基于Linux包過濾的防火墻技術(shù)及應(yīng)用

討論了Linux操作系統(tǒng)內(nèi)核的Ipchains軟件包工作原理。利用Ipchains中的輸入鏈、輸出鏈、轉(zhuǎn)發(fā)鏈和自定義鏈等防火鏈，通過設(shè)置一系列規(guī)則，過濾被主機接收、發(fā)送或轉(zhuǎn)發(fā)的數(shù)據(jù)包或主機從一個網(wǎng)卡轉(zhuǎn)發(fā)到另一個網(wǎng)卡的數(shù)據(jù)包，實現(xiàn)根據(jù)源地址、目的地址、協(xié)議號等信息控制訪問，企業(yè)無須專門的防火墻產(chǎn)品，即可建立包過濾防火墻。該技術(shù)適用于中小企業(yè)或部門級用戶。最后給出一個在局域網(wǎng)環(huán)境下用Ipchains實現(xiàn)Linux防火墻的具體實例。

關(guān) 鍵 詞 Linux操作系統(tǒng); Ipchains軟件包; 防火鏈; 包過濾; 防火墻; 中小企業(yè)

Mainly on the principle of Ipchains embedded in Linux kernel has been discussed. A series of rules can be set up with the input chains or output chains or forward chains or user defined chains, these rules can filter the packet of input or output or forward by host computer and can also filter packet from one network card to another network card by computer. Therefore, the access control can be implemented base on data of source address and destination address and protocol number. This technology is suitable for the users such as small enterprise or department to set up a firewall without professional firewall production. An example is presented for demonstrating how to use the proposed technology as firewall in LAN.