iptables/iptables-initscript

116 lines
3.9 KiB
Plaintext
Raw Normal View History

#!/bin/bash
#
# iptables -- Startup script to implement /etc/sysconfig/iptables pre-defined rules
#
# chkconfig: 2345 25 92
# description: Automates a packet filtering firewall with iptables.
# config: /etc/sysconfig/iptables
#
# By bero@redhat.com, based on the ipchains script:
# Script Author: Joshua Jensen <joshua@redhat.com>
# -- hacked up by gafton with help from notting
# Modified by Anton Altaparmakov <aia21@cam.ac.uk>:
# Modified by Nils Philippsen <nils@redhat.de>
. /etc/sysconfig/rc
. $rc_functions
NAME=iptables
IPTABLES=/sbin/$NAME
IPTABLES_RESTORE=/sbin/iptables-restore
IPTABLES_SAVE=/sbin/iptables-save
IPTABLES_CONFIG=/etc/sysconfig/$NAME
[ -x $IPTABLES ] || exit 0
case "$1" in
start)
# don't do squat if we don't have the config file
if [ -f $IPTABLES_CONFIG ]; then
# we do _not_ need to flush/clear anything when using iptables-restore
echo -n $"Applying iptables firewall rules: "
grep -v "^[[:space:]]*#" $IPTABLES_CONFIG | \
grep -v '^[[:space:]]*$' | \
$IPTABLES_RESTORE -c
evaluate_retval; echo
fi
touch /var/lock/subsys/$NAME
;;
stop)
echo -n $"Setting up default policies to ACCEPT: "
$IPTABLES --table mangle --policy PREROUTING ACCEPT &&
$IPTABLES --table mangle --policy INPUT ACCEPT &&
$IPTABLES --table mangle --policy FORWARD ACCEPT &&
$IPTABLES --table mangle --policy OUTPUT ACCEPT &&
$IPTABLES --table mangle --policy POSTROUTING ACCEPT &&
$IPTABLES --table filter --policy INPUT ACCEPT &&
$IPTABLES --table filter --policy OUTPUT ACCEPT &&
$IPTABLES --table filter --policy FORWARD ACCEPT &&
$IPTABLES --table nat --policy PREROUTING ACCEPT &&
$IPTABLES --table nat --policy POSTROUTING ACCEPT &&
$IPTABLES --table nat --policy OUTPUT ACCEPT
evaluate_retval; echo
echo -n $"Flushing all chains and deleting all user ones: "
for table in filter nat mangle; do
$IPTABLES --table $table --flush &&
$IPTABLES --table $table --delete-chain &&
$IPTABLES --table $table --zero
done
evaluate_retval; echo
rm -f /var/lock/subsys/$NAME
;;
restart|reload)
# "restart" is really just "start" as this isn't a daemon,
# and "start" clears any pre-defined rules anyway.
# This is really only here to make those who expect it happy
$0 start
;;
condrestart)
[ -e /var/lock/subsys/$NAME ] && $0 restart || :
;;
status)
for table in $(cat /proc/net/ip_tables_names 2>/dev/null); do
echo "["$"TABLE:"" $table]"
$IPTABLES -t $table --list
echo
done
;;
panic)
echo -n $"Setting up default policies to DROP: "
$IPTABLES --table mangle --policy PREROUTING DROP &&
$IPTABLES --table mangle --policy INPUT DROP &&
$IPTABLES --table mangle --policy FORWARD DROP &&
$IPTABLES --table mangle --policy OUTPUT DROP &&
$IPTABLES --table mangle --policy POSTROUTING DROP &&
$IPTABLES --table filter --policy INPUT DROP &&
$IPTABLES --table filter --policy OUTPUT DROP &&
$IPTABLES --table filter --policy FORWARD DROP &&
$IPTABLES --table nat --policy PREROUTING DROP &&
$IPTABLES --table nat --policy POSTROUTING DROP &&
$IPTABLES --table nat --policy OUTPUT DROP
evaluate_retval; echo
echo -n $"Flushing all chains and deleting all user ones: "
for table in filter nat mangle; do
$IPTABLES --table $table --flush &&
$IPTABLES --table $table --delete-chain &&
$IPTABLES --table $table --zero
done
evaluate_retval; echo
;;
save)
echo -n $"Saving current rules to"" \`$IPTABLES_CONFIG': "
touch $IPTABLES_CONFIG && chmod 600 $IPTABLES_CONFIG &&
$IPTABLES_SAVE -c > $IPTABLES_CONFIG 2>/dev/null
evaluate_retval; echo
;;
*)
echo "Usage: ""$0 {start|stop|restart|condrestart|status|panic|save}"
exit 1
;;
esac
exit 0