基于Linux的最新防火墙技术的研究

Research of the Up-to-date Firewall Technology Based on the Linux Kernel

Linux2.4内核下防火墙Iptables是以Netfilter为基础实现的。Netfilter是一种内核中用于扩展各种网络服务的结构化底层框架。深入研究了开放代码Linux2.4.18内核下防火墙Iptables实现的关键部分Netfilter架构,从Netfilter与IP层相对关系,到钩子和下挂函数的数据结构,注册和注销下挂函数的管理方法,如何启动钩子来检测IP包,全面剖析了Netfilter的实现细节。研究最终服务于软件研发,为自己的嵌入式防火墙产品的设计和开发提供一个新的设计思路,也为底层开发者利用Netfilter架构实现Linux内核下其它协议族的防火墙提供了便利。

The firewall Iptables under Linux 2.4 is implemented based on Netfilter. Netfilter is a structural kernel framework for network service extension. This paper presents an indepth research of the core implementation of the IP firewall Iptables under Linux kernel 2.4.18, detailed in four parts. The research of the paper ultimately servers software development, which on one hand provides a new kind of design for our own embedded firewall product, and on the other hand facilitates other developers to build firewall products on protocols other than IPv4 under Linux.