Abstract: For the safety of LAN and using firewall thriftily,the authors analyze the architecture of Netfilter in Linux2.4 kernel.Then the authors implement the firewall system based on embedded Linux OS,which has basic functions as Package Filtration,URL filtration,NAT and log.And,the firewall system integrates with DMZ which establishes a buffer zone between Internet and Intranet to make the Intranet safer,and connection tracking which maintains a table for connection track in order to get the more safer than package filtration.What’s more,this system provides friendly GUI for configuring system.

Key words: MINI Linux, firewall, iptables, NAT, DMZ

摘要： 为了构建安全可靠的网络,同时降低使用防火墙的成本,对Linux2.4内核防火墙结构Netfilter的实现机制进行了深入的研究和分析,并利用该机制设计实现了一个嵌入式Linux防火墙系统,该防火墙实现完善了包过滤、URL过滤、NAT和日志等防火墙基本功能,同时集成了非军事区（DMZ）,为Internet和Intranet之间建立了缓冲地带,以保证Intranet的安全。此外,该防火墙系统还集成了状态检测技术,可在内存中维护一个跟踪连接状态的表,比简单包过滤防火墙具有更大的安全性,并提供友好的管理配置界面。

关键词: MINI Linux, 防火墙, iptables, NAT, DMZ