1、重慶郵電大學(xué)碩士學(xué)位論文局域網(wǎng)邊界安全防御綜合設(shè)計(jì)研究姓名：初振林申請(qǐng)學(xué)位級(jí)別：碩士專業(yè)：通信與信息系統(tǒng)指導(dǎo)教師：杜江20080524重慶郵電大學(xué)碩士論文摘要AbstractAlargelocalaleanetworkisoftendividedintosmallsubnetsformanagementandsecurityButitisnotacceptablebyalldepartmentstodeployallexclusivef

2、irewallbeforeeverysubnetAcommonlowcostcomputersupplyingprotectionforsmalllocalareanetworkscouldbeabetterchoiceLinuxisaflexibleoperatingsystemforallkindsofapplicatioI塔Deployingfirewall，IDSandIPSaccordingtoitspositioninthe

3、networkisquiteeasyBridgeworkingonthedatalinklayerCanservicetheupperapplicationsforcomplexfunctionsbesidesconnectingtwonetworksandforwardframesThethesisdesignsasystemforLANsecuritybasedontheiptablesfirewallandsnort—inline

4、IPSwhicharerunningontheLinuxbridgeandactingwithotherThissystemrunsonacommoncompmerwimtwoadaptivecards，eapturesthepacketsthroughfiltersthem，andthenforwardsthemItistransparenttootherdevicesorotherpeopleItdoesnotchangethene

5、tworktopologyBecauseofnoIPaddress，itisn’tdetectedeasilyIthelpsisolatethebadpacketsfromtheprotectedLANmeanwhilemakesitselfstableandsecureThissystemhassoftwareforguardofsnort—inlineMakingtheguardsoftwarehiddencanprotectitf

6、rombeingfoundandkilledSnort——inlineisarelativelymatureIPSwithexcellentfunctionsandperformanceinopensourcefieldStream4forstatemaintainingandsessionreassemblingisoneofthemostimportantpreprocessorsofsnort_inlinebutitdown’ts

7、upportTCPwindowscaleoptionquitewellThisthesisrevealsitsflawandprovidesaresolveforitThesolutionhasbeentestedfeasibleandworkswellinTCPconnectionswithwindowscaleoptionThisthesisdisplaystheprinciple，theprocedureandatlastthet

8、estofthewholesystemRulesofiptablesandsnort_inline，performanceofthesystemaretestedinnetworkunderV]V[wareinordertosaveresearchexpenseProtectionfunctionofthesystemdesignedbythisthesisdependsoncorrectandefficientrulesSothist