#!/bin/sh
#
# Startup script to implement /etc/sysconfig/iptables pre-defined rules.
#
# chkconfig: 2345 03 92
#
# description: Automates a packet filtering firewall with iptables.
#
# by bero@redhat.com, based on the ipchains script:
# Script Author:	Joshua Jensen <joshua@redhat.com>
#   -- hacked up by gafton with help from notting
# modified by Anton Altaparmakov <aia21@cam.ac.uk>:
# modified by Nils Philippsen <nils@redhat.de>
#
# config: /etc/sysconfig/iptables
#
### BEGIN INIT INFO
# Provides: iptables firewall
# Default-Start: 2 3 4 5
# Short-Description: iptables packet filtering
# Description: Automates a packet filtering firewall with iptables,
#              using /etc/sysconfig/iptables pre-defined rules.
### END INIT INFO

# Source 'em up
. /etc/init.d/functions

IPTABLES_CONFIG=/etc/sysconfig/iptables

if [ ! -x /sbin/iptables ]; then
	exit 0
fi

iftable() {
	if grep -Fqsx $1 /proc/net/ip_tables_names; then
		iptables -t "$@"
	fi
}

check() {
	if [ -n "$1" ]; then
		rm -f /@lib@/iptables
		ln -s /@lib@/iptables.d/"${1}" /@lib@/iptables
		iftable nat -N __T__${1##*-}__ >/dev/null 2>&1
		iftable nat -A __T__${1##*-}__ -j MASQUERADE >/dev/null 2>&1
		res=$?
		iftable nat -F __T__${1##*-}__ >/dev/null 2>&1
		iftable nat -X __T__${1##*-}__ >/dev/null 2>&1
		return $res
	else
		IPTABLES_LIST="$(/bin/ls /@lib@/iptables.d)"
		if [ $(echo $IPTABLES_LIST | wc -w) -gt 1 ] || [ ! -e /@lib@/iptables ]; then
			/sbin/modprobe ipt_MASQUERADE >/dev/null 2>&1
			for i in $IPTABLES_LIST ; do
				check "${i}" && break
			done
			/sbin/modprobe -r ipt_MASQUERADE >/dev/null 2>&1
		else
			return 0;
		fi
	fi
}

start() {
	# don't do squat if we don't have the config file
	if [ -f $IPTABLES_CONFIG ]; then
	    # We do _not_ need to flush/clear anything when using iptables-restore
	    echo $"Applying iptables firewall rules: "
            grep -v "^[[:space:]]*#" $IPTABLES_CONFIG | grep -v '^[[:space:]]*$' | /sbin/iptables-restore -w 5 -c && \
		    success $"Applying iptables firewall rules" || \
		    failure $"Applying iptables firewall rules"
	    echo
	    touch /var/lock/subsys/iptables
	fi
}

stop() {
	# don't reset firewall rules if we don't have the config file
	[ -f $IPTABLES_CONFIG ] || return

	chains="$(cat /proc/net/ip_tables_names 2>/dev/null)"
        for i in $chains; do iptables -t "$i" -F; done && \
                success $"Flushing all chains:" || \
                failure $"Flushing all chains:"
        for i in $chains; do iptables -t "$i" -X; done && \
                success $"Removing user defined chains:" || \
                failure $"Removing user defined chains:"
        echo -n $"Resetting built-in chains to the default ACCEPT policy:"
	iftable filter -P INPUT ACCEPT && \
	   iftable filter -P OUTPUT ACCEPT && \
	   iftable filter -P FORWARD ACCEPT && \
	   iftable nat -P PREROUTING ACCEPT && \
	   iftable nat -P POSTROUTING ACCEPT && \
	   iftable nat -P OUTPUT ACCEPT && \
           iftable mangle -P PREROUTING ACCEPT && \
           iftable mangle -P OUTPUT ACCEPT && \
	   success $"Resetting built-in chains to the default ACCEPT policy" || \
	   failure $"Resetting built-in chains to the default ACCEPT policy"
	echo
	rm -f /var/lock/subsys/iptables
}

case "$1" in
  start)
	check
	start
	;;

  stop)
	stop
	;;

  restart|reload)
	# "restart" is really just "start" as this isn't a daemon,
	#  and "start" clears any pre-defined rules anyway.
	#  This is really only here to make those who expect it happy
	start
	;;

  condrestart)
	[ -e /var/lock/subsys/iptables ] && start
	;;

  status)
	tables="$(cat /proc/net/ip_tables_names 2>/dev/null)"
	for table in $tables; do
		echo $"Table: $table"
		iptables -t "$table" --list
	done
	;;

  panic)
	echo -n $"Changing target policies to DROP: "	
	iftable filter -P INPUT DROP && \
	    iftable filter -P FORWARD DROP && \
	    iftable filter -P OUTPUT DROP && \
	    iftable nat -P PREROUTING DROP && \
	    iftable nat -P POSTROUTING DROP && \
	    iftable nat -P OUTPUT DROP && \
	    iftable mangle -P PREROUTING DROP && \
	    iftable mangle -P OUTPUT DROP && \
	    success $"Changing target policies to DROP" || \
	    failure $"Changing target policies to DROP"
	echo
        iftable filter -F INPUT && \
                iftable filter -F FORWARD && \
                iftable filter -F OUTPUT && \
                iftable nat -F PREROUTING && \
                iftable nat -F POSTROUTING && \
                iftable nat -F OUTPUT && \
                iftable mangle -F PREROUTING && \
                iftable mangle -F OUTPUT && \
                success $"Flushing all chains:" || \
                failure $"Flushing all chains:"
        iftable filter -X INPUT && \
                iftable filter -X FORWARD && \
                iftable filter -X OUTPUT && \
                iftable nat -X PREROUTING && \
                iftable nat -X POSTROUTING && \
                iftable nat -X OUTPUT && \
                iftable mangle -X PREROUTING && \
                iftable mangle -X OUTPUT && \
                success $"Removing user defined chains:" || \
                failure $"Removing user defined chains:"
        ;;

  save)
	echo -n $"Saving current rules to $IPTABLES_CONFIG: "
	touch "$IPTABLES_CONFIG"
	chmod 600 "$IPTABLES_CONFIG"
	/sbin/iptables-save -c > $IPTABLES_CONFIG  2>/dev/null && \
	  success $"Saving current rules to $IPTABLES_CONFIG" || \
	  failure $"Saving current rules to $IPTABLES_CONFIG"
	echo
	;;

  check)
    check
	;;

  *)
	echo $"Usage: $0 {start|stop|restart|condrestart|status|panic|save|check}"
	exit 1
esac

exit 0