Linux内核中NetfiltrIptables防火墙设置分析.docx

摘要随着网络安全问题日益严重，防火墙越来越受到人们的重视。由于Linux操作 摘要 随着网络安全问题日益严重，防火墙越来越受到人们的重视。由于Linux操作 系统源代码的开放性，使得Linux成为研究防火墙技术的一个很好的平台。 本文首先概述了网络安全问题的产生，介绍了防火墙的概念，然后对其关键 技术做了简要的介绍。本文还介绍了基于Linux内核的Netfilter框架原理以及 iptables工具，并分析了Netfilter／iptables框架对数据包的处理流程。 本文最后通过对一款基于WiMAX网络产品的特性的分析，提出符合其特点 的防火墙；随后在分析防火墙与其他模块的协同工作原理的的基础上，比较了使 用脚本语言和C语言这两种防火墙的方法，根据分析以及比较结果，用C语言给 出防火墙关键技术(状态检测技术、NAT等)的程序模块；对测试结果的分析表 明：用C语言实现的防火墙关键模块符合设计要求。 上述基于WiMAX的防火墙的配置是在Linux嵌入式平台上实现的，适用于用 户管理界面采用CGI规范作为服务器和客户端之间的接口，并用Javascript作为开 发语言的其他网络产品的开发。 关键词：Linux Netfilter iptables防火墙 AbstractWith Abstract With the increasingly serious network security problem，firewall has been payed more and more attention．As the Linux operating system source code is open，Linux supplies a good platform for the research of firewall technology． To begin讯tll，network security problem and the concept of firewall are given in this paper．Then the key technology of firewall is introduced．What’S more，this paper also introduces the Netfilter framework based on the Linux kernel and the iptables tool and analyzes the processing ofNetfilter／iptables framework for packet． Based on the analysis of a WiMAX product,a new kind of firewall，which coincides with the characteristies of the WiMAX product iS presented at the end of this paper．Then a comparation of using scripting language and C language to config the firewall has been made based on analyzing the cooperative work principle of firewall and other modules．According to the results of comparing and analyzing，this paper choose C language to give the program module of key technology of firewall(state detection technology,NAL etc)；The analysis of testing result shows that the key technology implemented by C language meets the design requirements． 111e above configuration of firewall based on WiMAX iS implemented on Linux embedded platform．The firewall is suitable for the development of other network with the port between a server and client that using CGI standard as user management interface and using