基于Linux系统的Netfilter/iptables防火墙的研究与应用

Research and Application of Netfilter/iptables Firewall Based on Linux System

小型企业的网络安全并未引起足够的重视,除了昂贵的第三方安全服务提供商外,目前并没有一个很好的解决方案。Netfilter/iptables是基于Linux系统的内置防火墙,通过iptables表、链关系,以及包过滤、重定向、地址转换等功能,构建了一个功能强大的专业性防火墙,使用简便,成本低廉,尤其适用于小型企业,可以代替昂贵的商业防火墙解决方案。Linux防火墙通过在内外网间构建访问规则与策略,能有效防范一些典型的网络攻击行为如:DDos攻击、端口扫描、植入木马、IP欺骗等,从而构建起安全的网络环境。

The network security of small enterprises lacks attention,and there is no solution at present except the expensive third-party security service providers.Netfilter/iptables is a built-in firewall based on Linux system.Through iptables,chain relationship,packet filtering,redirection,address translation and other functions,a powerful professional firewall can be constructed,which is easy to use and low in cost,especially suitable for small enterprises,and can replace expensive commercial firewall solutions.By constructing access rules and policies between internal and external networks,Linux firewall can effectively prevent some typical network attacks such as DDos attacks,port scanning,Trojan horse planting,IP spoofing,etc.,thus constructing a secure network environment.