These rules are stored in special-purpose packet filtering tables integrated in the Linux kernel. 这些规则存储在专用的信息包过滤表中,而这些表集成在Linux内核中。
Such firewalls can remember previous decisions taken regarding packet filtering and make new decisions based on them. 这类防火墙会记得先前关于信息包过滤所做的决定,并根据它们做出新的决定。
After the rules are built and chains are in place, the real work of packet filtering starts. 建立规则并将链放在适当的位置之后,就可以开始进行真正的信息包过滤工作了。
The netfilter/ iptables system gives its users total control over firewall configuration and packet filtering. netfilter/iptables系统使其用户可以完全控制防火墙配置和信息包过滤。
The netfilter/ iptables IP packet filtering system is the latest among Linux packet filtering solutions like ipfwadm and ipchains and is also the first one to be integrated into the Linux kernel. 在如ipfwadm和ipchains这样的Linux信息包过滤解决方案中,netfilter/iptablesIP信息包过滤系统是最新的解决方案,而且也是第一个集成到Linux内核的解决方案。
Inside the packet filtering tables the rules are grouped together in what are known as chains. 在信息包过滤表中,规则被分组放在我们所谓的链(chain)中。
A table is a packet filtering table that contains rules and chains dealing with specific kinds of packets only. 表是包含仅处理特定类型信息包的规则和链的信息包过滤表。
The netfilter/ iptables IP packet filtering system is a powerful tool that is used to add, edit and remove the rules that a firewall follows and consists of while making packet filtering decisions. netfilter/iptablesIP信息包过滤系统是一种功能强大的工具,可用于添加、编辑和除去规则,这些规则是在做信息包过滤决定时,防火墙所遵循和组成的规则。
The netfilter/ iptables IP packet filtering system, although referred to as a single entity, is actually made up of two components: netfilter and iptables. 虽然netfilter/iptablesIP信息包过滤系统被称为单个实体,但它实际上由两个组件netfilter和iptables组成。
The iptables component is a tool, also known as userspace, which facilitates inserting, modifying and removing rules in the packet filtering tables. iptables组件是一种工具,也称为用户空间(userspace),它使插入、修改和除去信息包过滤表中的规则变得容易。
This information about states is used by a firewall when it is making new packet filtering decisions to increase its efficiency and speed. 在决定新的信息包过滤时,防火墙所使用的这些状态信息可以增加其效率和速度。
If the packet originated from outside and is destined for the system and the firewall is on, the kernel passes it on to the INPUT chain of the kernelspace packet filtering table. 如果信息包源自外界并前往系统,而且防火墙是打开的,那么内核将它传递到内核空间信息包过滤表的INPUT链。
It allows the creation of customized rules for firewalls that govern packet filtering. 它允许为防火墙建立可定制化的规则来控制信息包过滤。
The filter table is used for general packet filtering and consists of INPUT, OUTPUT, and FORWARD chains. filter表用于一般的信息包过滤,它包含INPUT、OUTPUT和FORWARD链。
Rules govern packet filtering by providing the firewall with instructions on what to do with packets coming from a certain source, going to a certain destination or having a specific protocol type. 通过向防火墙提供有关对来自某个源、到某个目的地或具有特定协议类型的信息包要做些什么的指令,规则控制信息包的过滤。
This process is known as packet filtering. 我们将该过程称为信息包过滤。
Now you've learned how to build basic rules and chains and how to add or remove them from the packet filtering tables. 现在,您已经学习了如何建立基本的规则和链以及如何从信息包过滤表中添加或删除它们。
Understanding firewall configuration and packet filtering 理解防火墙配置和信息包过滤
With packet filtering, you have access to deliver the package yourself. 使用包过滤时,你自己来送交此小数据包。
Packet filtering is used between the internal host and external host; the filter system is a router or a host. 数据包过滤用在内部主机和外部主机之间,过滤系统是一台路由器或是一台主机。
Some vendors are developing firewalls that overcome many of these problems and combine the advantages of application gateways and packet filtering. 有些供应商在开发能克服其中许多问题和把应用入口与包过滤之优点结合起来的防火墙。
The packet filtering firewall and proxy firewall are analyzed and compared in this paper, the methods that can solve the existed problems are also put forward. 对包过滤防火墙和代理防火墙技术进行了比较分析,并针对二者存在的问题提出了解决的方法。
Most commercial routers have some kind of built-in packet filtering capability. 多数商品化的路由器都有某种内建的包过滤功能。
A system architecture against ARP spoofing based on packet filtering 一种基于报文过滤防御ARP欺骗的系统架构