虚拟专网中防火墙位置的选择

防火墙是虚拟专网中的一种基本安全设施，在任何VPN(虚拟专用网络，Vinual Private Net—work)方案中都需要认真考虑防火墙的位置。根据防火墙的放置位置，可以使网络有不同的安全特点，也为网络管理者提供了更多的选择余地。防火墙应该放在安全网关(VNP服务器)的里面还是外面，一直都是争论的焦点。对于需要对外界共享部分资源的企业，适合于将防火墙放置在内部网络的最外面。而对于那些不希望任何非VPN用户访问的企业网络，适合于将防火墙置于VPN服务器之前。当然不同的位置，其配置方法也有差别，就虚拟专网中的防火墙两种位置进行讨论，并给出实际应用建议。

Option of the Firewall Location in Virtual Private Network(VPN)

Firewall is a kind of basic safe facility in Virtual Private Network. In any VPN scheme, the location of firewall must be considered conscientious.According to firewall's location, different network has different safe characteristic. Firewall should be put in front of or behind safe gateway ( VNP server), which is the focus of the argument. To share the enterprise's partial resources for outside world, firewall is different in department network. To let non-VPN user visit intranet, firewall is put behind VPN server.This paper discuss the firewall's location in fictitious special net.