143 lines
3.6 KiB
Bash
Executable file
143 lines
3.6 KiB
Bash
Executable file
#!/bin/bash
|
|
### BEGIN INIT INFO
|
|
# Provides: firewall
|
|
# Required-Start: $network
|
|
# Required-Stop: $network
|
|
# Default-Start: 2 3 4 5
|
|
# Default-Stop: 0 1 6
|
|
# Short-Description: Firewalls' state save/restore/flush
|
|
# Description: Store the firewalls' state at shutdown, and restores it at boot.
|
|
# Aalso set the firewalls to a default state, and flush all rules.
|
|
### END INIT INFO
|
|
|
|
DEFAULT_V4="/etc/firewall/default_v4.rules"
|
|
DEFAULT_V6="/etc/firewall/default_v6.rules"
|
|
STATE_V4="/etc/firewall/state_v4.rules"
|
|
STATE_V6="/etc/firewall/state_v6.rules"
|
|
|
|
# Confirm the iptables utilities are available.
|
|
[[ ! -x "/usr/sbin/iptables" ]] || [[ ! -x "/usr/sbin/ip6tables" ]] || [[ ! -x "/usr/sbin/iptables-save" ]] || [[ ! -x "/usr/sbin/iptables-restore" ]] || [[ ! -x "/usr/sbin/ip6tables-save" ]] || [[ ! -x "/usr/sbin/ip6tables-restore" ]] && {
|
|
printf "%s: %s\\n" "${0##*/}" "iptables package not installed!" >&2
|
|
exit 1
|
|
}
|
|
|
|
firewall_states_restore() {
|
|
local ERR=0
|
|
|
|
# Restore the saved (or default) v4 firewall state.
|
|
iptables-restore "$STATE_V4" 2>/dev/null || {
|
|
printf "%s: %s " "${0##*/}" "failed to restore saved" >&2
|
|
if iptables-restore "$DEFAULT_V4" 2>/dev/null; then
|
|
printf "%s " ", only default" >&2
|
|
else
|
|
printf "%s " "and default" >&2
|
|
ERR=1
|
|
fi
|
|
printf "%s\\n" "v4 firewall state" >&2
|
|
}
|
|
|
|
# Restore the saved (or default) v6 firewall state.
|
|
ip6tables-restore "$STATE_V6" 2>/dev/null || {
|
|
printf "%s: %s " "${0##*/}" "failed to restore saved" >&2
|
|
if ip6tables-restore "$DEFAULT_V6" 2>/dev/null; then
|
|
printf "%s " ", only default" >&2
|
|
else
|
|
printf "%s " "and default" >&2
|
|
ERR=1
|
|
fi
|
|
printf "%s\\n" "v6 firewall state" >&2
|
|
}
|
|
|
|
return "$ERR"
|
|
}
|
|
|
|
firewall_states_save() {
|
|
local ERR=0
|
|
|
|
# Store the state of the v4 firewall.
|
|
iptables-save >"$STATE_V4" 2>/dev/null || {
|
|
printf "%s: %s\\n" "${0##*/}" "failed to save v4 firewall state" >&2
|
|
ERR=1
|
|
}
|
|
|
|
# Store the state of the v6 firewall.
|
|
ip6tables-save >"$STATE_V6" 2>/dev/null || {
|
|
printf "%s: %s\\n" "${0##*/}" "failed to save v6 firewall state" >&2
|
|
ERR=1
|
|
}
|
|
|
|
return "$ERR"
|
|
}
|
|
|
|
firewall_defaults_restore() {
|
|
local ERR=0
|
|
|
|
# Restore the default v4 firewall state.
|
|
iptables-restore "$DEFAULT_V4" 2>/dev/null || {
|
|
printf "%s: %s\\n" "${0##*/}" "failed to restore default v4 firewall state" >&2
|
|
ERR=1
|
|
}
|
|
|
|
# Restore the default v6 firewall state.
|
|
ip6tables-restore "$DEFAULT_V6" 2>/dev/null || {
|
|
printf "%s: %s\\n" "${0##*/}" "failed to restore default v6 firewall state" >&2
|
|
ERR=1
|
|
}
|
|
|
|
return "$ERR"
|
|
}
|
|
|
|
firewall_flush() {
|
|
# Set the default policies to ACCEPT.
|
|
iptables -P INPUT ACCEPT
|
|
ip6tables -P INPUT ACCEPT
|
|
iptables -P OUTPUT ACCEPT
|
|
ip6tables -P OUTPUT ACCEPT
|
|
iptables -P FORWARD ACCEPT
|
|
ip6tables -P FORWARD ACCEPT
|
|
|
|
# Flush all the rules in the tables.
|
|
iptables -F INPUT
|
|
ip6tables -F INPUT
|
|
iptables -F OUTPUT
|
|
ip6tables -F OUTPUT
|
|
iptables -F FORWARD
|
|
ip6tables -F FORWARD
|
|
|
|
# Delete all user defined tables.
|
|
iptables -X
|
|
ip6tables -X
|
|
|
|
# Reset packet counters to zero.
|
|
iptables -Z
|
|
ip6tables -Z
|
|
|
|
return 0 # All the above commands should never fail.
|
|
}
|
|
|
|
case "$1" in
|
|
start|restart|reload|force-reload)
|
|
firewall_states_restore
|
|
exit "$?"
|
|
;;
|
|
stop)
|
|
firewall_states_save
|
|
exit "$?"
|
|
;;
|
|
defaults)
|
|
firewall_defaults_restore || {
|
|
printf "%s: %s\\n" "${0##*/}" "failed to restore default firewall state" >&2
|
|
exit 1
|
|
}
|
|
echo "$?"
|
|
;;
|
|
flush)
|
|
firewall_flush # Should never fail.
|
|
;;
|
|
*)
|
|
printf "%s %s\\n" "${0##*/}" "<start|stop|restart|reload|force-reload|defaults|flush>"
|
|
exit 2
|
|
;;
|
|
esac
|
|
|
|
exit 0
|