📄 00000008.htm
字号:
<HTML><HEAD> <TITLE>BBS水木清华站∶精华区</TITLE></HEAD><BODY><CENTER><H1>BBS水木清华站∶精华区</H1></CENTER>发信人: zixia (Do you zixia tonight), 信区: Linux <BR>标 题: 6. How Packets Traverse The Filters <BR>发信站: BBS 水木清华站 (Wed Oct 11 01:17:47 2000) WWW-POST <BR> <BR> Linux 2.4 Packet Filtering HOWTO: How Packets Traverse The Filters (p1 of <BR>2)
<BR> Next Previous Contents
<BR>Lin here a <BR>Ma
<BR> mo----------------------------------------------------------------------o
<BR>
<BR>6. How Packets Traverse The Filters
<BR>
<BR>3.1The kernel starts with three lists of rules in the `filter' table; these
<BR> lists are called firewall chains or just chains. The three chains are
<BR> called INPUT, OUTPUT and FORWARD.
<BR>
<BR> This is very different from how the 2.0 and 2.2 kernels worked!
<BR>
<BR> For ASCII-art fans, the chains are arranged like so:
<BR>
<BR> _____ e,
<BR> Incoming / \ Outgoing
<BR> -->[Routing ]--->|FORWARD|-------> the
<BR> [Decision] \_____/ ^ e
<BR> | | <BR>on
<BR> v ____
<BR> ___ / \
<BR> / \ |OUTPUT|
<BR> |INPUT| \____/
<BR> \___/ ^
<BR> | |
<BR> ----> Local Process ----
<BR>
<BR> The three circles represent the three chains mentioned above. When a <BR>n
<BR> packet reaches a circle in the diagram, that chain is examined to decide
<BR> the fate of the packet. If the chain says to DROP the packet, it is <BR>killed
<BR> there, but if the chain says to ACCEPT the packet, it continues <BR>traversing
<BR> the diagram.
<BR>
<BR> A chain is a checklist of rules. Each rule says `if the packet header
<BR> looks like this, then here's what to do with the packet'. If the rule
<BR> doesn't match the packet, then the next rule in the chain is consulted.
<BR> Finally, if there are no more rules to consult, then the kernel looks at
<BR> the chain policy to decide what to do. In a security-conscious system,
<BR> this policy usually tells the kernel to DROP the packet.
<BR>
<BR> 1. When a packet comes in (say, through the Ethernet card) the kernel
<BR> first looks at the destination of the packet: this is called
<BR>Lin `routing'. here a <BR>M
<BR> m2. If it's destined for this box, the packet passes downwards in the o
<BR> diagram, to the INPUT chain. If it passes this, any processes waiting
<BR> for that packet will receive it.
<BR> 3. Otherwise, if the kernel does not have forwarding enabled, or it
<BR>3.1 doesn't know how to forward the packet, the packet is dropped. If
<BR> forwarding is enabled, and the packet is destined for another network
<BR> interface (if you have another one), then the packet goes rightwards
<BR> on our diagram to the FORWARD chain. If it is ACCEPTed, it will be
<BR> sent out.
<BR> 4. Finally, a program running on the box can send network packets. These
<BR> packets pass through the OUTPUT chain immediately: if it says ACCEPT,
<BR> then the packet continues out to whatever interface it is destined
<BR> for. e,
<BR>
<BR> ----------------------------------------------------------------------e
<BR> e
<BR> Next Previous Contents on <BR>-- <BR>))))))))))))))))))))))))))))))))))))))))))))))))))) <BR> ((((((((((((生命的欢喜可以再影印一张吗?(((((((((((( <BR> ))))))))))))老去的热情可以再拉皮整形吗?)))))))))))) <BR> ((((((((((((病中的真理可以再传真校对吗?(((((((((((( <BR> ))))))))))))死掉的爱情可以再输入键出吗?)))))))))))) <BR> ((((((((((((((((((((((((((((((((((((((((((((((((((( <BR> <BR>※ 来源:·BBS 水木清华站 smth.org·[FROM: 202.112.45.49] <BR><CENTER><H1>BBS水木清华站∶精华区</H1></CENTER></BODY></HTML>
⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -