软件包
l7-protocols-2009-05-28.tar.gz
linux-2.6.28.10.tar.gz
netfilter-layer7-v2.22.tar.gz
iptables-1.4.6.tar.bz2
解压内核源码和netfilter-L7源码
[root@station1 ~]# tar xf linux-2.6.28.10.tar.gz -C /usr/src/
[root@station1 ~]# tar xf netfilter-layer7-v2.22.tar.gz -C /usr/src/
[root@station1 ~]#
编译内核
[root@station1 linux]# cp /boot/config-2.6.18-308.el5 .config
[root@station1 linux]# make menuconfig
选择顺序
Networking support ---> Networking options ---> Network packet filtering framework (Netfilter) --->
Core Netfilter Configuration --->
<M> Netfilter connection tracking support
<M> "layer7" match support
进行编译
[root@station1 linux]# make
[root@station1 linux]# make modules_install
[root@station1 linux]# make install
重启后查看内核版本
[root@station1 ~]# uname -r
2.6.28.10-l7
[root@station1 ~]#
安装新的iptables
[root@station1 ~]# rpm -e iptables-ipv6 iptables --nodeps
warning: /etc/sysconfig/iptables-config saved as /etc/sysconfig/iptables-config.rpmsave
[root@station1 ~]#
[root@station1 ~]# tar xf iptables-1.4.6.tar.bz2 -C /usr/src/
[root@station1 ~]# cd /usr/src/iptables-1.4.6/extensions/
[root@station1 extensions]#
[root@station1 netfilter-layer7-v2.22]# cp iptables-1.4.3forward-for-kernel-2.6.20forward/libxt_layer7.* ../iptables-1.4.6/extensions/
[root@station1 netfilter-layer7-v2.22]#
[root@station1 src]# cd iptables-1.4.6/
[root@station1 iptables-1.4.6]#
[root@station1 iptables-1.4.6]# ./configure --prefix=/usr/ --with-ksource=/usr/src/linux
[root@station1 iptables-1.4.6]# make
[root@station1 iptables-1.4.6]# make install
[root@station1 iptables-1.4.6]#
安装layer-7
[root@station1 ~]# tar xf l7-protocols-2009-05-28.tar.gz
[root@station1 ~]# cd l7-protocols-2009-05-28
[root@station1 l7-protocols-2009-05-28]# make install
mkdir -p /etc/l7-protocols
cp -R * /etc/l7-protocols
[root@station1 l7-protocols-2009-05-28]#
实现禁止qq
iptables -A FORWARD -s 10.10.1.0/24 -m layer7 --l7proto qq -j DROP
原文：http://fangyu.blog.51cto.com/4883282/1568650