diff -u -r -N IPTables-IPv4-0.98-orig/include/libiptc/ipt_kernel_headers.h IPTables-IPv4-0.98/include/libiptc/ipt_kernel_headers.h
--- IPTables-IPv4-0.98-orig/include/libiptc/ipt_kernel_headers.h	2001-10-06 04:16:12.000000000 +0200
+++ IPTables-IPv4-0.98/include/libiptc/ipt_kernel_headers.h	2008-07-28 12:49:01.000000000 +0200
@@ -13,6 +13,7 @@
 #include <netinet/udp.h>
 #include <net/if.h>
 #include <sys/types.h>
+#include <linux/types.h>
 #else /* libc5 */
 #include <sys/socket.h>
 #include <linux/ip.h>
diff -u -r -N IPTables-IPv4-0.98-orig/include/linux/config.h IPTables-IPv4-0.98/include/linux/config.h
--- IPTables-IPv4-0.98-orig/include/linux/config.h	1970-01-01 02:00:00.000000000 +0200
+++ IPTables-IPv4-0.98/include/linux/config.h	2008-07-28 14:45:12.000000000 +0200
@@ -0,0 +1,8 @@
+#ifndef _LINUX_CONFIG_H
+#define _LINUX_CONFIG_H
+
+#ifdef __KERNEL__
+#error Incorrectly using glibc headers for a kernel module
+#endif
+
+#endif
diff -u -r -N IPTables-IPv4-0.98-orig/include/linux/netfilter_ipv4/ip_conntrack.h IPTables-IPv4-0.98/include/linux/netfilter_ipv4/ip_conntrack.h
--- IPTables-IPv4-0.98-orig/include/linux/netfilter_ipv4/ip_conntrack.h	1970-01-01 02:00:00.000000000 +0200
+++ IPTables-IPv4-0.98/include/linux/netfilter_ipv4/ip_conntrack.h	2008-07-28 14:44:31.000000000 +0200
@@ -0,0 +1,45 @@
+#ifndef _IP_CONNTRACK_H
+#define _IP_CONNTRACK_H
+/* Connection state tracking for netfilter.  This is separated from,
+   but required by, the NAT layer; it can also be used by an iptables
+   extension. */
+
+#include <linux/config.h>
+#include <linux/netfilter_ipv4/ip_conntrack_tuple.h>
+
+enum ip_conntrack_info
+{
+	/* Part of an established connection (either direction). */
+	IP_CT_ESTABLISHED,
+
+	/* Like NEW, but related to an existing connection, or ICMP error
+	   (in either direction). */
+	IP_CT_RELATED,
+
+	/* Started a new connection to track (only
+           IP_CT_DIR_ORIGINAL); may be a retransmission. */
+	IP_CT_NEW,
+
+	/* >= this indicates reply direction */
+	IP_CT_IS_REPLY,
+
+	/* Number of distinct IP_CT types (no NEW in reply dirn). */
+	IP_CT_NUMBER = IP_CT_IS_REPLY * 2 - 1
+};
+
+/* Bitset representing status of connection. */
+enum ip_conntrack_status {
+	/* It's an expected connection: bit 0 set.  This bit never changed */
+	IPS_EXPECTED_BIT = 0,
+	IPS_EXPECTED = (1 << IPS_EXPECTED_BIT),
+
+	/* We've seen packets both ways: bit 1 set.  Can be set, not unset. */
+	IPS_SEEN_REPLY_BIT = 1,
+	IPS_SEEN_REPLY = (1 << IPS_SEEN_REPLY_BIT),
+
+	/* Conntrack should never be early-expired. */
+	IPS_ASSURED_BIT = 2,
+	IPS_ASSURED = (1 << IPS_ASSURED_BIT),
+};
+
+#endif /* _IP_CONNTRACK_H */
diff -u -r -N IPTables-IPv4-0.98-orig/include/linux/netfilter_ipv4/ip_conntrack_tuple.h IPTables-IPv4-0.98/include/linux/netfilter_ipv4/ip_conntrack_tuple.h
--- IPTables-IPv4-0.98-orig/include/linux/netfilter_ipv4/ip_conntrack_tuple.h	1970-01-01 02:00:00.000000000 +0200
+++ IPTables-IPv4-0.98/include/linux/netfilter_ipv4/ip_conntrack_tuple.h	2008-07-28 14:43:39.000000000 +0200
@@ -0,0 +1,105 @@
+#ifndef _IP_CONNTRACK_TUPLE_H
+#define _IP_CONNTRACK_TUPLE_H
+
+/* A `tuple' is a structure containing the information to uniquely
+  identify a connection.  ie. if two packets have the same tuple, they
+  are in the same connection; if not, they are not.
+
+  We divide the structure along "manipulatable" and
+  "non-manipulatable" lines, for the benefit of the NAT code.
+*/
+
+/* The protocol-specific manipulable parts of the tuple: always in
+   network order! */
+union ip_conntrack_manip_proto
+{
+	/* Add other protocols here. */
+	u_int16_t all;
+
+	struct {
+		u_int16_t port;
+	} tcp;
+	struct {
+		u_int16_t port;
+	} udp;
+	struct {
+		u_int16_t id;
+	} icmp;
+};
+
+/* The manipulable part of the tuple. */
+struct ip_conntrack_manip
+{
+	u_int32_t ip;
+	union ip_conntrack_manip_proto u;
+};
+
+/* This contains the information to distinguish a connection. */
+struct ip_conntrack_tuple
+{
+	struct ip_conntrack_manip src;
+
+	/* These are the parts of the tuple which are fixed. */
+	struct {
+		u_int32_t ip;
+		union {
+			/* Add other protocols here. */
+			u_int16_t all;
+
+			struct {
+				u_int16_t port;
+			} tcp;
+			struct {
+				u_int16_t port;
+			} udp;
+			struct {
+				u_int8_t type, code;
+			} icmp;
+		} u;
+
+		/* The protocol. */
+		u_int16_t protonum;
+	} dst;
+};
+
+enum ip_conntrack_dir
+{
+	IP_CT_DIR_ORIGINAL,
+	IP_CT_DIR_REPLY,
+	IP_CT_DIR_MAX
+};
+
+static inline int ip_ct_tuple_src_equal(const struct ip_conntrack_tuple *t1,
+				        const struct ip_conntrack_tuple *t2)
+{
+	return t1->src.ip == t2->src.ip
+		&& t1->src.u.all == t2->src.u.all;
+}
+
+static inline int ip_ct_tuple_dst_equal(const struct ip_conntrack_tuple *t1,
+				        const struct ip_conntrack_tuple *t2)
+{
+	return t1->dst.ip == t2->dst.ip
+		&& t1->dst.u.all == t2->dst.u.all
+		&& t1->dst.protonum == t2->dst.protonum;
+}
+
+static inline int ip_ct_tuple_equal(const struct ip_conntrack_tuple *t1,
+				    const struct ip_conntrack_tuple *t2)
+{
+	return ip_ct_tuple_src_equal(t1, t2) && ip_ct_tuple_dst_equal(t1, t2);
+}
+
+static inline int ip_ct_tuple_mask_cmp(const struct ip_conntrack_tuple *t,
+				       const struct ip_conntrack_tuple *tuple,
+				       const struct ip_conntrack_tuple *mask)
+{
+	return !(((t->src.ip ^ tuple->src.ip) & mask->src.ip)
+		 || ((t->dst.ip ^ tuple->dst.ip) & mask->dst.ip)
+		 || ((t->src.u.all ^ tuple->src.u.all) & mask->src.u.all)
+		 || ((t->dst.u.all ^ tuple->dst.u.all) & mask->dst.u.all)
+		 || ((t->dst.protonum ^ tuple->dst.protonum)
+		     & mask->dst.protonum));
+}
+
+#endif /* _IP_CONNTRACK_TUPLE_H */
diff -u -r -N IPTables-IPv4-0.98-orig/include/linux/netfilter_ipv4/ip_nat.h IPTables-IPv4-0.98/include/linux/netfilter_ipv4/ip_nat.h
--- IPTables-IPv4-0.98-orig/include/linux/netfilter_ipv4/ip_nat.h	1970-01-01 02:00:00.000000000 +0200
+++ IPTables-IPv4-0.98/include/linux/netfilter_ipv4/ip_nat.h	2008-07-28 14:41:40.000000000 +0200
@@ -0,0 +1,81 @@
+#ifndef _IP_NAT_H
+#define _IP_NAT_H
+#include <linux/netfilter_ipv4.h>
+#include <linux/netfilter_ipv4/ip_conntrack_tuple.h>
+
+#define IP_NAT_MAPPING_TYPE_MAX_NAMELEN 16
+
+enum ip_nat_manip_type
+{
+	IP_NAT_MANIP_SRC,
+	IP_NAT_MANIP_DST
+};
+
+#ifndef CONFIG_IP_NF_NAT_LOCAL
+/* SRC manip occurs only on POST_ROUTING */
+#define HOOK2MANIP(hooknum) ((hooknum) != NF_IP_POST_ROUTING)
+#else
+/* SRC manip occurs POST_ROUTING or LOCAL_IN */
+#define HOOK2MANIP(hooknum) ((hooknum) != NF_IP_POST_ROUTING && (hooknum) != NF_IP_LOCAL_IN)
+#endif
+
+/* 2.3.19 (I hope) will define this in linux/netfilter_ipv4.h. */
+#ifndef SO_ORIGINAL_DST
+#define SO_ORIGINAL_DST 80
+#endif
+
+#define IP_NAT_RANGE_MAP_IPS 1
+#define IP_NAT_RANGE_PROTO_SPECIFIED 2
+/* Used internally by get_unique_tuple(). */
+#define IP_NAT_RANGE_FULL 4
+
+/* NAT sequence number modifications */
+struct ip_nat_seq {
+	/* position of the last TCP sequence number 
+	 * modification (if any) */
+	u_int32_t correction_pos;
+	/* sequence number offset before and after last modification */
+	int32_t offset_before, offset_after;
+};
+
+/* Single range specification. */
+struct ip_nat_range
+{
+	/* Set to OR of flags above. */
+	unsigned int flags;
+
+	/* Inclusive: network order. */
+	u_int32_t min_ip, max_ip;
+
+	/* Inclusive: network order */
+	union ip_conntrack_manip_proto min, max;
+};
+
+/* A range consists of an array of 1 or more ip_nat_range */
+struct ip_nat_multi_range
+{
+	unsigned int rangesize;
+
+	/* hangs off end. */
+	struct ip_nat_range range[1];
+};
+
+/* Worst case: local-out manip + 1 post-routing, and reverse dirn. */
+#define IP_NAT_MAX_MANIPS (2*3)
+
+struct ip_nat_info_manip
+{
+	/* The direction. */
+	u_int8_t direction;
+
+	/* Which hook the manipulation happens on. */
+	u_int8_t hooknum;
+
+	/* The manipulation type. */
+	u_int8_t maniptype;
+
+	/* Manipulations to occur at each conntrack in this dirn. */
+	struct ip_conntrack_manip manip;
+};
+
+#endif
diff -u -r -N IPTables-IPv4-0.98-orig/libiptc/libip6tc.c IPTables-IPv4-0.98/libiptc/libip6tc.c
--- IPTables-IPv4-0.98-orig/libiptc/libip6tc.c	2003-07-04 23:06:44.000000000 +0200
+++ IPTables-IPv4-0.98/libiptc/libip6tc.c	2008-07-28 12:55:39.000000000 +0200
@@ -111,7 +111,7 @@
 #include "libiptc.c"
 
 #define BIT6(a, l) \
- ((ntohl(a->in6_u.u6_addr32[(l) / 32]) >> (31 - ((l) & 31))) & 1)
+ ((ntohl(a->__in6_u.__u6_addr32[(l) / 32]) >> (31 - ((l) & 31))) & 1)
 
 int
 ipv6_prefix_length(const struct in6_addr *a)
diff -u -r -N IPTables-IPv4-0.98-orig/libiptc/Makefile IPTables-IPv4-0.98/libiptc/Makefile
--- IPTables-IPv4-0.98-orig/libiptc/Makefile	2003-07-05 04:36:11.000000000 +0200
+++ IPTables-IPv4-0.98/libiptc/Makefile	2008-07-28 13:08:55.000000000 +0200
@@ -1,4 +1,4 @@
-CFLAGS := -I../include -I/usr/src/linux/include -DIPTABLES_VERSION=\"1.2.8\" -O2 -Wall
+CFLAGS := -I../include -I/usr/src/linux/include -DIPTABLES_VERSION=\"1.2.8\" -O2 -Wall -fPIC
 CC := gcc
 AR := ar
 RM := rm
diff -u -r -N IPTables-IPv4-0.98-orig/Makefile.PL IPTables-IPv4-0.98/Makefile.PL
--- IPTables-IPv4-0.98-orig/Makefile.PL	2003-07-05 06:50:57.000000000 +0200
+++ IPTables-IPv4-0.98/Makefile.PL	2008-07-28 13:00:48.000000000 +0200
@@ -80,7 +80,7 @@
     'VERSION_FROM' => 'IPv4.pm', # finds $VERSION
     'OBJECT'	=> 'IPv4.o loader.o packer.o unpacker.o maskgen.o libiptc/libiptc.a',
     'INC'	=> '-Iinclude -I/usr/src/linux/include',
-    'CCFLAGS'	=> "-Wall -DMODULE_PATH=\\\"$moduledir\\\"" . (defined $Config{'use64bitint'} ? " -DPERL_USES_64BIT_INT" : ""),
+    'CCFLAGS'	=> "-Wall -fPIC -DMODULE_PATH=\\\"$moduledir\\\"" . (defined $Config{'use64bitint'} ? " -DPERL_USES_64BIT_INT" : ""),
     'TYPEMAPS'	=> ['IPTables.typemap'],
     'XSPROTOARG' => '-noprototypes',
 );
diff -u -r -N IPTables-IPv4-0.98-orig/modules/Makefile IPTables-IPv4-0.98/modules/Makefile
--- IPTables-IPv4-0.98-orig/modules/Makefile	2003-07-06 19:29:47.000000000 +0200
+++ IPTables-IPv4-0.98/modules/Makefile	2008-07-28 14:32:44.000000000 +0200
@@ -16,7 +16,7 @@
 INSTALL_DIR := $(INSTALL_BASE)/lib/IPTables-IPv4
 endif
 
-CFLAGS := -I$(KERNEL_INC) -I$(NF_INC) -I$(PERL_INC) -I.. -Wall -O2 -Wundef
+CFLAGS := -I$(KERNEL_INC) -I$(NF_INC) -I$(PERL_INC) -I.. -Wall -O2 -Wundef -fPIC
 
 # Basic protocol modules for IPTables::IPv4
 MODULE_NAMES := icmp tcp udp ah esp
