討論了Linux操作系統內核的Ipchains軟件包工作原理。利用Ipchains中的輸入鏈、輸出鏈、轉發鏈和自定義鏈等防火鏈，通過設置一系列規則，過濾被主機接收、發送或轉發的數據包或主機從一個網卡轉發到另一個網卡的數據包，實現根據源地址、目的地址、協議號等信息控制訪問，企業無須專門的防火墻產品，即可建立包過濾防火墻。該技術適用于中小企業或部門級用戶。最后給出一個在局域網環境下用Ipchains實現Linux防火墻的具體實例。

關 鍵 詞 Linux操作系統; Ipchains軟件包; 防火鏈; 包過濾; 防火墻; 中小企業

Mainly on the principle of Ipchains embedded in Linux kernel has been discussed. A series of rules can be set up with the input chains or output chains or forward chains or user defined chains, these rules can filter the packet of input or output or forward by host computer and can also filter packet from one network card to another network card by computer. Therefore, the access control can be implemented base on data of source address and destination address and protocol number. This technology is suitable for the users such as small enterprise or department to set up a firewall without professional firewall production. An example is presented for demonstrating how to use the proposed technology as firewall in LAN.