基于Linux平台的内江职业技术学院防火墙系统的设计与实现

发布时间：2018-09-12 17:55

【摘要】：当前网络安全所面临的威胁主要来自病毒攻击、木马攻击、黑客攻击以及间谍软件的窃密。光靠杀毒软件不足以保证系统的安全。传统防火墙在面对新一代的网络安全威胁作用越来越小,而UTM(统一威胁管理)网关虽然集成了防火墙、防毒系统、入侵检测与监控系统等功能,但在性能以及应对内部网络安全威胁方面存在不足,需要与应用级防火墙相互配合来共同维护网络安全。本文通过对Linux内核、防火墙原理与技术、TCP/IP协议以及Linux高级网络特性的研究,实现了一个Linux环境下的简易防火墙。本次设计的校园防火墙提供了URL过滤功能,可以控制校园用户对非法站点的访问。它可以实现IP地址和MAC地址的绑定,防止校园内部网络用户更换IP地址,进行恶意攻击。目前学院硬件防火墙(RG-WALL 1600-EI)具有流量控制功能,可以分配合理的带宽给校园用户。RG-WALL 1600-EI还具有HTTP透明代理,NAT功能和VPN等功能,能够充分满足校园网络的需要,但这些都必须购买相应的模块。SIPFW防火墙的总体架构由两个部分组成:用户空间部分的交互控制用户接口和内核空间部分的处理模块。本文通过对netfilter架构上INPUT链、OUTPUT链、FORWARD链的网络数据进行过滤完成对进入本地、从本机发出、经由本机转发的网络数据进行处理。用户空间主要由命令行解析和内核通信两部分组成,命令行解析使用GNU系统函数进行处理,通信部分则负责传递用户的合法输入信息并将该操作结果展示给用户。本文设计的防火墙内核空间与用户空间之间的通信,通过内接建立的私有Netlink通信类型的套接字进行处理完成用户对过滤规则的列表、增加、删除、清除等操作。通过使用Linux内核中的PROC虚拟文件系统将防火墙中的信息传递给用户空间。本论文所实现的SIPFW防火墙基本可以实现简单的网络数据的拦截,SIPFW防火墙的功能比较单一,可以进行网络数据的拦截,可以通过用户的命令对防火墙过滤规则进行设计,可以记录防火墙规则的命中情况,可以通过配置文件和PROC虚拟文件系统对防火墙进行简单的配置等。本系统经过测试,运行良好,已达到预期效果。
[Abstract]:The main threats to network security come from virus attack, Trojan horse attack, hacker attack and spyware theft. Anti-virus software alone is not enough to ensure the safety of the system. In the face of the new generation of network security threats, the traditional firewall is becoming less and less effective, while the UTM (Unified threat Management) gateway integrates the functions of firewall, anti-virus system, intrusion detection and monitoring system, etc. However, there are shortcomings in performance and in dealing with internal network security threats, so it is necessary to cooperate with application-level firewalls to maintain network security. Based on the research of Linux kernel, firewall principle and technology, TCP / IP protocol and the characteristics of Linux advanced network, a simple firewall in Linux environment is implemented in this paper. This design of campus firewall provides URL filtering function, which can control the access of campus users to illegal sites. It can realize the binding of IP address and MAC address, and prevent the users of campus internal network from changing IP address and making malicious attack. At present, the college hardware firewall (RG-WALL 1600-EI) has the function of flow control, which can allocate reasonable bandwidth to the campus user. RG-WALL 1600-EI also has the functions of HTTP transparent proxy, Nat and VPN, which can fully meet the needs of campus network. But all these must purchase the corresponding module. SIPFW firewall architecture consists of two parts: interactive control user interface in user space part and processing module in kernel space part. In this paper, the network data of the INPUT output chain is filtered on the netfilter architecture, and the network data which is sent out from the local computer and transmitted through the local computer is processed. The user space is mainly composed of two parts: command line parsing and kernel communication. The command line parsing is handled by GNU system function, and the communication part is responsible for transmitting the legitimate input information of the user and displaying the operation result to the user. In this paper, the communication between the firewall kernel space and the user space is processed by the socket of the private Netlink communication type, which is used to complete the list, add, delete, and clear of the filter rules. The information in firewall is transferred to user space by using PROC virtual file system in Linux kernel. The SIPFW firewall implemented in this paper can basically realize the simple network data interception. The function of SIPFW firewall is relatively simple, and the network data can be intercepted. The firewall filtering rules can be designed by the user's command. We can record the hit of firewall rules and configure firewall by configuration file and PROC virtual file system. The system has been tested, running well, has achieved the desired results.
【学位授予单位】：电子科技大学
【学位级别】：硕士
【学位授予年份】：2015
【分类号】：TP393.08;TP316.81

【相似文献】