為了解決防火墻對(duì)IPv6 協(xié)議的兼容及對(duì)內(nèi)部網(wǎng)絡(luò)之間安全的保障問(wèn)題，本文設(shè)計(jì)實(shí)
現(xiàn)了基于Intel Xscale IXP425 處理器的嵌入式IPv6 防火墻。該防火墻可以通過(guò)WEB 遠(yuǎn)程加以管理，對(duì)IPv6 網(wǎng)絡(luò)包和IPv4 網(wǎng)絡(luò)包均可以進(jìn)行良好的過(guò)濾。防火墻能夠判斷出網(wǎng)絡(luò)包的協(xié)議類型，分別加以處理，實(shí)行動(dòng)態(tài)包過(guò)濾，并可以解決IPv6 分片攻擊問(wèn)題。防火墻硬件系統(tǒng)基于IXP425 處理器，該處理器具有良好的網(wǎng)絡(luò)特性，擁有分布式處理架構(gòu)，并行方式執(zhí)行其指令流。處理器的高速性保證了嵌入式IPv6 防火墻處理網(wǎng)絡(luò)數(shù)據(jù)包的高效性。防火墻軟件系統(tǒng)基于Linux 的Netfilter 框架，該框架對(duì)網(wǎng)絡(luò)包的處理體系十分成熟，從而保證了嵌入式IPv6 防火墻運(yùn)行時(shí)的穩(wěn)定性和準(zhǔn)確性。
關(guān)鍵字：IPv6,防火墻，IXP425，網(wǎng)絡(luò)
Abstract: In order to solve the problem of the firewall's compatibility to IPv6 protocol and the
security among the internal nets, the paper designs and implements the embedded IPv6 firewall based on Intel XScale IXP425 network processor .This firewall can be managed by visting WEB page from remote machine and can filter both Ipv6 packet and IPv4 packet. It can identify the protocol of the net packet and process it in respective ways with the main method of Dynamic Packet Filtering.The firewall also solves the problem of IPv6 fragmentation. The hardware system of the firewall is based on IXP425 network processor with good network characteristic, whose distributed processing framework and parallel implementation of its order flows ensure the embedded IPv6 firewall processes the data packet with high speed. The software system of the firewall is based on the Netfilter framework of the Linux with a sophisticated system to process the network packet .The framework support the embedded IPv6 firewall run with high stability and veracity .
Key word:IPV6,Firewall, IXP425，Network