|
cvsdist |
bfa5afa |
#!/bin/sh
|
|
cvsdist |
bfa5afa |
#
|
|
cvsdist |
31d8898 |
# iptables Start iptables firewall
|
|
cvsdist |
bfa5afa |
#
|
|
cvsdist |
bfa5afa |
# chkconfig: 2345 08 92
|
|
cvsdist |
31d8898 |
# description: Starts, stops and saves iptables firewall
|
|
cvsdist |
bfa5afa |
#
|
|
cvsdist |
bfa5afa |
# config: /etc/sysconfig/iptables
|
|
cvsdist |
31d8898 |
# config: /etc/sysconfig/iptables-config
|
|
![](https://seccdn.libravatar.org/avatar/043cbe4382cc89c10798a4de55109392c17b90a6cfeaef4908e150224bd58d6e?s=16&d=retro) |
32bdef7 |
#
|
|
![](https://seccdn.libravatar.org/avatar/043cbe4382cc89c10798a4de55109392c17b90a6cfeaef4908e150224bd58d6e?s=16&d=retro) |
32bdef7 |
### BEGIN INIT INFO
|
|
![](https://seccdn.libravatar.org/avatar/043cbe4382cc89c10798a4de55109392c17b90a6cfeaef4908e150224bd58d6e?s=16&d=retro) |
32bdef7 |
# Provides: iptables
|
|
![](https://seccdn.libravatar.org/avatar/043cbe4382cc89c10798a4de55109392c17b90a6cfeaef4908e150224bd58d6e?s=16&d=retro) |
19f9d68 |
# Required-Start:
|
|
![](https://seccdn.libravatar.org/avatar/043cbe4382cc89c10798a4de55109392c17b90a6cfeaef4908e150224bd58d6e?s=16&d=retro) |
19f9d68 |
# Required-Stop:
|
|
![](https://seccdn.libravatar.org/avatar/043cbe4382cc89c10798a4de55109392c17b90a6cfeaef4908e150224bd58d6e?s=16&d=retro) |
19f9d68 |
# Default-Start: 2 3 4 5
|
|
![](https://seccdn.libravatar.org/avatar/043cbe4382cc89c10798a4de55109392c17b90a6cfeaef4908e150224bd58d6e?s=16&d=retro) |
32bdef7 |
# Default-Stop: 0 1 6
|
|
![](https://seccdn.libravatar.org/avatar/043cbe4382cc89c10798a4de55109392c17b90a6cfeaef4908e150224bd58d6e?s=16&d=retro) |
32bdef7 |
# Short-Description: start and stop iptables firewall
|
|
![](https://seccdn.libravatar.org/avatar/043cbe4382cc89c10798a4de55109392c17b90a6cfeaef4908e150224bd58d6e?s=16&d=retro) |
32bdef7 |
# Description: Start, stop and save iptables firewall
|
|
![](https://seccdn.libravatar.org/avatar/043cbe4382cc89c10798a4de55109392c17b90a6cfeaef4908e150224bd58d6e?s=16&d=retro) |
32bdef7 |
### END INIT INFO
|
|
cvsdist |
bfa5afa |
|
|
cvsdist |
31d8898 |
# Source function library.
|
|
cvsdist |
bfa5afa |
. /etc/init.d/functions
|
|
cvsdist |
bfa5afa |
|
|
cvsdist |
31d8898 |
IPTABLES=iptables
|
|
cvsdist |
31d8898 |
IPTABLES_DATA=/etc/sysconfig/$IPTABLES
|
|
cvsdist |
31d8898 |
IPTABLES_CONFIG=/etc/sysconfig/${IPTABLES}-config
|
|
cvsdist |
31d8898 |
IPV=${IPTABLES%tables} # ip for ipv4 | ip6 for ipv6
|
|
![](https://seccdn.libravatar.org/avatar/043cbe4382cc89c10798a4de55109392c17b90a6cfeaef4908e150224bd58d6e?s=16&d=retro) |
32bdef7 |
[ "$IPV" = "ip" ] && _IPV="ipv4" || _IPV="ipv6"
|
|
cvsdist |
31d8898 |
PROC_IPTABLES_NAMES=/proc/net/${IPV}_tables_names
|
|
cvsdist |
31d8898 |
VAR_SUBSYS_IPTABLES=/var/lock/subsys/$IPTABLES
|
|
cvsdist |
bfa5afa |
|
|
cvsdist |
31d8898 |
if [ ! -x /sbin/$IPTABLES ]; then
|
|
![](https://seccdn.libravatar.org/avatar/043cbe4382cc89c10798a4de55109392c17b90a6cfeaef4908e150224bd58d6e?s=16&d=retro) |
6a95dca |
echo -n $"${IPTABLES}: /sbin/$IPTABLES does not exist."; warning; echo
|
|
![](https://seccdn.libravatar.org/avatar/043cbe4382cc89c10798a4de55109392c17b90a6cfeaef4908e150224bd58d6e?s=16&d=retro) |
32bdef7 |
exit 5
|
|
cvsdist |
bfa5afa |
fi
|
|
cvsdist |
bfa5afa |
|
|
cvsdist |
314b6dc |
# Old or new modutils
|
|
cvsdist |
314b6dc |
/sbin/modprobe --version 2>&1 | grep -q module-init-tools \
|
|
cvsdist |
314b6dc |
&& NEW_MODUTILS=1 \
|
|
cvsdist |
314b6dc |
|| NEW_MODUTILS=0
|
|
cvsdist |
314b6dc |
|
|
cvsdist |
31d8898 |
# Default firewall configuration:
|
|
cvsdist |
31d8898 |
IPTABLES_MODULES=""
|
|
cvsdist |
314b6dc |
IPTABLES_MODULES_UNLOAD="yes"
|
|
cvsdist |
31d8898 |
IPTABLES_SAVE_ON_STOP="no"
|
|
cvsdist |
31d8898 |
IPTABLES_SAVE_ON_RESTART="no"
|
|
cvsdist |
31d8898 |
IPTABLES_SAVE_COUNTER="no"
|
|
![](https://seccdn.libravatar.org/avatar/043cbe4382cc89c10798a4de55109392c17b90a6cfeaef4908e150224bd58d6e?s=16&d=retro) |
17fd75c |
IPTABLES_STATUS_NUMERIC="yes"
|
|
![](https://seccdn.libravatar.org/avatar/043cbe4382cc89c10798a4de55109392c17b90a6cfeaef4908e150224bd58d6e?s=16&d=retro) |
bc5bcb4 |
IPTABLES_STATUS_VERBOSE="no"
|
|
![](https://seccdn.libravatar.org/avatar/043cbe4382cc89c10798a4de55109392c17b90a6cfeaef4908e150224bd58d6e?s=16&d=retro) |
bc5bcb4 |
IPTABLES_STATUS_LINENUMBERS="yes"
|
|
cvsdist |
bfa5afa |
|
|
cvsdist |
31d8898 |
# Load firewall configuration.
|
|
cvsdist |
31d8898 |
[ -f "$IPTABLES_CONFIG" ] && . "$IPTABLES_CONFIG"
|
|
cvsdist |
bfa5afa |
|
|
![](https://seccdn.libravatar.org/avatar/043cbe4382cc89c10798a4de55109392c17b90a6cfeaef4908e150224bd58d6e?s=16&d=retro) |
b467a21 |
# Netfilter modules
|
|
![](https://seccdn.libravatar.org/avatar/043cbe4382cc89c10798a4de55109392c17b90a6cfeaef4908e150224bd58d6e?s=16&d=retro) |
bfc8fd6 |
NF_MODULES=($(lsmod | awk "/^${IPV}table_/ {print \$1}") ${IPV}_tables)
|
|
![](https://seccdn.libravatar.org/avatar/043cbe4382cc89c10798a4de55109392c17b90a6cfeaef4908e150224bd58d6e?s=16&d=retro) |
bfc8fd6 |
NF_MODULES_COMMON=(x_tables nf_nat nf_conntrack) # Used by netfilter v4 and v6
|
|
![](https://seccdn.libravatar.org/avatar/043cbe4382cc89c10798a4de55109392c17b90a6cfeaef4908e150224bd58d6e?s=16&d=retro) |
b467a21 |
|
|
![](https://seccdn.libravatar.org/avatar/043cbe4382cc89c10798a4de55109392c17b90a6cfeaef4908e150224bd58d6e?s=16&d=retro) |
b467a21 |
# Get active tables
|
|
![](https://seccdn.libravatar.org/avatar/043cbe4382cc89c10798a4de55109392c17b90a6cfeaef4908e150224bd58d6e?s=16&d=retro) |
b467a21 |
NF_TABLES=$(cat "$PROC_IPTABLES_NAMES" 2>/dev/null)
|
|
![](https://seccdn.libravatar.org/avatar/043cbe4382cc89c10798a4de55109392c17b90a6cfeaef4908e150224bd58d6e?s=16&d=retro) |
b467a21 |
|
|
![](https://seccdn.libravatar.org/avatar/043cbe4382cc89c10798a4de55109392c17b90a6cfeaef4908e150224bd58d6e?s=16&d=retro) |
b467a21 |
|
|
cvsdist |
31d8898 |
rmmod_r() {
|
|
cvsdist |
31d8898 |
# Unload module with all referring modules.
|
|
cvsdist |
31d8898 |
# At first all referring modules will be unloaded, then the module itself.
|
|
cvsdist |
f8ef2e4 |
local mod=$1
|
|
cvsdist |
f8ef2e4 |
local ret=0
|
|
cvsdist |
314b6dc |
local ref=
|
|
cvsdist |
bfa5afa |
|
|
cvsdist |
31d8898 |
# Get referring modules.
|
|
cvsdist |
314b6dc |
# New modutils have another output format.
|
|
cvsdist |
314b6dc |
[ $NEW_MODUTILS = 1 ] \
|
|
![](https://seccdn.libravatar.org/avatar/043cbe4382cc89c10798a4de55109392c17b90a6cfeaef4908e150224bd58d6e?s=16&d=retro) |
32bdef7 |
&& ref=$(lsmod | awk "/^${mod}/ { print \$4; }" | tr ',' ' ') \
|
|
![](https://seccdn.libravatar.org/avatar/043cbe4382cc89c10798a4de55109392c17b90a6cfeaef4908e150224bd58d6e?s=16&d=retro) |
32bdef7 |
|| ref=$(lsmod | grep ^${mod} | cut -d "[" -s -f 2 | cut -d "]" -s -f 1)
|
|
cvsdist |
31d8898 |
|
|
cvsdist |
314b6dc |
# recursive call for all referring modules
|
|
cvsdist |
31d8898 |
for i in $ref; do
|
|
cvsdist |
31d8898 |
rmmod_r $i
|
|
cvsdist |
31d8898 |
let ret+=$?;
|
|
cvsdist |
31d8898 |
done
|
|
cvsdist |
31d8898 |
|
|
cvsdist |
31d8898 |
# Unload module.
|
|
cvsdist |
314b6dc |
# The extra test is for 2.6: The module might have autocleaned,
|
|
cvsdist |
314b6dc |
# after all referring modules are unloaded.
|
|
cvsdist |
314b6dc |
if grep -q "^${mod}" /proc/modules ; then
|
|
cvsdist |
314b6dc |
modprobe -r $mod > /dev/null 2>&1
|
|
![](https://seccdn.libravatar.org/avatar/043cbe4382cc89c10798a4de55109392c17b90a6cfeaef4908e150224bd58d6e?s=16&d=retro) |
bfc8fd6 |
res=$?
|
|
![](https://seccdn.libravatar.org/avatar/043cbe4382cc89c10798a4de55109392c17b90a6cfeaef4908e150224bd58d6e?s=16&d=retro) |
bfc8fd6 |
[ $res -eq 0 ] || echo -n " $mod"
|
|
![](https://seccdn.libravatar.org/avatar/043cbe4382cc89c10798a4de55109392c17b90a6cfeaef4908e150224bd58d6e?s=16&d=retro) |
bfc8fd6 |
let ret+=$res;
|
|
cvsdist |
314b6dc |
fi
|
|
cvsdist |
31d8898 |
|
|
cvsdist |
31d8898 |
return $ret
|
|
cvsdist |
31d8898 |
}
|
|
cvsdist |
31d8898 |
|
|
cvsdist |
31d8898 |
flush_n_delete() {
|
|
cvsdist |
31d8898 |
# Flush firewall rules and delete chains.
|
|
![](https://seccdn.libravatar.org/avatar/043cbe4382cc89c10798a4de55109392c17b90a6cfeaef4908e150224bd58d6e?s=16&d=retro) |
22d0822 |
[ ! -e "$PROC_IPTABLES_NAMES" ] && return 0
|
|
cvsdist |
31d8898 |
|
|
cvsdist |
31d8898 |
# Check if firewall is configured (has tables)
|
|
![](https://seccdn.libravatar.org/avatar/043cbe4382cc89c10798a4de55109392c17b90a6cfeaef4908e150224bd58d6e?s=16&d=retro) |
b467a21 |
[ -z "$NF_TABLES" ] && return 1
|
|
cvsdist |
31d8898 |
|
|
![](https://seccdn.libravatar.org/avatar/043cbe4382cc89c10798a4de55109392c17b90a6cfeaef4908e150224bd58d6e?s=16&d=retro) |
6a95dca |
echo -n $"${IPTABLES}: Flushing firewall rules: "
|
|
cvsdist |
31d8898 |
ret=0
|
|
cvsdist |
31d8898 |
# For all tables
|
|
![](https://seccdn.libravatar.org/avatar/043cbe4382cc89c10798a4de55109392c17b90a6cfeaef4908e150224bd58d6e?s=16&d=retro) |
b467a21 |
for i in $NF_TABLES; do
|
|
cvsdist |
31d8898 |
# Flush firewall rules.
|
|
cvsdist |
31d8898 |
$IPTABLES -t $i -F;
|
|
cvsdist |
31d8898 |
let ret+=$?;
|
|
cvsdist |
31d8898 |
|
|
cvsdist |
31d8898 |
# Delete firewall chains.
|
|
cvsdist |
31d8898 |
$IPTABLES -t $i -X;
|
|
cvsdist |
31d8898 |
let ret+=$?;
|
|
cvsdist |
31d8898 |
|
|
cvsdist |
31d8898 |
# Set counter to zero.
|
|
cvsdist |
31d8898 |
$IPTABLES -t $i -Z;
|
|
cvsdist |
31d8898 |
let ret+=$?;
|
|
cvsdist |
31d8898 |
done
|
|
cvsdist |
31d8898 |
|
|
cvsdist |
31d8898 |
[ $ret -eq 0 ] && success || failure
|
|
cvsdist |
31d8898 |
echo
|
|
cvsdist |
314b6dc |
return $ret
|
|
cvsdist |
31d8898 |
}
|
|
cvsdist |
31d8898 |
|
|
cvsdist |
31d8898 |
set_policy() {
|
|
cvsdist |
31d8898 |
# Set policy for configured tables.
|
|
cvsdist |
31d8898 |
policy=$1
|
|
cvsdist |
31d8898 |
|
|
cvsdist |
31d8898 |
# Check if iptable module is loaded
|
|
![](https://seccdn.libravatar.org/avatar/043cbe4382cc89c10798a4de55109392c17b90a6cfeaef4908e150224bd58d6e?s=16&d=retro) |
22d0822 |
[ ! -e "$PROC_IPTABLES_NAMES" ] && return 0
|
|
cvsdist |
31d8898 |
|
|
cvsdist |
31d8898 |
# Check if firewall is configured (has tables)
|
|
![](https://seccdn.libravatar.org/avatar/043cbe4382cc89c10798a4de55109392c17b90a6cfeaef4908e150224bd58d6e?s=16&d=retro) |
b467a21 |
tables=$(cat "$PROC_IPTABLES_NAMES" 2>/dev/null)
|
|
cvsdist |
31d8898 |
[ -z "$tables" ] && return 1
|
|
cvsdist |
31d8898 |
|
|
![](https://seccdn.libravatar.org/avatar/043cbe4382cc89c10798a4de55109392c17b90a6cfeaef4908e150224bd58d6e?s=16&d=retro) |
6a95dca |
echo -n $"${IPTABLES}: Setting chains to policy $policy: "
|
|
cvsdist |
31d8898 |
ret=0
|
|
cvsdist |
31d8898 |
for i in $tables; do
|
|
cvsdist |
31d8898 |
echo -n "$i "
|
|
cvsdist |
31d8898 |
case "$i" in
|
|
![](https://seccdn.libravatar.org/avatar/043cbe4382cc89c10798a4de55109392c17b90a6cfeaef4908e150224bd58d6e?s=16&d=retro) |
bc7eeb0 |
raw)
|
|
![](https://seccdn.libravatar.org/avatar/043cbe4382cc89c10798a4de55109392c17b90a6cfeaef4908e150224bd58d6e?s=16&d=retro) |
bc7eeb0 |
$IPTABLES -t raw -P PREROUTING $policy \
|
|
![](https://seccdn.libravatar.org/avatar/043cbe4382cc89c10798a4de55109392c17b90a6cfeaef4908e150224bd58d6e?s=16&d=retro) |
bc7eeb0 |
&& $IPTABLES -t raw -P OUTPUT $policy \
|
|
![](https://seccdn.libravatar.org/avatar/043cbe4382cc89c10798a4de55109392c17b90a6cfeaef4908e150224bd58d6e?s=16&d=retro) |
bc7eeb0 |
|| let ret+=1
|
|
![](https://seccdn.libravatar.org/avatar/043cbe4382cc89c10798a4de55109392c17b90a6cfeaef4908e150224bd58d6e?s=16&d=retro) |
bc7eeb0 |
;;
|
|
cvsdist |
31d8898 |
filter)
|
|
cvsdist |
31d8898 |
$IPTABLES -t filter -P INPUT $policy \
|
|
cvsdist |
31d8898 |
&& $IPTABLES -t filter -P OUTPUT $policy \
|
|
cvsdist |
31d8898 |
&& $IPTABLES -t filter -P FORWARD $policy \
|
|
cvsdist |
31d8898 |
|| let ret+=1
|
|
cvsdist |
31d8898 |
;;
|
|
cvsdist |
31d8898 |
nat)
|
|
cvsdist |
31d8898 |
$IPTABLES -t nat -P PREROUTING $policy \
|
|
cvsdist |
31d8898 |
&& $IPTABLES -t nat -P POSTROUTING $policy \
|
|
cvsdist |
31d8898 |
&& $IPTABLES -t nat -P OUTPUT $policy \
|
|
cvsdist |
31d8898 |
|| let ret+=1
|
|
cvsdist |
31d8898 |
;;
|
|
cvsdist |
31d8898 |
mangle)
|
|
cvsdist |
31d8898 |
$IPTABLES -t mangle -P PREROUTING $policy \
|
|
cvsdist |
31d8898 |
&& $IPTABLES -t mangle -P POSTROUTING $policy \
|
|
cvsdist |
31d8898 |
&& $IPTABLES -t mangle -P INPUT $policy \
|
|
cvsdist |
31d8898 |
&& $IPTABLES -t mangle -P OUTPUT $policy \
|
|
cvsdist |
31d8898 |
&& $IPTABLES -t mangle -P FORWARD $policy \
|
|
cvsdist |
31d8898 |
|| let ret+=1
|
|
cvsdist |
31d8898 |
;;
|
|
cvsdist |
31d8898 |
*)
|
|
cvsdist |
31d8898 |
let ret+=1
|
|
cvsdist |
31d8898 |
;;
|
|
cvsdist |
31d8898 |
esac
|
|
cvsdist |
31d8898 |
done
|
|
cvsdist |
31d8898 |
|
|
cvsdist |
31d8898 |
[ $ret -eq 0 ] && success || failure
|
|
cvsdist |
31d8898 |
echo
|
|
cvsdist |
314b6dc |
return $ret
|
|
cvsdist |
e8d685d |
}
|
|
cvsdist |
e8d685d |
|
|
cvsdist |
bfa5afa |
start() {
|
|
cvsdist |
31d8898 |
# Do not start if there is no config file.
|
|
![](https://seccdn.libravatar.org/avatar/043cbe4382cc89c10798a4de55109392c17b90a6cfeaef4908e150224bd58d6e?s=16&d=retro) |
22d0822 |
[ ! -f "$IPTABLES_DATA" ] && return 6
|
|
![](https://seccdn.libravatar.org/avatar/043cbe4382cc89c10798a4de55109392c17b90a6cfeaef4908e150224bd58d6e?s=16&d=retro) |
22d0822 |
|
|
![](https://seccdn.libravatar.org/avatar/043cbe4382cc89c10798a4de55109392c17b90a6cfeaef4908e150224bd58d6e?s=16&d=retro) |
6a95dca |
# check if ipv6 module load is deactivated
|
|
![](https://seccdn.libravatar.org/avatar/043cbe4382cc89c10798a4de55109392c17b90a6cfeaef4908e150224bd58d6e?s=16&d=retro) |
6a95dca |
if [ "${_IPV}" = "ipv6" ] \
|
|
![](https://seccdn.libravatar.org/avatar/043cbe4382cc89c10798a4de55109392c17b90a6cfeaef4908e150224bd58d6e?s=16&d=retro) |
6a95dca |
&& grep -qIsE "^install[[:space:]]+${_IPV}[[:space:]]+/bin/(true|false)" /etc/modprobe.conf /etc/modprobe.d/* ; then
|
|
![](https://seccdn.libravatar.org/avatar/043cbe4382cc89c10798a4de55109392c17b90a6cfeaef4908e150224bd58d6e?s=16&d=retro) |
6a95dca |
echo $"${IPTABLES}: ${_IPV} is disabled."
|
|
![](https://seccdn.libravatar.org/avatar/043cbe4382cc89c10798a4de55109392c17b90a6cfeaef4908e150224bd58d6e?s=16&d=retro) |
6a95dca |
return 150
|
|
![](https://seccdn.libravatar.org/avatar/043cbe4382cc89c10798a4de55109392c17b90a6cfeaef4908e150224bd58d6e?s=16&d=retro) |
22d0822 |
fi
|
|
cvsdist |
31d8898 |
|
|
![](https://seccdn.libravatar.org/avatar/043cbe4382cc89c10798a4de55109392c17b90a6cfeaef4908e150224bd58d6e?s=16&d=retro) |
6a95dca |
echo -n $"${IPTABLES}: Applying firewall rules: "
|
|
cvsdist |
31d8898 |
|
|
cvsdist |
31d8898 |
OPT=
|
|
cvsdist |
31d8898 |
[ "x$IPTABLES_SAVE_COUNTER" = "xyes" ] && OPT="-c"
|
|
cvsdist |
31d8898 |
|
|
cvsdist |
31d8898 |
$IPTABLES-restore $OPT $IPTABLES_DATA
|
|
cvsdist |
31d8898 |
if [ $? -eq 0 ]; then
|
|
cvsdist |
31d8898 |
success; echo
|
|
cvsdist |
31d8898 |
else
|
|
cvsdist |
31d8898 |
failure; echo; return 1
|
|
cvsdist |
31d8898 |
fi
|
|
cvsdist |
31d8898 |
|
|
cvsdist |
314b6dc |
# Load additional modules (helpers)
|
|
cvsdist |
31d8898 |
if [ -n "$IPTABLES_MODULES" ]; then
|
|
![](https://seccdn.libravatar.org/avatar/043cbe4382cc89c10798a4de55109392c17b90a6cfeaef4908e150224bd58d6e?s=16&d=retro) |
6a95dca |
echo -n $"${IPTABLES}: Loading additional modules: "
|
|
cvsdist |
31d8898 |
ret=0
|
|
cvsdist |
31d8898 |
for mod in $IPTABLES_MODULES; do
|
|
cvsdist |
31d8898 |
echo -n "$mod "
|
|
cvsdist |
31d8898 |
modprobe $mod > /dev/null 2>&1
|
|
cvsdist |
31d8898 |
let ret+=$?;
|
|
cvsdist |
31d8898 |
done
|
|
cvsdist |
31d8898 |
[ $ret -eq 0 ] && success || failure
|
|
cvsdist |
31d8898 |
echo
|
|
cvsdist |
31d8898 |
fi
|
|
cvsdist |
31d8898 |
|
|
cvsdist |
31d8898 |
touch $VAR_SUBSYS_IPTABLES
|
|
cvsdist |
314b6dc |
return $ret
|
|
cvsdist |
bfa5afa |
}
|
|
cvsdist |
bfa5afa |
|
|
cvsdist |
bfa5afa |
stop() {
|
|
cvsdist |
31d8898 |
# Do not stop if iptables module is not loaded.
|
|
![](https://seccdn.libravatar.org/avatar/043cbe4382cc89c10798a4de55109392c17b90a6cfeaef4908e150224bd58d6e?s=16&d=retro) |
22d0822 |
[ ! -e "$PROC_IPTABLES_NAMES" ] && return 0
|
|
cvsdist |
31d8898 |
|
|
cvsdist |
31d8898 |
flush_n_delete
|
|
cvsdist |
31d8898 |
set_policy ACCEPT
|
|
cvsdist |
31d8898 |
|
|
cvsdist |
314b6dc |
if [ "x$IPTABLES_MODULES_UNLOAD" = "xyes" ]; then
|
|
![](https://seccdn.libravatar.org/avatar/043cbe4382cc89c10798a4de55109392c17b90a6cfeaef4908e150224bd58d6e?s=16&d=retro) |
6a95dca |
echo -n $"${IPTABLES}: Unloading modules: "
|
|
cvsdist |
314b6dc |
ret=0
|
|
![](https://seccdn.libravatar.org/avatar/043cbe4382cc89c10798a4de55109392c17b90a6cfeaef4908e150224bd58d6e?s=16&d=retro) |
b467a21 |
for mod in ${NF_MODULES[*]}; do
|
|
![](https://seccdn.libravatar.org/avatar/043cbe4382cc89c10798a4de55109392c17b90a6cfeaef4908e150224bd58d6e?s=16&d=retro) |
b467a21 |
rmmod_r $mod
|
|
![](https://seccdn.libravatar.org/avatar/043cbe4382cc89c10798a4de55109392c17b90a6cfeaef4908e150224bd58d6e?s=16&d=retro) |
b467a21 |
let ret+=$?;
|
|
![](https://seccdn.libravatar.org/avatar/043cbe4382cc89c10798a4de55109392c17b90a6cfeaef4908e150224bd58d6e?s=16&d=retro) |
b467a21 |
done
|
|
![](https://seccdn.libravatar.org/avatar/043cbe4382cc89c10798a4de55109392c17b90a6cfeaef4908e150224bd58d6e?s=16&d=retro) |
32bdef7 |
# try to unload remaining netfilter modules used by ipv4 and ipv6
|
|
![](https://seccdn.libravatar.org/avatar/043cbe4382cc89c10798a4de55109392c17b90a6cfeaef4908e150224bd58d6e?s=16&d=retro) |
32bdef7 |
# netfilter
|
|
![](https://seccdn.libravatar.org/avatar/043cbe4382cc89c10798a4de55109392c17b90a6cfeaef4908e150224bd58d6e?s=16&d=retro) |
b467a21 |
for mod in ${NF_MODULES_COMMON[*]}; do
|
|
![](https://seccdn.libravatar.org/avatar/043cbe4382cc89c10798a4de55109392c17b90a6cfeaef4908e150224bd58d6e?s=16&d=retro) |
6a95dca |
rmmod_r $mod >/dev/null
|
|
![](https://seccdn.libravatar.org/avatar/043cbe4382cc89c10798a4de55109392c17b90a6cfeaef4908e150224bd58d6e?s=16&d=retro) |
b467a21 |
done
|
|
cvsdist |
314b6dc |
[ $ret -eq 0 ] && success || failure
|
|
cvsdist |
314b6dc |
echo
|
|
cvsdist |
314b6dc |
fi
|
|
cvsdist |
31d8898 |
|
|
cvsdist |
31d8898 |
rm -f $VAR_SUBSYS_IPTABLES
|
|
cvsdist |
314b6dc |
return $ret
|
|
cvsdist |
31d8898 |
}
|
|
cvsdist |
31d8898 |
|
|
cvsdist |
31d8898 |
save() {
|
|
cvsdist |
31d8898 |
# Check if iptable module is loaded
|
|
![](https://seccdn.libravatar.org/avatar/043cbe4382cc89c10798a4de55109392c17b90a6cfeaef4908e150224bd58d6e?s=16&d=retro) |
22d0822 |
[ ! -e "$PROC_IPTABLES_NAMES" ] && return 0
|
|
cvsdist |
31d8898 |
|
|
cvsdist |
31d8898 |
# Check if firewall is configured (has tables)
|
|
![](https://seccdn.libravatar.org/avatar/043cbe4382cc89c10798a4de55109392c17b90a6cfeaef4908e150224bd58d6e?s=16&d=retro) |
22d0822 |
[ -z "$NF_TABLES" ] && return 6
|
|
cvsdist |
31d8898 |
|
|
![](https://seccdn.libravatar.org/avatar/043cbe4382cc89c10798a4de55109392c17b90a6cfeaef4908e150224bd58d6e?s=16&d=retro) |
6a95dca |
echo -n $"${IPTABLES}: Saving firewall rules to $IPTABLES_DATA: "
|
|
cvsdist |
31d8898 |
|
|
cvsdist |
31d8898 |
OPT=
|
|
cvsdist |
31d8898 |
[ "x$IPTABLES_SAVE_COUNTER" = "xyes" ] && OPT="-c"
|
|
cvsdist |
31d8898 |
|
|
cvsdist |
31d8898 |
ret=0
|
|
![](https://seccdn.libravatar.org/avatar/043cbe4382cc89c10798a4de55109392c17b90a6cfeaef4908e150224bd58d6e?s=16&d=retro) |
32bdef7 |
TMP_FILE=$(/bin/mktemp -q /tmp/$IPTABLES.XXXXXX) \
|
|
cvsdist |
31d8898 |
&& chmod 600 "$TMP_FILE" \
|
|
cvsdist |
31d8898 |
&& $IPTABLES-save $OPT > $TMP_FILE 2>/dev/null \
|
|
![](https://seccdn.libravatar.org/avatar/043cbe4382cc89c10798a4de55109392c17b90a6cfeaef4908e150224bd58d6e?s=16&d=retro) |
32bdef7 |
&& size=$(stat -c '%s' $TMP_FILE) && [ $size -gt 0 ] \
|
|
cvsdist |
31d8898 |
|| ret=1
|
|
cvsdist |
31d8898 |
if [ $ret -eq 0 ]; then
|
|
cvsdist |
31d8898 |
if [ -e $IPTABLES_DATA ]; then
|
|
cvsdist |
31d8898 |
cp -f $IPTABLES_DATA $IPTABLES_DATA.save \
|
|
cvsdist |
31d8898 |
&& chmod 600 $IPTABLES_DATA.save \
|
|
cvsdist |
31d8898 |
|| ret=1
|
|
cvsdist |
31d8898 |
fi
|
|
cvsdist |
31d8898 |
if [ $ret -eq 0 ]; then
|
|
cvsdist |
31d8898 |
cp -f $TMP_FILE $IPTABLES_DATA \
|
|
cvsdist |
31d8898 |
&& chmod 600 $IPTABLES_DATA \
|
|
cvsdist |
31d8898 |
|| ret=1
|
|
cvsdist |
31d8898 |
fi
|
|
cvsdist |
31d8898 |
fi
|
|
cvsdist |
31d8898 |
[ $ret -eq 0 ] && success || failure
|
|
cvsdist |
31d8898 |
echo
|
|
cvsdist |
31d8898 |
rm -f $TMP_FILE
|
|
cvsdist |
314b6dc |
return $ret
|
|
cvsdist |
31d8898 |
}
|
|
cvsdist |
31d8898 |
|
|
cvsdist |
31d8898 |
status() {
|
|
![](https://seccdn.libravatar.org/avatar/043cbe4382cc89c10798a4de55109392c17b90a6cfeaef4908e150224bd58d6e?s=16&d=retro) |
b467a21 |
if [ ! -f "$VAR_SUBSYS_IPTABLES" -a -z "$NF_TABLES" ]; then
|
|
![](https://seccdn.libravatar.org/avatar/043cbe4382cc89c10798a4de55109392c17b90a6cfeaef4908e150224bd58d6e?s=16&d=retro) |
6a95dca |
echo $"${IPTABLES}: Firewall is not running."
|
|
![](https://seccdn.libravatar.org/avatar/043cbe4382cc89c10798a4de55109392c17b90a6cfeaef4908e150224bd58d6e?s=16&d=retro) |
b467a21 |
return 3
|
|
![](https://seccdn.libravatar.org/avatar/043cbe4382cc89c10798a4de55109392c17b90a6cfeaef4908e150224bd58d6e?s=16&d=retro) |
b467a21 |
fi
|
|
![](https://seccdn.libravatar.org/avatar/043cbe4382cc89c10798a4de55109392c17b90a6cfeaef4908e150224bd58d6e?s=16&d=retro) |
adba868 |
|
|
cvsdist |
31d8898 |
# Do not print status if lockfile is missing and iptables modules are not
|
|
cvsdist |
31d8898 |
# loaded.
|
|
![](https://seccdn.libravatar.org/avatar/043cbe4382cc89c10798a4de55109392c17b90a6cfeaef4908e150224bd58d6e?s=16&d=retro) |
32bdef7 |
# Check if iptable modules are loaded
|
|
![](https://seccdn.libravatar.org/avatar/043cbe4382cc89c10798a4de55109392c17b90a6cfeaef4908e150224bd58d6e?s=16&d=retro) |
b467a21 |
if [ ! -e "$PROC_IPTABLES_NAMES" ]; then
|
|
![](https://seccdn.libravatar.org/avatar/043cbe4382cc89c10798a4de55109392c17b90a6cfeaef4908e150224bd58d6e?s=16&d=retro) |
6a95dca |
echo $"${IPTABLES}: Firewall modules are not loaded."
|
|
![](https://seccdn.libravatar.org/avatar/043cbe4382cc89c10798a4de55109392c17b90a6cfeaef4908e150224bd58d6e?s=16&d=retro) |
32bdef7 |
return 3
|
|
cvsdist |
31d8898 |
fi
|
|
cvsdist |
31d8898 |
|
|
cvsdist |
31d8898 |
# Check if firewall is configured (has tables)
|
|
![](https://seccdn.libravatar.org/avatar/043cbe4382cc89c10798a4de55109392c17b90a6cfeaef4908e150224bd58d6e?s=16&d=retro) |
b467a21 |
if [ -z "$NF_TABLES" ]; then
|
|
![](https://seccdn.libravatar.org/avatar/043cbe4382cc89c10798a4de55109392c17b90a6cfeaef4908e150224bd58d6e?s=16&d=retro) |
6a95dca |
echo $"${IPTABLES}: Firewall is not configured. "
|
|
![](https://seccdn.libravatar.org/avatar/043cbe4382cc89c10798a4de55109392c17b90a6cfeaef4908e150224bd58d6e?s=16&d=retro) |
32bdef7 |
return 3
|
|
cvsdist |
31d8898 |
fi
|
|
cvsdist |
31d8898 |
|
|
cvsdist |
31d8898 |
NUM=
|
|
cvsdist |
31d8898 |
[ "x$IPTABLES_STATUS_NUMERIC" = "xyes" ] && NUM="-n"
|
|
![](https://seccdn.libravatar.org/avatar/043cbe4382cc89c10798a4de55109392c17b90a6cfeaef4908e150224bd58d6e?s=16&d=retro) |
adba868 |
VERBOSE=
|
|
![](https://seccdn.libravatar.org/avatar/043cbe4382cc89c10798a4de55109392c17b90a6cfeaef4908e150224bd58d6e?s=16&d=retro) |
adba868 |
[ "x$IPTABLES_STATUS_VERBOSE" = "xyes" ] && VERBOSE="--verbose"
|
|
![](https://seccdn.libravatar.org/avatar/043cbe4382cc89c10798a4de55109392c17b90a6cfeaef4908e150224bd58d6e?s=16&d=retro) |
adba868 |
COUNT=
|
|
![](https://seccdn.libravatar.org/avatar/043cbe4382cc89c10798a4de55109392c17b90a6cfeaef4908e150224bd58d6e?s=16&d=retro) |
adba868 |
[ "x$IPTABLES_STATUS_LINENUMBERS" = "xyes" ] && COUNT="--line-numbers"
|
|
cvsdist |
31d8898 |
|
|
![](https://seccdn.libravatar.org/avatar/043cbe4382cc89c10798a4de55109392c17b90a6cfeaef4908e150224bd58d6e?s=16&d=retro) |
b467a21 |
for table in $NF_TABLES; do
|
|
cvsdist |
31d8898 |
echo $"Table: $table"
|
|
![](https://seccdn.libravatar.org/avatar/043cbe4382cc89c10798a4de55109392c17b90a6cfeaef4908e150224bd58d6e?s=16&d=retro) |
adba868 |
$IPTABLES -t $table --list $NUM $VERBOSE $COUNT && echo
|
|
cvsdist |
31d8898 |
done
|
|
cvsdist |
314b6dc |
|
|
cvsdist |
314b6dc |
return 0
|
|
cvsdist |
31d8898 |
}
|
|
cvsdist |
31d8898 |
|
|
cvsdist |
31d8898 |
restart() {
|
|
cvsdist |
31d8898 |
[ "x$IPTABLES_SAVE_ON_RESTART" = "xyes" ] && save
|
|
cvsdist |
31d8898 |
stop
|
|
cvsdist |
31d8898 |
start
|
|
cvsdist |
bfa5afa |
}
|
|
cvsdist |
bfa5afa |
|
|
![](https://seccdn.libravatar.org/avatar/043cbe4382cc89c10798a4de55109392c17b90a6cfeaef4908e150224bd58d6e?s=16&d=retro) |
32bdef7 |
|
|
cvsdist |
bfa5afa |
case "$1" in
|
|
cvsdist |
31d8898 |
start)
|
|
![](https://seccdn.libravatar.org/avatar/043cbe4382cc89c10798a4de55109392c17b90a6cfeaef4908e150224bd58d6e?s=16&d=retro) |
0396e7e |
[ -f "$VAR_SUBSYS_IPTABLES" ] && exit 0
|
|
cvsdist |
bfa5afa |
start
|
|
cvsdist |
314b6dc |
RETVAL=$?
|
|
cvsdist |
bfa5afa |
;;
|
|
cvsdist |
31d8898 |
stop)
|
|
cvsdist |
31d8898 |
[ "x$IPTABLES_SAVE_ON_STOP" = "xyes" ] && save
|
|
cvsdist |
bfa5afa |
stop
|
|
cvsdist |
314b6dc |
RETVAL=$?
|
|
cvsdist |
bfa5afa |
;;
|
|
![](https://seccdn.libravatar.org/avatar/043cbe4382cc89c10798a4de55109392c17b90a6cfeaef4908e150224bd58d6e?s=16&d=retro) |
32bdef7 |
restart|force-reload)
|
|
cvsdist |
31d8898 |
restart
|
|
cvsdist |
314b6dc |
RETVAL=$?
|
|
cvsdist |
bfa5afa |
;;
|
|
![](https://seccdn.libravatar.org/avatar/043cbe4382cc89c10798a4de55109392c17b90a6cfeaef4908e150224bd58d6e?s=16&d=retro) |
32bdef7 |
condrestart|try-restart)
|
|
![](https://seccdn.libravatar.org/avatar/043cbe4382cc89c10798a4de55109392c17b90a6cfeaef4908e150224bd58d6e?s=16&d=retro) |
bfc8fd6 |
[ ! -e "$VAR_SUBSYS_IPTABLES" ] && exit 0
|
|
![](https://seccdn.libravatar.org/avatar/043cbe4382cc89c10798a4de55109392c17b90a6cfeaef4908e150224bd58d6e?s=16&d=retro) |
32bdef7 |
restart
|
|
![](https://seccdn.libravatar.org/avatar/043cbe4382cc89c10798a4de55109392c17b90a6cfeaef4908e150224bd58d6e?s=16&d=retro) |
32bdef7 |
RETVAL=$?
|
|
cvsdist |
bfa5afa |
;;
|
|
cvsdist |
31d8898 |
status)
|
|
cvsdist |
31d8898 |
status
|
|
cvsdist |
314b6dc |
RETVAL=$?
|
|
cvsdist |
bfa5afa |
;;
|
|
cvsdist |
31d8898 |
panic)
|
|
cvsdist |
31d8898 |
flush_n_delete
|
|
cvsdist |
31d8898 |
set_policy DROP
|
|
cvsdist |
314b6dc |
RETVAL=$?
|
|
cvsdist |
bfa5afa |
;;
|
|
cvsdist |
31d8898 |
save)
|
|
cvsdist |
31d8898 |
save
|
|
cvsdist |
314b6dc |
RETVAL=$?
|
|
cvsdist |
bfa5afa |
;;
|
|
cvsdist |
31d8898 |
*)
|
|
![](https://seccdn.libravatar.org/avatar/043cbe4382cc89c10798a4de55109392c17b90a6cfeaef4908e150224bd58d6e?s=16&d=retro) |
6a95dca |
echo $"Usage: ${IPTABLES} {start|stop|restart|condrestart|status|panic|save}"
|
|
![](https://seccdn.libravatar.org/avatar/043cbe4382cc89c10798a4de55109392c17b90a6cfeaef4908e150224bd58d6e?s=16&d=retro) |
324c1a2 |
RETVAL=2
|
|
cvsdist |
31d8898 |
;;
|
|
cvsdist |
bfa5afa |
esac
|
|
cvsdist |
bfa5afa |
|
|
cvsdist |
314b6dc |
exit $RETVAL
|