中文摘要：

随着IPv6协议带来网络地址的增长和智能网络设备的发展，各种专有网络同外界设备，特别是具有单独地址的个人设备的互联成为网络互连中的重要应用场景，保证其安全性和可控性成为考虑的主要因素．IPSec-VPN是当下主流的专用网络安全通信技术，但存在安全控制粒度不灵活，支持的网络拓扑结构不灵活等问题．本文提出一种新的IPSec包封装模式-混合模式，并给出基于Linux内核包过滤机制的混合模式IPSec VPN的设计与实现．该方案能支持LAN-to-LAN环境和远程访问IPSec VPN环境下的安全通信并实现网关对访问者的完全透明，是一种新型的IPSec-VPN解决方案．

英文摘要：

Development of IPv6 networks brought the need of secure communication between private networks and different kind of personal devices. Secure and scalable communication protection scheme is required. While IPSec-VPN is a popular solution,it has several drawbacks such as forced requirement of accessor＇s knowledge about VPN gateways. In this paper,we proposed a new IPSec-VPN packaging mode-hybrid mode ,and gave the implementation of it using Linux kernel netfiltering scheme. Applications show that the hybrid-mode IPSec-VPN works well for different VPN topologies and makes VPN gateways transparent to users.