基于Linux模块编程的包过滤型防火墙系统

Packet Filtering Firewall System Based on Linux Module Programming

该文首先分析了Linux的Netfilter的内核架构。在此基础上,采用模块编程方式开发了一个高效实用的包过滤型防火墙系统,对进出子网的数据包可实现基于地址、协议、端口的过滤。

The article analyses Netfilter kernel architecture for Linux at first. A practical and effective Packet filtering firewall system is de- veloped using method of module programming. It filters all passing data packets with address, protocol and port.