利用Netfilter实现防火墙的性能分析

Performance Analysis of Firewall based on Netfilter

介绍了 L inux下防火墙从 Ipfwadm到 Ipchains,又到 Iptables的发展 ,通过与 Ipchains进行比较 ,着重分析了 Netfilter的功能框架 ,兼容的前版本的 Ipchains和 Ipfwadm,针对诸如实现复杂、代码复杂、不易扩展等旧版本存在的问题进行了改进 ,并介绍了其配置工具 Iptables的用法 ,预测不久 Netfilter将代替 Ipchains而成为主流。

This paper introduces the development of the f ir ewall under Linux from Ipfwadm to Ipchain and Iptables,and then gives more descr iption in analyzing the function frame of Netfilter by means of comparing with t hat of Ipchains,which is compatible with Ipchains and Ipfwadm of the preceding v ersion,and has been improved for the problems,such as complicated implementation ,complicated code and not easy to be expended,etc.And also how to use the config uration tools,Iptables,is presented.It is predicated that Netfileter will becom e the main trend in stead of Ipchains in the future.