmp:
Patch-o-matic-ng from Netfilter
# cd /tmp
# links2 ftp://ftp.netfilter.org/pub/patch-o-matic-ng/snapshot/

Select the latest .tar.bz2 and press D to download and Q to quit links2. Unpack patch-o-matic-ng

Determine iptables ebuild script and remember this path (should be /usr/portage/net-firewall/iptables/iptables-.ebuild but we will refer to it as /path/to/iptables.ebuild):
# equery which iptables

Let's make sure the source is available:
# ebuild /path/to/iptables.ebuild clean
# ebuild /path/to/iptables.ebuild unpack

Determine iptables source directory which should be /var/tmp/portage/iptables-/work/iptables-. We will refer to it as /path/to/iptables.source/. Apply the policy match patch:
# export KERNEL_DIR=/usr/src/linux
# export IPTABLES_DIR=/path/to/iptables.source/
# cd /tmp/patch-o-matic-ng-/
# ./runme extra

Just press ENTER to all patches except policy match. When you reach policy match, press y and enter and then type q and enter to quit. Make sure you see the following files in place:
/path/to/iptables.source/extensions/libip?t_policy.c
/path/to/iptables.source/include/linux/netfilter_ipv?/ip?t_policy.h
If not, copy them over from:
/tmp/patch-o-matic-ng-/patchlets/policy/iptables/extensions/
/tmp/patch-o-matic-ng-/patchlets/policy/linux-2.6(your version)/include/linux/netfilter_ipv?/
Finally, you need to add policy to the PF_EXT_SLIB variable in /path/to/iptables.source/extensions/Makefile.
[edit] Recompile the kernel with ipsec and policy match
# genkernel --menuconfig all

Linux Kernel Configuration: genkernel --menuconfig all
you should have similar options:
Device Drivers --->

Networking Support --->
Networking Options --->
<*> PF_KEY sockets
<*> IP: AH transformations
<*> IP: ESP transformations
<*> IP: IPComp transformations
<*> IP: tunnel transformations
<*> IPsec user configuration interface
Network Packet Filtering --->

IP: Netfilter Configuration --->
<*> IPsec policy match support

kernel modules
You could also specify pf_key, ah?, esp?, ipcomp and xfrm_user as modules (M) but then you would have to load them at boot time by including them in /etc/modules.autoload.d/kernel-.
reboot

Make sure genkernel exits without errors. The new kernel image should be ready to load (usually in /boot/). Reboot the system
[edit] Recompile iptables with policy match
Netfilter's iptables also needs to be recompiled with policy match support. Let's do that and install the software as well.
# ebuild /path/to/iptables.ebuild compile
# ebuild /path/to/iptables.ebuild install
# ebuild /path/to/iptables.ebuild qmerge

Взято отсюда http://gentoo-wiki.com/HOWTO_Shorewall_Firewall_IPsec_VPN_and_2.6_kernel
на момент поста gentoo-wiki.com не работал...

----
Portage 2.1.3.9 (default-linux/amd64/2007.0/desktop, gcc-4.1.2, glibc-2.6.1-r0, 2.6.23-gentoo x86_64)
man life | grep sense