Linux下基于Netfilter/Iptables防火墙的研究与应用

Research and application of Netfilter/Iptables firewall based on Linux

在对Linux下netfilter/iptables防火墙工作机制进行分析的基础上,提出了能够提高防火墙数据匹配效率的FLC(First-Last-Characters)算法,并在netfilter/iptables防火墙中,与BMHS算法进行了对比测试。测试结果表明,这种算法能够有效地提高防火墙的性能,具有一定的应用价值。

Along with the computer network security being increasingly precarious, the performance requirement for the firewall has to meet more strict demands. This paper, based on the analysis of the mechanism of Netfilter/Iptables Firewall under Linux, proposes FLC(First-Last-Characters) algorithm which can improve the matching efficiency of firewall data and has brought comparative test with the BMHS algorithm in the netfilter/iptables firewall. The test results show that this algorithm can effectively increase firewall performance and has a certain application value.