#!/bin/sh # # Startup script to implement /etc/sysconfig/iptables pre-defined rules. # # chkconfig: 2345 03 92 # # description: Automates a packet filtering firewall with iptables. # # by bero@redhat.com, based on the ipchains script: # Script Author: Joshua Jensen <joshua@redhat.com> # -- hacked up by gafton with help from notting # modified by Anton Altaparmakov <aia21@cam.ac.uk>: # modified by Nils Philippsen <nils@redhat.de> # # config: /etc/sysconfig/iptables # ### BEGIN INIT INFO # Provides: iptables firewall # Default-Start: 2 3 4 5 # Short-Description: iptables packet filtering # Description: Automates a packet filtering firewall with iptables, # using /etc/sysconfig/iptables pre-defined rules. ### END INIT INFO # Source 'em up . /etc/init.d/functions IPTABLES_CONFIG=/etc/sysconfig/iptables if [ ! -x /sbin/iptables ]; then exit 0 fi iftable() { if fgrep -qsx $1 /proc/net/ip_tables_names; then iptables -t "$@" fi } check() { if [ -n "$1" ]; then rm -f /@lib@/iptables ln -s /@lib@/iptables.d/${1} /@lib@/iptables iftable nat -N __T__${1##*-}__ >/dev/null 2>&1 iftable nat -A __T__${1##*-}__ -j MASQUERADE >/dev/null 2>&1 res=$? iftable nat -F __T__${1##*-}__ >/dev/null 2>&1 iftable nat -X __T__${1##*-}__ >/dev/null 2>&1 return $res else IPTABLES_LIST=`/bin/ls /@lib@/iptables.d` if [ `echo $IPTABLES_LIST | wc -w` -gt 1 ] || [ ! -e /@lib@/iptables ]; then /sbin/modprobe ipt_MASQUERADE >/dev/null 2>&1 for i in $IPTABLES_LIST ; do check ${i} && break done /sbin/modprobe -r ipt_MASQUERADE >/dev/null 2>&1 else return 0; fi fi } start() { # don't do squat if we don't have the config file if [ -f $IPTABLES_CONFIG ]; then # We do _not_ need to flush/clear anything when using iptables-restore echo $"Applying iptables firewall rules: " grep -v "^[[:space:]]*#" $IPTABLES_CONFIG | grep -v '^[[:space:]]*$' | /sbin/iptables-restore -c && \ success $"Applying iptables firewall rules" || \ failure $"Applying iptables firewall rules" echo touch /var/lock/subsys/iptables fi } stop() { chains=`cat /proc/net/ip_tables_names 2>/dev/null` for i in $chains; do iptables -t $i -F; done && \ success $"Flushing all chains:" || \ failure $"Flushing all chains:" for i in $chains; do iptables -t $i -X; done && \ success $"Removing user defined chains:" || \ failure $"Removing user defined chains:" echo -n $"Resetting built-in chains to the default ACCEPT policy:" iftable filter -P INPUT ACCEPT && \ iftable filter -P OUTPUT ACCEPT && \ iftable filter -P FORWARD ACCEPT && \ iftable nat -P PREROUTING ACCEPT && \ iftable nat -P POSTROUTING ACCEPT && \ iftable nat -P OUTPUT ACCEPT && \ iftable mangle -P PREROUTING ACCEPT && \ iftable mangle -P OUTPUT ACCEPT && \ success $"Resetting built-in chains to the default ACCEPT policy" || \ failure $"Resetting built-in chains to the default ACCEPT policy" echo rm -f /var/lock/subsys/iptables } case "$1" in start) check start ;; stop) stop ;; restart|reload) # "restart" is really just "start" as this isn't a daemon, # and "start" clears any pre-defined rules anyway. # This is really only here to make those who expect it happy start ;; condrestart) [ -e /var/lock/subsys/iptables ] && start ;; status) tables=`cat /proc/net/ip_tables_names 2>/dev/null` for table in $tables; do echo $"Table: $table" iptables -t $table --list done ;; panic) echo -n $"Changing target policies to DROP: " iftable filter -P INPUT DROP && \ iftable filter -P FORWARD DROP && \ iftable filter -P OUTPUT DROP && \ iftable nat -P PREROUTING DROP && \ iftable nat -P POSTROUTING DROP && \ iftable nat -P OUTPUT DROP && \ iftable mangle -P PREROUTING DROP && \ iftable mangle -P OUTPUT DROP && \ success $"Changing target policies to DROP" || \ failure $"Changing target policies to DROP" echo iftable filter -F INPUT && \ iftable filter -F FORWARD && \ iftable filter -F OUTPUT && \ iftable nat -F PREROUTING && \ iftable nat -F POSTROUTING && \ iftable nat -F OUTPUT && \ iftable mangle -F PREROUTING && \ iftable mangle -F OUTPUT && \ success $"Flushing all chains:" || \ failure $"Flushing all chains:" iftable filter -X INPUT && \ iftable filter -X FORWARD && \ iftable filter -X OUTPUT && \ iftable nat -X PREROUTING && \ iftable nat -X POSTROUTING && \ iftable nat -X OUTPUT && \ iftable mangle -X PREROUTING && \ iftable mangle -X OUTPUT && \ success $"Removing user defined chains:" || \ failure $"Removing user defined chains:" ;; save) echo -n $"Saving current rules to $IPTABLES_CONFIG: " touch $IPTABLES_CONFIG chmod 600 $IPTABLES_CONFIG /sbin/iptables-save -c > $IPTABLES_CONFIG 2>/dev/null && \ success $"Saving current rules to $IPTABLES_CONFIG" || \ failure $"Saving current rules to $IPTABLES_CONFIG" echo ;; check) check ;; *) echo $"Usage: $0 {start|stop|restart|condrestart|status|panic|save|check}" exit 1 esac exit 0