CN100530205C

CN100530205C - Firewall device and setting method thereof

Info

Publication number: CN100530205C
Application number: CNB031397190A
Authority: CN
Inventors: 周星雨; 何唐
Original assignee: Hongfujin Precision Industry Shenzhen Co Ltd; Hon Hai Precision Industry Co Ltd
Current assignee: Hongfujin Precision Industry Shenzhen Co Ltd; Hon Hai Precision Industry Co Ltd
Priority date: 2003-07-05
Filing date: 2003-07-05
Publication date: 2009-08-19
Anticipated expiration: 2023-07-05
Also published as: CN1567333A

Abstract

It is a kind of firewall apparatus and its setting method. This firewall apparatus comprises firewall hardware structure and firewall software system. Among which, the firewall hardware structure comprises at least three network ports; the firewall software system comprises a command line interface, a WEB management interface, a setting management module, a Lib sharing database and a tool management module. When setting the firewall, first, user inputs command to system through command line interface or WEB management interface; then system checks, pretreats and compiles the command; and opens the sub-database that needs to change setting in Lib sharing database; and changes the regulation and list in this sub-database; then stores and closes the sub-database after change, at last returns the database change result to user and finish the setting of firewall apparatus.

Description

Firewall device and method to set up thereof

[technical field]

The invention relates to a kind of firewall device and method to set up thereof.

[background technology]

Fire wall is a kind of system or system in combination that strengthens border between two or more networks, it is the controlled access point between a network and other network, can be divided into hardware firewall and software firewall, it can scan its all-network communication of flowing through, and filter out some aggressive operations, in order to avoid objective network wrecks, fire wall can also be closed the port that seldom uses, but also can forbid the communication of particular port and forbid visit, thereby prevent all communications from not clear invador from some special website.

There is the system architecture complexity mostly in present fire wall; loaded down with trivial details or the not high shortcoming of security performance of method to set up; as No. the 97115121.0th, Chinese patent application; it is by packet filter; safety governor; system administration manager and card reader four parts are formed; packet filter is between Intranet and router; safety governor is between system administration manager and Intranet; system administration manager is carried out insulation blocking; card reader links to each other with system administration manager; system administration manager will be when relating to the network security controlled variable and be configured in the fire wall; must insert safety card to the card reader mouth; and input correct PIN code; just can enter configuration status; because it has been set up card reader and must insert safety card and import PIN code the fire wall parameter is configured before, thereby increased the complexity of system and to the operation easier of this fire wall parameter configuration.

[summary of the invention]

In view of this, need provide a kind of firewall device, its system architecture is simple, be provided with conveniently.

Also need to provide a kind of fire wall method to set up, it is provided with conveniently, and has higher safety performance.

A kind of firewall device, it comprises firewall hardware structure and firewall software system, wherein the firewall hardware structure comprises three network ports at least.The firewall software system comprises command line interface, WEB management interface at least, management module, shared data bank and tool management module is set.Wherein, command line interface and WEB management interface are used to offer a kind of management interface that the firewall configuration parameter is set of user.The management module is set to be used for loading the user command file to shared data bank dynamically.Shared data bank is used to store a plurality of subdata bases, and checks whether the user command file is legal.The tool management module is a kind of IP packet filtration system that is integrated in the linux kernel, is used for revising the rule and the tabulation that are stored in shared data bank.

A kind of firewall device method to set up may further comprise the steps: the user at first passes through command line interface or WEB management interface to system's input command; Command line interface and WEB management interface are submitted to described order the management module are set; The management module is set then can be started the foundation of communication call function and shared data bank and get in touch and shared data bank is sent in order; The shared data bank system can check whether this order is legal, does not conform to rule and returns and show error message, as order legal this system then can those legal orders of pre-service; Shared data bank compiles these order and submits to the tool management module; It opens the subdata base that needs to revise setting in the shared data bank tool management module, and the rule and the tabulation that are stored in this subdata base are made amendment; Finish behind this modification process deposit and close this subdata base; And system returns to the user with the database update result.

Firewall device of the present invention has the security performance height, and system architecture is simple and advantage easily is set.

[description of drawings]

Fig. 1 is the hardware configuration synoptic diagram of firewall device of the present invention.

Fig. 2 is the software systems synoptic diagram of firewall device of the present invention.

Fig. 3 is the method to set up process flow diagram of firewall device of the present invention.

[embodiment]

Firewall device of the present invention comprises firewall hardware structure and firewall software system, sees also Fig. 1, is the hardware configuration synoptic diagram of firewall device of the present invention.This firewall hardware structure comprises three network ports at least, and it is respectively four port lan ports 12, WAN port 14 and DMZ (Demilitarized Zone) port one 6.Wherein, lan port 12 is used to link inner LAN, and WAN port 14 is used to link outside Wide Area Network, and DMZ port one 6 is used to link the network of outside DMZ framework fire wall.

Seeing also Fig. 2, is the software systems synoptic diagram of firewall device of the present invention.This firewall software system comprises command line interface 21, WEB management interface 22 at least, management module 23, shared data bank 24 and tool management module 25 is set.In the embodiment of the present invention, shared data bank 24 is the Lib shared data bank.Wherein, command line interface 21 and WEB management interface 22 are used to offer a kind of management interface that the firewall configuration parameter is set of user.Management module 23 is set is used for dynamically, and this Lib shared data bank 24 further comprises Access subdata base 241, Nat subdata base 242, If subdata base 243 and Pool subdata base 244 to Lib shared data bank 24 loading command files.Wherein, Access subdata base 241 is used for memory access tabulation and access rule, and this Nat subdata base 242 is used to store NAT (Network Address Translation) rule; If subdata base 243 is used for storage system interface information; Pool subdata base 244 is used to store nat pool tabulation (NAT POOLLIST).Tool management module 25 in the above-mentioned firewall software system is a kind of IP packet filtration system that is integrated in the linux kernel, it includes kernel spacing assembly 251 and user's space assembly 252, wherein, kernel spacing assembly 251 is parts of kernel, form by some packet filtration tables, these tables comprise kernel and are used for the rule set that the control information packet filtering handles, user's space assembly 252 then is a kind of instrument, it makes insertion, the rule of revising and removing in the packet filtration table becomes easy, by using user's space, can make up the customized rules of oneself easily, and with these rale store in the packet filtration table of kernel spacing.

Seeing also Fig. 3, is the method to set up process flow diagram of firewall device of the present invention.At first, the user, is submitted to order by it management module 23 (step 110) is set to system's input command (step 100) by command line interface 21 or WEB management interface 22.Then, 23 of modules of management being set can start 24 foundation of communication call function and Lib shared data bank and get in touch and this Lib shared data bank 24 (step 120) is sent in order.After this, Lib shared data bank 24 can be checked this order whether legal (step 130), does not conform to rule and returns and show error message (step 140).As order legally, then Lib shared data bank 24 can those legal orders (step 150) of pre-service, to reject redundance character (for example TAB key and space bar) wherein, then compile these order and submit to tool management module 25 (step 160).Thereby tool management module 25 is opened the subdata base that needs to revise setting in the Lib shared data banks 24, and to being stored in rule in this subdata base and tabulation make amendment (step 170).After finishing modification process the deposit and close subdata base (step 180), final system returns to user's (step 190) to finish the setting to firewall device with the database update result.

Claims

1. A firewall device, comprising: a firewall hardware structure, which at least includes three network ports; and a firewall software system, characterized in that, the firewall software system at least includes:

command line interface;

WEB management interface, wherein, the WEB management interface and the command line interface are used to provide users with a management interface for setting firewall configuration parameters;

Setting up a management module, which is used to dynamically load user command files into the shared database;

Shared database, which is used to store multiple sub-databases, and checks whether the user command file is legal; and

The tool management module is an IP packet filtering system integrated in the Linux kernel, and is used to modify the rules and lists stored in the sub-database of the shared database.

2 . The firewall device according to claim 1 , wherein the network ports include four-port LAN ports, which are used to connect to internal LANs. 3 .

3. The firewall device according to claim 1, wherein the network port comprises a wide area network port, which is used to connect to an external wide area network.

4 . The firewall device according to claim 1 , wherein the network port is a DMZ port, which is used to connect to a network of an external DMZ-based firewall.

5. The firewall device according to claim 1, wherein the shared database comprises a first sub-database for storing access lists and access rules.

6. The firewall device according to claim 1, wherein the shared database comprises a second sub-database for storing NAT rules.

7. The firewall device according to claim 1, wherein the shared database comprises a third sub-database for storing system interface information.

8. The firewall device according to claim 1, wherein the shared database comprises a fourth sub-database for storing a list of NAT pools.

9. The firewall device according to claim 1, wherein the tool management module includes a kernel space component, which is composed of a plurality of packet filter tables, wherein the packet filter table includes a kernel for A rule set that controls packet filtering processing.

10. The firewall device according to claim 1, wherein the tool management module includes a user space component, which is used to modify or delete the rules in the packet filtering table.

11. A firewall setting method, characterized in that, said firewall setting method comprises the following steps:

Users input commands to the system through the command line interface or WEB management interface;

Command line interface or WEB management interface submits commands to the configuration management module;

Set the management module to start the communication call function to establish contact with the shared database and send the command to the shared database;

The shared database checks whether the order is legal, returns and displays an error message if the order is illegal, and preprocesses these legal orders as the system is legal if the order is legal;

The shared database compiles these legal commands and submits them to the tool management module;

The tool management module opens the sub-database that needs to be modified in the shared database, and modifies the rules and lists stored in the sub-database;

After completing the modification process, save and close the sub-database;

The shared database returns the database modification result to the user.

12. The firewall setting method according to claim 11, characterized in that, when said shared database preprocesses these legal commands, redundant characters in these commands will be eliminated.