討論了Linux操作系統(tǒng)內(nèi)核的Ipchains軟件包工作原理。利用Ipchains中的輸入鏈、輸出鏈、轉(zhuǎn)發(fā)鏈和自定義鏈等防火鏈，通過設(shè)置一系列規(guī)則，過濾被主機(jī)接收、發(fā)送或轉(zhuǎn)發(fā)的數(shù)據(jù)包或主機(jī)從一個(gè)網(wǎng)卡轉(zhuǎn)發(fā)到另一個(gè)網(wǎng)卡的數(shù)據(jù)包，實(shí)現(xiàn)根據(jù)源地址、目的地址、協(xié)議號(hào)等信息控制訪問，企業(yè)無須專門的防火墻產(chǎn)品，即可建立包過濾防火墻。該技術(shù)適用于中小企業(yè)或部門級(jí)用戶。最后給出一個(gè)在局域網(wǎng)環(huán)境下用Ipchains實(shí)現(xiàn)Linux防火墻的具體實(shí)例。

關(guān) 鍵 詞 Linux操作系統(tǒng); Ipchains軟件包; 防火鏈; 包過濾; 防火墻; 中小企業(yè)

Mainly on the principle of Ipchains embedded in Linux kernel has been discussed. A series of rules can be set up with the input chains or output chains or forward chains or user defined chains, these rules can filter the packet of input or output or forward by host computer and can also filter packet from one network card to another network card by computer. Therefore, the access control can be implemented base on data of source address and destination address and protocol number. This technology is suitable for the users such as small enterprise or department to set up a firewall without professional firewall production. An example is presented for demonstrating how to use the proposed technology as firewall in LAN.