文档介绍：华中科技大学
硕士学位论文
MoIP网关中防火墙模块的设计与实现
姓名:刘毅
申请学位级别:硕士
专业:通信与信息系统
指导教师:杜旭
20080528
华中科技大学硕士学位论文
摘要
随着互联网技术的飞速发展,信息共享需求与实现的矛盾得以有效化解,但开
放信息资源的安全日益成为一个不容忽视的技术和社会问题。防火墙作为本地网络
与外部网络之间的安全屏障,可以隔离风险网络与本地网络的连接,同时不会妨碍
人们对外部网络的访问,是一种非常有效的网络安全模型。Linux 具有良好的网络
性能和开放源码的特点,而且 Linux 和 filter/iptables
简洁高效、可扩展性好,使越来越多的开发者选择它作为防火墙的实现基础。利用
filter/iptables 及其扩展技术来实现家庭网关的防火墙功能,具有良好的借
鉴意义和实用价值。
本文首先讨论了防火墙技术的发展,并深入分析了 Linux 防火墙子系统
Netfilter/iptables 的实现机制。在此基础上,以家庭网关项目需求为背景,结合嵌入
式 Linux 技术,提出了防火墙模块的设计方案,并详细论述了实现过程。防火墙整
体结构包括两部分:基本防火墙和扩展防火墙。基本防火墙针对家庭网关的网络应
用进行固定配置,filter/iptables 的过滤功能,并利用 Web
技术,能够让用户定制防火墙规则,控制规则作用时间,查看日志记录。最后设计
了网络拓扑对防火墙功能进行测试,结果表明该防火墙模块的实现完全满足家庭网
关需要。
这种防火墙的构建方式已经应用于小型家庭网关中,研究和实践表明,该方案
具有良好的可移植性并且适用于家庭网关各种不同的应用场合。

关键词:嵌入式Linux系统; 家庭网关; 防火墙; 过滤器; 日志
I
华中科技大学硕士学位论文
Abstract
With the rapid development of technology, the contradiction between
requirement and implementation of information sharing has been effectively resolved, but
the security of the opening information resource is ing increasingly a problem of
society and technology. As a safety barrier between work and work,
firewall is an efficient model which can isolate the connection from work but
not interfere with the access. Linux is an open source operating system and has good
network performance; furthermore, the firewall filter/iptables in Linux
kernel is concise, having high efficiency and good extensibility, which is chosen
as the base of a firewall by many developers. It has good reference meaning and practical
value using filter/iptables to implement the firewall in residential gateway.
This thesis analyzes the implementation mechanism of filter/iptables after
introduced the problem work security and discussed the development of firewall
technology. Based on requirement of residential gateway, the author designs the firewall
module and depicts the course of realization in detail. The firewall includes a basic
firewall and