针对嵌入式Linux防火墙进行设计并加以实现及测试。首先,提出了基于ARM处理器的嵌入式Linux防火墙的体系架构,给出了Linux一种内核裁剪定制的方案;接着,针对Netfilter/Iptables在大数量规则集下性能低下的问题,提出了Iptables结合NF-hipacI、pset使用的解决方案,并成功实现了移植;最后,针对实现的系统,给出了完整详细的功能及性能测试结果。功能测试结果表明了系统设计的合理性和有效性,性能测试结果指出了影响系统性能的关键参数,为进一步优化系统提供了参考和依据。
In this paper,a project is designed and tested for embedded Linux firewall.Firstly,a system framework of embedded Linux firewall based on ARM processor is proposed and a scheme of Linux kernel reducing is designed.Secondly,considering the poor performance of Netfilter/Iptables in large number rules set,a method of Iptables combining with NF-hipac and Ipset is introduced,and it is transplanted successfully.Finally,with the accomplished system,the integrated and detailed function and performance tests are provided.The function experiments show the rationality and efficiency of the system design and the performance tests indicate the key parameters influencing the system performance,which provides the reference and basis for further optimizing the system.