随着Internet的普及，网络在人们工作和生活中的作用越来越重要,对网络安全性的要求也越来越高。建立防火墙能够有效地分隔内部网络和外部网络，从而达到保护内部网络的目的。Linux作为一种免费的、易于管理与维护的操作系统，在稳定性等方面都独具优势，其在网络安全领域也十分出色。Linux系统自带的防火墙工具——Netfilter/IPtables凭借免费、功能强、使用灵活等优点越来越多地应用到企业内部网络中。本文阐述了Netfilter的框架结构，以及Netfilter／lPtables的工作原理，为保证企业内部网络与系统的安全打下基础。

With the popularization of Internet, the firewall is one of the effective measures to isolate the internal network from the external for the network security becomes more and more important nowadays. Linux as a prompt development OS is easy to manage and maintain, having advantage in the field of the systematic stability and so on. Linux also do well in the network security issues. Netfilter／IPtables，which is self-contained by Linux，is increasingly applied in the internal network for its free of charge，powerful functionality and better flexibility. In this paper，the frame structure of Netfilter and operational principal of Netfilter／IPtables is presented. It’s a foundation of the internal network and system security.