- added link patch: don't propagate -lpcap everywhere; release 2

[packages/iptables.git] / iptables.init

#!/bin/sh
#
# Startup script to implement /etc/sysconfig/iptables pre-defined rules.
#
# chkconfig: 2345 08 92
#
# description: Automates a packet filtering firewall with iptables.
#
# by bero@redhat.com, based on the ipchains script:
# Script Author:	Joshua Jensen <joshua@redhat.com>
#   -- hacked up by gafton with help from notting
# modified by Anton Altaparmakov <aia21@cam.ac.uk>:
# modified by Nils Philippsen <nils@redhat.de>
#
# config: /etc/sysconfig/iptables

IPTABLES_CONFIG=/etc/sysconfig/iptables
if [ ! -f $IPTABLES_CONFIG ]; then
	case "$1" in
	start|restart|force-reload)
		exit 0
	;;
	esac
fi

# Source 'em up
. /etc/rc.d/init.d/functions

if [ "$(kernelver)" -lt "002003000" ]; then
	exit 0
fi

if /sbin/lsmod 2>/dev/null | grep -q ipchains; then
	# Don't do both
	exit 0
fi

IPTABLES_SAVE_ON_STOP="no"
IPTABLES_SAVE_COUNTER="no"
IPTABLES_STATUS_NUMERIC="yes"
IPTABLES_STATUS_VERBOSE="no"
IPTABLES_STATUS_LINENUMBERS="yes"
[ -f /etc/sysconfig/iptables-config ] && . /etc/sysconfig/iptables-config
_SAVEOPT=
is_yes $IPTABLES_SAVE_COUNTER && _SAVEOPT="-c"

if [ "$1" = "--quiet" ]; then
	shift
	show() { return 0; }
	ok() { return 0; }
	fail() { return 1; }
fi

iftable() {
	if fgrep -qsx $1 /proc/net/ip_tables_names; then
		iptables -t "$@"
	fi
}

start() {
	# don't do squat if we don't have the config file
	if [ -f $IPTABLES_CONFIG ]; then
		# If we don't clear these first, we might be adding to
		#  pre-existing rules.
		tables=`cat /proc/net/ip_tables_names 2>/dev/null`
		show "Flushing all current rules and user defined chains"
		let ret=0
		for i in $tables; do iptables -t $i -F; let ret+=$?; done
		if [ $ret -eq 0 ]; then
			ok
		else
			fail
		fi
		show "Clearing all current rules and user defined chains"
		let ret=0
		for i in $tables; do iptables -t $i -X; let ret+=$?; done
		if [ $ret -eq 0 ]; then
			ok
		else
			fail
		fi

		for i in $tables; do iptables -t $i -Z; done

		show "Applying iptables firewall rules"
		grep -v "^[[:space:]]*#" $IPTABLES_CONFIG | grep -v '^[[:space:]]*$' | /usr/sbin/iptables-restore $_SAVEOPT && \
			ok || \
			fail
		touch /var/lock/subsys/iptables
	fi
}

stop() {
	tables=`cat /proc/net/ip_tables_names 2>/dev/null`
	show "Flushing all chains"
	let ret=0
	for i in $tables; do iptables -t $i -F; let ret+=$?; done
	if [ $ret -eq 0 ]; then
		ok
	else
		fail
	fi

	show "Removing user defined chains"
	let ret=0
	for i in $tables; do iptables -t $i -X; let ret+=$?; done
	if [ $ret -eq 0 ]; then
		ok
	else
		fail
	fi
	show "Resetting built-in chains to the default ACCEPT policy"
	iftable filter -P INPUT ACCEPT && \
	iftable filter -P OUTPUT ACCEPT && \
	iftable filter -P FORWARD ACCEPT && \
	iftable nat -P PREROUTING ACCEPT && \
	iftable nat -P POSTROUTING ACCEPT && \
	iftable nat -P OUTPUT ACCEPT && \
	iftable mangle -P PREROUTING ACCEPT && \
	iftable mangle -P OUTPUT ACCEPT && \
	ok || fail
	rm -f /var/lock/subsys/iptables
}

save() {
	show "Saving current rules to %s" $IPTABLES_CONFIG
	touch $IPTABLES_CONFIG
	chmod 600 $IPTABLES_CONFIG
	/usr/sbin/iptables-save $_SAVEOPT > $IPTABLES_CONFIG  2>/dev/null && ok || fail
}

upstart_controlled --except status panic load save clear

case "$1" in
  start|load)
	start
	;;
  stop)
	is_yes $IPTABLES_SAVE_ON_STOP && save
	stop
	;;
  clear)
	stop
	;;
  restart|force-reload)
	# "restart" is really just "start" as this isn't a daemon,
	#  and "start" clears any pre-defined rules anyway.
	#  This is really only here to make those who expect it happy
	start
	;;
  panic)
	show "Changing target policies to DROP"
	iftable filter -P INPUT DROP && \
	iftable filter -P FORWARD DROP && \
	iftable filter -P OUTPUT DROP && \
	iftable nat -P PREROUTING DROP && \
	iftable nat -P POSTROUTING DROP && \
	iftable nat -P OUTPUT DROP && \
	iftable mangle -P PREROUTING DROP && \
	iftable mangle -P OUTPUT DROP && \
	ok || fail
	iftable filter -F INPUT && \
	iftable filter -F FORWARD && \
	iftable filter -F OUTPUT && \
	iftable nat -F PREROUTING && \
	iftable nat -F POSTROUTING && \
	iftable nat -F OUTPUT && \
	iftable mangle -F PREROUTING && \
	iftable mangle -F OUTPUT && \
	ok || fail
	iftable filter -X INPUT && \
	iftable filter -X FORWARD && \
	iftable filter -X OUTPUT && \
	iftable nat -X PREROUTING && \
	iftable nat -X POSTROUTING && \
	iftable nat -X OUTPUT && \
	iftable mangle -X PREROUTING && \
	iftable mangle -X OUTPUT && \
	ok || fail
	;;
  save)
	save
	;;
  status)
	is_yes $IPTABLES_STATUS_NUMERIC && _NUMERIC="-n"
	is_yes $IPTABLES_STATUS_VERBOSE && _VERBOSE="--verbose"
	is_yes $IPTABLES_STATUS_LINENUMBERS && _LINES="--line-numbers"
	tables=`cat /proc/net/ip_tables_names 2>/dev/null`
	for table in $tables; do
		echo "Table: $table"
		iptables -t $table --list $_NUMERIC $_VERBOSE $_LINES
	done
	;;
  *)
	msg_usage "$0 {start|stop|restart|force-reload|panic|load|save|clear|status}"
	exit 3
esac

exit 0