桑达（SED-FW2003）防火墙技术的研究——NAT及透明代理的设计与实现

【作者】 钱伟中；

【导师】 袁宏春；

【作者基本信息】 电子科技大学 ， 计算机应用技术， 2002， 硕士

【摘要】 随着Internet的快速发展，网络安全问题日益突出，防火墙在这一实际问题上提出了一整套解决方案。课题目标是完成一台功能完备的防火墙产品样机，达到国家公安部规定的国家二级防火墙标准。 NAT和透明代理是其中非常重要的功能模块。NAT对内网主机的出网数据包进行网络地址变换，内网主机可以使用保留地址上网，外网主机无法直接访问内网主机，从而实现单向通信。NAT同时可以起到节约合法IP地址的作用。NAT通常嵌入到包过滤模块中实现。透明代理是指内网主机需要访问外网主机时，不需要做任何设置，完全意识不到防火墙的存在，而完成内外网的通信。它的引入可以对出人防火墙的应用层数据进行强制过滤，这一过程是对用户透明的。NAT和透明代理为防火墙系统提供更强大的安全功能，是防火墙安全系统中非常重要的组成部分。 本文详细分析了NAT和透明代理的技术原理，并论述了NAT和透明代理在SED-FW2003中的设计与实现。其中，NAT包括PAT和DNAT两个功能在实时、嵌入式操作系统中的实现，支持TCP、UDP和ICMP协议，采用端口映射的方法，实现多个内网地址使用一个防火墙连接公网地址的方式。采用HASH算法，减少了查找映射表的处理时间，通过对序列号的修补，解决了NAT技术不能支持FTP的问题。透明代理包括透明通道和应用代理的实现。实现的相关应用协议包括HTTP、FTP、TELNET、NNTP、POP3、SMTP，并实现了URL过滤、命令过滤和邮件规则过滤功能。 联调结果证明，我们开发的防火墙功能样机已经具备较好的功能，稳定性良好，达到了预期的设计目标。更多还原

【Abstract】 With the rapid development of the Internet, the problem of network security is outstanding increasingly. Firewall technology gives a solution to the problem.Our task is to finish a product sample with full functions and to achieve the national standard of 2nd level firewall established by the Police Department.NAT and transparent proxy are very important function modules of firewall.NAT would do network address translation for outbound packet so that inside hosts can use reserved IP addresses and outside hosts can not visit inside ones directly to realize one-way communication. Meanwhile, needed valid IP address number can be decreased by using NAT embedded usually in packet filtering module. Transparent proxy is that inside hosts can visit Internet without doing any set-up and knowing exsitence of firewall. All application layer data are forced to be filterd by proxy when transparent proxy is used and the process is transparent for users.NAT and transparent proxy provide a more powerful function for the firewall system.They are very important components of the firewall security system.This paper expatiates technical principles of NAT and transparent proxy and discusses the design and implementation of NAT and transparent proxy in SED-FW2003. NAT implements the functions of PAT and DNAT in the real time embedded operation system with the result of supporting protocols of TCP UDP and ICMP. The way in which many inside hosts use one IP has been realized by port mapping.Processing time is reduced due to the adoption of HASH.The problem that NAT fails to support FTP have been settled by sequence repairing. Transparent proxy including transparent channel and application level proxy would deal with its associated protocols of HTTP,FTP,TELNET,NNTP,POP3,SMTP,resulting in the application data filtration of URI command and mail rules.The debugging shows that the product sample has good functions and stability and the design goal has been achieved.更多还原