嵌入式Linux防火墙的设计与实现  

Design and Implementation of the Embedded Linux Firewall

作　　者：饶明[1] 杜忠辉[1] 韩琦[1] 李琼[1] 

机构地区：[1]哈尔滨工业大学计算机科学与技术学院,哈尔滨150001

出　　处：《智能计算机与应用》2011年第3期35-39,共5页Intelligent Computer and Applications

基　　金：国家自然科学基金（60832010 61100187）

摘　　要：针对嵌入式Linux防火墙进行设计并加以实现及测试。首先,提出了基于ARM处理器的嵌入式Linux防火墙的体系架构,给出了Linux一种内核裁剪定制的方案;接着,针对Netfilter/Iptables在大数量规则集下性能低下的问题,提出了Iptables结合NF-hipacI、pset使用的解决方案,并成功实现了移植;最后,针对实现的系统,给出了完整详细的功能及性能测试结果。功能测试结果表明了系统设计的合理性和有效性,性能测试结果指出了影响系统性能的关键参数,为进一步优化系统提供了参考和依据。In this paper,a project is designed and tested for embedded Linux firewall.Firstly,a system framework of embedded Linux firewall based on ARM processor is proposed and a scheme of Linux kernel reducing is designed.Secondly,considering the poor performance of Netfilter/Iptables in large number rules set,a method of Iptables combining with NF-hipac and Ipset is introduced,and it is transplanted successfully.Finally,with the accomplished system,the integrated and detailed function and performance tests are provided.The function experiments show the rationality and efficiency of the system design and the performance tests indicate the key parameters influencing the system performance,which provides the reference and basis for further optimizing the system.

关 键 词：嵌入式LINUX系统 防火墙 交叉编译 内核裁剪 

分 类 号：TP391[自动化与计算机技术—计算机应用技术] TN911.73[自动化与计算机技术—计算机科学与技术]