一、引言包过滤和代理系统是目前互联网络防火墙中较为普遍使用的二种技术。其中包过滤防火墙由于可以与现有的路由器集成,也可以用独立的包过滤软件实现,十分灵活方便,所以应用最为广泛。但如果产品选择和使用不当,出现的问题也是最多的。包过滤技术的主要依据是包含在IP包头中的各种信息,一般不涉及包体中的数据(当然根据包体中的关键词也可以过滤,本文不作讨论)。所以,包过 I. INTRODUCTION Packet filtering and proxy systems are the two most commonly used technologies in the Internet firewall. Packet filtering firewall which can integrate with the existing router can also be used independent packet filtering software, very flexible and convenient, so the most widely used. However, if the product is selected and used improperly, the most problems arise. The main basis of packet filtering technology is contained in the IP header of a variety of information, generally do not involve the data in the package (of course, according to the package body can also filter the keywords, this article is not for discussion). So, too