Linux防火墙技术的研究与实现

Linux防火墙技术的研究与实现
 
摘要：随着以Internet为代表的全球信息化浪潮的来临，信息网络技术的应用正日益广泛和深入，而伴随网络的普及，公共通信网络传输中的数据安全问题也成为目前研究的热点。
防火墙是实施网络安全策略的重要组成部分，是用在安全私有网络和外部不可信任网络之间安全连接的1个设备或1组设备，作为私有网络和外部网络之间连接的单点存在。防火墙作为内部网络安全的屏障，其主要目标是保护内部网络资源，执行网络基本安全策略，防止内部信息泄漏和外部入侵，提供对网络资源的访问控制，发现安全隐患，为安全策略的完善提供帮助，监督各类通信行为。
本文对Linux 2. 4内核防火墙NetFilter的原理进行了深入研究，分析了在NetFilter架构下防火墙的设计与实现，叙述了Linux的动态地址转换，论述了在Linux下防火墙的设计和开发过程。以GNU为开发工具，作者基于NetFilter架构开发了1款包过滤的个人防火墙，并对其做了测试。

关键词：网络安全；防火墙；Linux；方案设计；NetFilter；包过滤

Research and Realization of Firewall Based on Linux
 
Abstract：With the rapid develppment of information technology based on Internet; theapplication of information network techniques is extended more and more.Following popularization of Internet, the data security problems transmitting inInternet bring a hot challenge in the research field.
The firewall is inserted between the premises network and the Internet toestablish a controlled link and to erect an outer security wall or perimeter. The aimof this perimeter is to protect the premises network from Internet based attacks andto provide a single choke point where security and audit can be imposed. （转载自http://www.ＮＳＥＡＣ.com中国科教评价网）
This thesis discusses the netfilter mechanism of Linux 2.4 kernel, and analyzes how to design and realize the firewall based on netfilter technology, and also describes network address  translation in Linux. Developed by GNU, a netfilter based firewall is realized and tested.

Keywords: Network Security; Firewall; Linux; Scheme Designing; NetFilter; Packet Filter