计算机安全超级工具（十一）－防火墙

BSD ipfw

http://www.freebsd.org/doc/en/books/handbook/firewalls-ipfw.html

 

The IPFIREWALL (IPFW ) is a FreeBSD sponsored firewall software application authored and maintained by FreeBSD volunteer staff members. It uses the legacy stateless rules and a legacy rule coding technique to achieve what is referred to as Simple Stateful logic.

The IPFW sample ruleset (found in /etc/rc.firewall and /etc/rc.firewall6 ) in the standard FreeBSD install is rather simple and it is not expected to be used directly without modifications. The example does not use stateful filtering, which is beneficial in most setups, so it will not be used as base for this section.

The IPFW stateless rule syntax is empowered with technically sophisticated selection capabilities which far surpasses the knowledge level of the customary firewall installer. IPFW is targeted at the professional user or the advanced technical computer hobbyist who have advanced packet selection requirements. A high degree of detailed knowledge into how different protocols use and create their unique packet header information is necessary before the power of the IPFW rules can be unleashed. Providing that level of explanation is out of the scope of this section of the Handbook.

IPFW is composed of seven components, the primary component is the kernel firewall filter rule processor and its integrated packet accounting facility, the logging facility, the divert rule which triggers the NAT facility, and the advanced special purpose facilities, the dummynet traffic shaper facilities, the fwd rule forward facility, the bridge facility, and the ipstealth facility. IPFW supports both IPv4 and IPv6.

 

 

netfilter/iptables

http://www.netfilter.org/

What can I do with netfilter/iptables?

• build internet firewalls based on stateless and stateful packet filtering
• use NAT and masquerading for sharing internet access if you don't have enough public IP addresses
• use NAT to implement transparent proxies
• aid the tc and iproute2 systems used to build sophisticated QoS and policy routers
• do further packet manipulation (mangling) like altering the TOS/DSCP/ECN bits of the IP header