CHX-I防火墙官方教程-附带翻译.docVIP

CHX-I Documentation Introduction 介绍 In its default configuration the packet/payload filter does not impose any security restrictions on any type of traffic. 默认配置下，包过滤器和负载过滤器没有任何规则，可以允许任何数据包通过。 The CHX suite of tools is not a personal firewall and should not be used by those expecting out-of-the box security configurations or unfamiliar with TCP/IP networking and IP security in general. Several configuration templates are provided to assist first time users in grasping CHX-I filtering concepts. These templates can be obtained in the download area. CHX不是防火墙软件，如果你对TCP/IP协议和IP安全方面的知识不了解，而且希望CHX是傻瓜型的防火墙—经过简单配置就可以使用—的话，那我们建议你还是不要使用CHX了。我们在网站的下载中心提供了几个配置模板，初学者可以通过研究这些模板来搞清CHX-I的过滤思想。 First time users are encouraged to make extensive use of the available logging features (and the GoTo Related Filter feature) when debugging their CHX IP security policies. 首次使用CHX的用户，在编辑和调试自己的IP过滤策略之前，建议您认真研究一下CHX的日志（利用日志的跳转功能，查找对应的过滤器规则，并研究他）。 The packet filter cannot facilitate address/port translation in gateway environments. The CHX-I NAT module was designed to provide this functionality as either a stand alone or add-on to the packet filter management console. 对于通过在网关模式下上网的用户要注意：包过滤器没有地址/端口转换功能。但是，CHX-I的NAT模块可以完成这个功能，而且不管是单独使用该模块，还是把它添加到包过滤器的管理单元内。 The payload filter extends the functionality of the packet filter by inspecting and editing TCP/UDP/ICMP data. The payload filter can trigger permissive or prohibitive packet filter rules as well as other payload rules (chained payload rule sets). 负载过滤器负责检查和编辑TCP/UDP/ICMP数据，从而扩展了包过滤器的功能。一个负载过滤器规则能够触发其他负载过滤器规则（可设置成链式过滤器规则），也能触发包过滤器规则，从而达到禁止或允许数据包通过的目的。 The CHX suite of network and security tools can be deployed on gateways (e.g. bridge, router, NAT) or distributed on servers/workstations. CHX网络和安全软件包可以被配置在网关模式下（如：桥接、路由、NAT模式），也可以在服务器/工作站上使用。 Upgrades From 2.x Notes General upgrade(from 2.x) notes: 升级到3.0的注意事项： - prior to installing CHX 3.0 please un-install any previous versions of the packet filter. - 请先卸载原来版本的包过滤器，再直接安装CHX3.0即可 - yo