【摘要】 针对包过滤防火墙和状态检测防火墙的安全控制层次较低、控制能力有限、不能依据数据包内容进行控制的缺点,介绍一种在FreeBSD的IPFW防火墙之上,使用转发套接字建立进程级应用层防火墙的技术。通过这种技术建立的应用层防火墙既保留包过滤防火墙和状态检测防火墙对用户透明的优点,又具有针对特定应用进行访问控制的能力。更多还原

【Abstract】 Package-filter firewall and state-check firewall work at network layer,they have very limited control abilities and can not check the content of IP data package.In this paper,we introduce a technology to develop application layer firewall which running as user process.With this technology,we can develop application layer firewall with the advantage of user-transparency,good performance,etc.This technology is based on FreeBSD’s IPFW firewall system and divert socket.更多还原