本文對Linux 防火墻內核中Netfilter 系統的結構框架、工作原理及其在內核中的實現機制進行了研究，闡述了Linux 內核可加載模塊的機制，并分析了其主要數據結構及它們之間的關系。還介紹了如何編寫內核模塊，并將其鑲嵌在Netfilter 的架構中以實現對防火墻功能的擴充，并用防火墻作為實例，說明了如何在Linux 系統下實現模塊加載和卸載。
關鍵詞：防火墻；Linux 內核；Netfilter；模塊加載
Abstract：This paper introduces the framework, working theory and implementation mechanisms in kernel of the Linux firewall named Netfilter. Then it expounds the loading module mechanism of Linux, and analyzes the data structure of Linux module and their relationship, and how to program the kernel module and build it in Netfilter, in order to achieve the function expansion of firewall. The Linux firewall will be taken as an example to show how to implement module loading and unloading technology.
Key words：firewall; Iinux kernal; Netfilter ; Module Loading Technology