Centos查看当前内核、Iptables版本并下载相应源码：
#https://www.haiyun.me
uname -r
2.6.18-274.el5
cd /usr/src/kernels/
wget http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.18.tar.gz
iptables -V
iptables v1.3.5
wget http://ftp.netfilter.org/pub/iptables/iptables-1.3.5.tar.bz2或下载Centos官方内核源码：
useradd test
su -l test
mkdir -p ~/rpmbuild/{BUILD,BUILDROOT,RPMS,SOURCES,SPECS,SRPMS}
echo '%_topdir %(echo $HOME)/rpmbuild' > ~/.rpmmacros
yum install rpm-build redhat-rpm-config unifdef
rpm -i http://vault.centos.org/5.7/os/SRPMS/kernel-2.6.18-274.el5.src.rpm
cd ~/rpmbuild/SPECS
rpmbuild -bp --target=$(uname -m) kernel.spec
cd ~/rpmbuild/BUILD/kernel*/linux*/ #源码所在目录下载Layer7模块和规则文件：
wget http://sourceforge.net/projects/l7-filter/files/l7-filter%20kernel%20version/2.18/netfilter-layer7-v2.18.tar.gz
wget http://sourceforge.net/projects/l7-filter/files/Protocol%20definitions/2009-05-28/l7-protocols-2009-05-28.tar.gz给内核打上Layer7补丁并编译模块：
tar zxvf linux-2.6.18.tar.gz
tar zxvf netfilter-layer7-v2.18.tar.gz
cd linux-2.6.18
patch -p1 < ../netfilter-layer7-v2.18/for_older_kernels/kernel-2.6.18-2.6.19-layer7-2.9.patch
#查看READ文件根据内核版本选择相应的补丁
yum install -y ncurses-devel
#安装ncurses库，编译内核需要
make oldconfig
#备份配置文件
make menuconfig
#进入内核编译选项在以下菜单处理选择将layer7编译为模块：
Networking——Networking options--->Network packet filtering (replaces ipchains)--->Layer 7 match support (EXPERIMENTAL) 编译内核模块：
#https://www.haiyun.me
make prepare
make modules_prepare
#创建外部模块所需文件，后续可直接编译指定模块
make M=net/ipv4/netfilter/
#仅编译防火墙相关模块复制编译的layer7.ko模块至系统：
strip --strip-debug net/ipv4/netfilter/ipt_layer7.ko
cp net/ipv4/netfilter/ipt_layer7.ko /lib/modules/2.6.18-274.el5/kernel/net/ipv4/netfilter/
chmod 744 /lib/modules/2.6.18-274.el5/kernel/net/ipv4/netfilter/ipt_layer7.ko
depmod -a编译安装Iptables layer7模块：
tar jxvf iptables-1.3.5.tar.bz2
cd iptables-1.3.5
patch -p1 < ../netfilter-layer7-v2.18/iptables-1.3-for-kernel-pre2.6.20-layer7-2.18.patch
#给iptables打上layer7补丁，阅读README根据内核及Iptables版本选择相应的补丁
chmod +x extensions/.layer7-test
make KERNEL_DIR=/usr/src/kernels/linux-2.6.18
make install KERNEL_DIR=/usr/src/kernels/linux-2.6.18安装Layer7示例脚本：
tar -zxvf l7-protocols-2009-05-28.tar.gz
cd l7-protocols-2009-05-28
make install应用示例：
modprobe ipt_layer7
/usr/local/sbin/iptables -A FORWARD -m layer7 --l7proto qq -j DROP 标签：iptables, linux, linux编译内核模块, 编译添加iptables模块, layer7, iptables添加layer7模块