Abstract: After analyzing the mechanism and the expansion of technology for Linux Netfilter/Iptables, the characteristics of the P2P protocol, through expanding kernel lib based on the Linux system, this paper implements user data space and kernel space data interchange through sharing lib, expands firewall rule, implements P2P flow control, and according to emerging P2P business to update the rule set, with the good performance of expansion.

Key words: Firewall, Kernel space, User space, Expansion

摘要： 分析了Linux Netfilter/Iptables 架构的实现机制和扩展技术，分析了P2P协议的特征，通过扩展Linux内核库，利用共享库实现用户数据空间与内核空间的数据交互，扩展防火墙的规则集，从而实现P2P流量控制的方法，而且可以根据不断出现的P2P业务更新规则集，具有很好的扩充性能。

关键词: 防火墙, 内核空间, 用户空间, 扩展