防火墙软件Ipchains在Linux系统中的应用

Application of fire wall software Ipchains in Linux system

Ipchains软件是Linux平台上网络层的IP包过滤防火墙 .在防火墙链中置IP伪装是一个比包过滤策略更加安全的解决方案 ,它同时解决了Internet中IP地址资源不足的问题 .构建IP防火墙的基本配置方式是 :可选择允许符合一定条件的包通过 ,也可先接受所有的包 ,再明确指出禁止哪些类型的包 .在开始过滤某些不想要的包之前 ,以下内容应不在被阻拦之列 :ICMP包、到DNS的TCP连接、主动式FTP的TCP连接等 .此外 ,还应针对可能的网络攻击的特点设定完善的安全策略 .

Ipchains is IP packet filter fire wall on the network layer of Linux.IP mask in the fire wall chains is a safer solution project than packet filter.Meanwhile,it can solve the lack of Internet IP address resource.There are two choices of basic fire wall configuration.Firstly,the packets that accord with certain conditions can pass.Second,all the packets can be accepted,and then the packets that should be forbidden will be pointed out clearly.Before filtering useless packets,the following contents should not be prohibited:TCP connection of ICMP packet to DNS,TCP connection of active FTP.Moreover,perfect safety tactics should be founded in order to prevent form possible network attack.