Linux,Unix 建立网络防火墙
我们能够用LINUX建立一个企业级的防火墙吗？答案是肯定的，不只能够，而且功能强大。我们在这里不方案触及ipchains，究竟iptables能够做的更超卓。iptables对包的管理和ipchains很不一样，现已从链变成了堆叠表,更重要的是iptables能够是基于状况的，而不只仅是包过滤的。用它能够构建强大的防火墙，听说曾经有人用它写过一万行的代码，想来一定十分很超卓。防火墙的命令防火墙在施行安全的过程中，至关重要的。一个防火墙策略要契合四个方案，而每个方案一般都不是一个单独的设备或软件来实现的。大多数状况下防火墙的组件放在一同使用以满意企业安全意图需要。防火墙要能满意以下四个方案：1gt;??实现一个企业的安全策略防火墙的首要意图是强行执行你的安全策略，比如你的安全策略需要对MAIL服务器的SMTP流量做限制，那么你要在防火墙上强行这些策略。2gt;??创建一个阻塞点防火墙在一个企业的私有网络和分网间建立一个查看点。这种实现请求一切的流量都要通过这个查看点。一旦查看点被建立，防火墙就能够监视，过滤和查看一切进出的流量。网络安全中称为阻塞点。通过强行一切进出的流量都通过这些查看点，管理员能够集中在较少的当地来实现安全意图。3gt;??记录internet流动防火墙还能强行记录日志，而且提供警报功能。通过在防火墙上实现日志服务，管理员能够监视一切从外部网或互联网的访问。好的日志是恰当网络安全的有效工具之一。4gt;??限制网络露出防火墙在你的网络周围创建了一个维护的鸿沟。而且关于公网躲藏了内部系统的一些信息以添加保密性。当远程节/点侦测你的网络时，他们只是能看到防火墙。远程设备将不会认识你内部网络的设计以及都部分啥。防火墙提高认证功能和对网络加密来限制网络信息的露出。通过对所能进入的流量进行查看，以限制从外部发起的攻击。(Can we build an enterprise-grade firewall with LINUX? The answer is yes, not only can, but powerful. We do not plan to touch ipchains here, after all iptables can do better. iptables' management of packets is very different from ipchains. It has now changed from a chain to a stack table. More importantly, iptables can be based on status, not just packet filtering. It can be used to build a powerful firewall. I heard that someone has written 10,000 lines of code with it. I think it must be very excellent. Firewall commands Firewalls are very important in the process of implementing security. A firewall policy should conform to four schemes, and each scheme is generally not implemented by a separate device or software. In most cases the components of the firewall are used together to meet the needs of enterprise security intent. The firewall must be able to satisfy the following four schemes: 1gt;?? The primary purpose of implementing an enterprise security policy is to enforce your security policy. For example, your security policy needs to limit the SMTP traffic of the MAIL server, then you need to These policies are enforced on the firewall. 2gt;?? Create a choke point firewall to establish a point of view between an enterprise's private network and sub-networks. This implementation requests that all traffic go through this viewpoint. Once the point of view is established, the firewall can monitor, filter and view all incoming and outgoing traffic. Known in cybersecurity as choke points. By forcing all incoming and outgoing traffic to pass through these viewing points, administrators can focus on fewer locales to achieve security intent. 3gt;?? Recording the Internet flow firewall can also force log records, and provide alarm functions. By implementing logging services on the firewall, administrators can monitor all access from the extranet or the Internet. A good log is one of the most effective tools for proper network security. 4gt;?? Restricting network exposure The firewall creates a maintenance divide around your network. And about the public network hiding some information about internal systems to add privacy. When remote nodes/points probe your network, they can only see the firewall. Remote devices will not know the design of your internal network and what it is all about. The firewall enhances the authentication function and encrypts the network to limit the exposure of network information. Limit attacks from the outside by viewing the incoming traffic.)
页:
[1]