基于LINUX平台的防火墙研究与实现

On the Implementation of a Firewall Based on Linux Platform

针对目前的防火墙技术不能有效地解决网络内部安全问题 ,提出一种结合包过滤和代理技术 ,并将代理服务器与认证系统建立在 B1级操作系统上的防火墙系统。所开发的基于 Linux平台的防火墙系统不仅实现了 HTTP代理、FTP代理和包过滤功能 ,还实现了内容过滤、地址翻译以及对 IP地址欺骗、IP源路由欺骗等攻击的防范。符合国标 GB/ T1 790 0 - 1 999、GB/ T1 80 2 0 - 1 999,通过了公安部安全产品检测 ;Intel性能测试表明 :1 0 0 M网络环境下包过滤可达到线速 ,HTTP代理为 30 %。

This paper presents a firewall system based on Linux - L-Firewall, which combines packet filter and proxy technology. Proxy and authentication are implemented on B1 level operating system. The paper emphasizes on the L-Firewall frame, especially on the implementation of packet filter module. L-Firewall provides not only HTTP, FTP proxy and packet filter, but also content filter, network address translation to protect network from IP spoofing and IP source route spoofing. L-Firewall tallies with GB/T17900-1999 and GB/T18020-1999.