基于netfilter/iptables和TC的LAN防火墙设计及流量控制  

Design of LAN firewall and traffic control based on netfilter/iptables and TC

作　　者：谢陶[1] 林岩[1] 

机构地区：[1]北京航空航天大学自动化科学与电气工程学院,北京100191

出　　处：《太赫兹科学与电子信息学报》2015年第5期799-804,共6页Journal of Terahertz Science and Electronic Information Technology

摘　　要：分析了Linux内核netfilter/iptables模块实现防火墙以及流量控制(TC)模块实现流量控制的原理和基本语法规则,在此基础上,针对小型局域网(LAN)提出了一套网络管理系统。该系统利用iptables实现防火墙及网络IP地址转换功能,并利用基于分层令牌桶队列规定的TC实现流量控制功能。实验结果表明,结合iptables和TC的网络管理系统能够有效保护网络安全,合理限制网络设备带宽,进而保障局域网服务质量。The principle and basic programming syntax of firewall tool―netfilter/iptables and traffic control tool―Traffic Control(TC) based on Linux are analyzed. According to features of small-scale Local Area Network(LAN), a network management system is proposed. This system implements packet filtering and network IP address translation by iptables, and implements traffic control by Hierarchical Token Bucket(HTB)-based TC. Test results indicate that the proposed system based on iptables and TC can effectively protect network security, reasonably constrain the bandwidth of network devices and ensure quality of services.

关 键 词：防火墙 流量控制 局域网 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]