Blame SOURCES/iptables.init

8cce6c
#!/bin/bash
8cce6c
#
8cce6c
# iptables	Start iptables firewall
8cce6c
#
8cce6c
# chkconfig: 2345 08 92
8cce6c
# description:	Starts, stops and saves iptables firewall
8cce6c
#
8cce6c
# config: /etc/sysconfig/iptables
8cce6c
# config: /etc/sysconfig/iptables-config
8cce6c
#
8cce6c
### BEGIN INIT INFO
8cce6c
# Provides: iptables
8cce6c
# Required-Start:
8cce6c
# Required-Stop:
8cce6c
# Default-Start: 2 3 4 5
8cce6c
# Default-Stop: 0 1 6
8cce6c
# Short-Description: start and stop iptables firewall
8cce6c
# Description: Start, stop and save iptables firewall
8cce6c
### END INIT INFO
8cce6c
8cce6c
# Source function library.
8cce6c
. /etc/init.d/functions
8cce6c
8cce6c
IPTABLES=iptables
8cce6c
IPTABLES_DATA=/etc/sysconfig/$IPTABLES
8cce6c
IPTABLES_FALLBACK_DATA=${IPTABLES_DATA}.fallback
8cce6c
IPTABLES_CONFIG=/etc/sysconfig/${IPTABLES}-config
8cce6c
IPV=${IPTABLES%tables} # ip for ipv4 | ip6 for ipv6
8cce6c
[ "$IPV" = "ip" ] && _IPV="ipv4" || _IPV="ipv6"
8cce6c
VAR_SUBSYS_IPTABLES=/var/lock/subsys/$IPTABLES
8cce6c
8cce6c
# only usable for root
8cce6c
if [ $EUID != 0 ]; then
8cce6c
    echo -n $"${IPTABLES}: Only usable by root."; warning; echo
8cce6c
    exit 4
8cce6c
fi
8cce6c
8cce6c
if [ ! -x /sbin/$IPTABLES ]; then
8cce6c
    echo -n $"${IPTABLES}: /sbin/$IPTABLES does not exist."; warning; echo
8cce6c
    exit 5
8cce6c
fi
8cce6c
8cce6c
# Default firewall configuration:
8cce6c
IPTABLES_MODULES=""
8cce6c
IPTABLES_SAVE_ON_STOP="no"
8cce6c
IPTABLES_SAVE_ON_RESTART="no"
8cce6c
IPTABLES_SAVE_COUNTER="no"
8cce6c
IPTABLES_STATUS_NUMERIC="yes"
8cce6c
IPTABLES_STATUS_VERBOSE="no"
8cce6c
IPTABLES_STATUS_LINENUMBERS="yes"
8cce6c
IPTABLES_SYSCTL_LOAD_LIST=""
8cce6c
IPTABLES_RESTORE_WAIT=600
8cce6c
IPTABLES_RESTORE_WAIT_INTERVAL=1000000
8cce6c
8cce6c
# Load firewall configuration.
8cce6c
[ -f "$IPTABLES_CONFIG" ] && . "$IPTABLES_CONFIG"
8cce6c
8cce6c
# explicitly omit security table from this list as
8cce6c
# it should be reserved for SELinux use
8cce6c
NF_TABLES="raw mangle filter nat"
8cce6c
8cce6c
8cce6c
flush_n_delete() {
8cce6c
    # Flush firewall rules and delete chains.
8cce6c
    echo -n $"${IPTABLES}: Flushing firewall rules: "
8cce6c
    ret=0
8cce6c
    # For all tables
8cce6c
    for i in $NF_TABLES; do
8cce6c
        # Flush firewall rules.
8cce6c
	$IPTABLES -t $i -F;
8cce6c
	let ret+=$?;
8cce6c
8cce6c
        # Delete firewall chains.
8cce6c
	$IPTABLES -t $i -X;
8cce6c
	let ret+=$?;
8cce6c
8cce6c
	# Set counter to zero.
8cce6c
	$IPTABLES -t $i -Z;
8cce6c
	let ret+=$?;
8cce6c
    done
8cce6c
8cce6c
    [ $ret -eq 0 ] && success || failure
8cce6c
    echo
8cce6c
    return $ret
8cce6c
}
8cce6c
8cce6c
set_policy() {
8cce6c
    # Set policy for configured tables.
8cce6c
    policy=$1
8cce6c
    echo -n $"${IPTABLES}: Setting chains to policy $policy: "
8cce6c
    ret=0
8cce6c
    for i in $NF_TABLES; do
8cce6c
	echo -n "$i "
8cce6c
	case "$i" in
8cce6c
	    raw)
8cce6c
		$IPTABLES -t raw -P PREROUTING $policy \
8cce6c
		    && $IPTABLES -t raw -P OUTPUT $policy \
8cce6c
		    || let ret+=1
8cce6c
		;;
8cce6c
	    filter)
8cce6c
                $IPTABLES -t filter -P INPUT $policy \
8cce6c
		    && $IPTABLES -t filter -P OUTPUT $policy \
8cce6c
		    && $IPTABLES -t filter -P FORWARD $policy \
8cce6c
		    || let ret+=1
8cce6c
		;;
8cce6c
	    nat)
8cce6c
		$IPTABLES -t nat -P PREROUTING $policy \
8cce6c
		    && $IPTABLES -t nat -P POSTROUTING $policy \
8cce6c
		    && $IPTABLES -t nat -P OUTPUT $policy \
8cce6c
		    || let ret+=1
8cce6c
		;;
8cce6c
	    mangle)
8cce6c
	        $IPTABLES -t mangle -P PREROUTING $policy \
8cce6c
		    && $IPTABLES -t mangle -P POSTROUTING $policy \
8cce6c
		    && $IPTABLES -t mangle -P INPUT $policy \
8cce6c
		    && $IPTABLES -t mangle -P OUTPUT $policy \
8cce6c
		    && $IPTABLES -t mangle -P FORWARD $policy \
8cce6c
		    || let ret+=1
8cce6c
		;;
8cce6c
	    *)
8cce6c
	        let ret+=1
8cce6c
		;;
8cce6c
        esac
8cce6c
    done
8cce6c
8cce6c
    [ $ret -eq 0 ] && success || failure
8cce6c
    echo
8cce6c
    return $ret
8cce6c
}
8cce6c
8cce6c
load_sysctl() {
8cce6c
    # load matched sysctl values
8cce6c
    if [ -n "$IPTABLES_SYSCTL_LOAD_LIST" ]; then
8cce6c
        echo -n $"Loading sysctl settings: "
8cce6c
        ret=0
8cce6c
        for item in $IPTABLES_SYSCTL_LOAD_LIST; do
2e3e3a
            fgrep -hs $item /etc/sysctl.d/*.conf | sysctl -p - >/dev/null
8cce6c
            let ret+=$?;
8cce6c
        done
8cce6c
        [ $ret -eq 0 ] && success || failure
8cce6c
        echo
8cce6c
    fi
8cce6c
    return $ret
8cce6c
}
8cce6c
8cce6c
start() {
8cce6c
    # Do not start if there is no config file.
8cce6c
    if [ ! -f "$IPTABLES_DATA" ]; then
8cce6c
	echo -n $"${IPTABLES}: No config file."; warning; echo
8cce6c
	return 6
8cce6c
    fi
8cce6c
8cce6c
    # check if ipv6 module load is deactivated
8cce6c
    if [ "${_IPV}" = "ipv6" ] \
8cce6c
	&& grep -qIsE "^install[[:space:]]+${_IPV}[[:space:]]+/bin/(true|false)" /etc/modprobe.conf /etc/modprobe.d/* ; then
8cce6c
	echo $"${IPTABLES}: ${_IPV} is disabled."
8cce6c
	return 150
8cce6c
    fi
8cce6c
8cce6c
    echo -n $"${IPTABLES}: Applying firewall rules: "
8cce6c
8cce6c
    OPT=
8cce6c
    [ "x$IPTABLES_SAVE_COUNTER" = "xyes" ] && OPT="-c"
8cce6c
    if [ $IPTABLES_RESTORE_WAIT -ne 0 ]; then
8cce6c
       OPT="${OPT} --wait ${IPTABLES_RESTORE_WAIT}"
8cce6c
       if [ $IPTABLES_RESTORE_WAIT_INTERVAL -lt 1000000 ]; then
8cce6c
           OPT="${OPT} --wait-interval ${IPTABLES_RESTORE_WAIT_INTERVAL}"
8cce6c
       fi
8cce6c
    fi
8cce6c
8cce6c
    $IPTABLES-restore $OPT $IPTABLES_DATA
8cce6c
    if [ $? -eq 0 ]; then
8cce6c
	success; echo
8cce6c
    else
8cce6c
	failure; echo;
8cce6c
	if [ -f "$IPTABLES_FALLBACK_DATA" ]; then
8cce6c
	    echo -n $"${IPTABLES}: Applying firewall fallback rules: "
8cce6c
	    $IPTABLES-restore $OPT $IPTABLES_FALLBACK_DATA
8cce6c
	    if [ $? -eq 0 ]; then
8cce6c
		success; echo
8cce6c
	    else
8cce6c
		failure; echo; return 1
8cce6c
	    fi
8cce6c
	else
8cce6c
	    return 1
8cce6c
	fi
8cce6c
    fi
8cce6c
    
8cce6c
    # Load additional modules (helpers)
8cce6c
    if [ -n "$IPTABLES_MODULES" ]; then
8cce6c
	echo -n $"${IPTABLES}: Loading additional modules: "
8cce6c
	ret=0
8cce6c
	for mod in $IPTABLES_MODULES; do
8cce6c
	    echo -n "$mod "
8cce6c
	    modprobe $mod > /dev/null 2>&1
8cce6c
	    let ret+=$?;
8cce6c
	done
8cce6c
	[ $ret -eq 0 ] && success || failure
8cce6c
	echo
8cce6c
    fi
8cce6c
    
8cce6c
    # Load sysctl settings
8cce6c
    load_sysctl
8cce6c
8cce6c
    touch $VAR_SUBSYS_IPTABLES
8cce6c
    return $ret
8cce6c
}
8cce6c
8cce6c
stop() {
8cce6c
    # Set default chain policy to ACCEPT, in order to not break shutdown
8cce6c
    # on systems where the default policy is DROP and root device is
8cce6c
    # network-based (i.e.: iSCSI, NFS)
8cce6c
    set_policy ACCEPT
8cce6c
    # And then, flush the rules and delete chains
8cce6c
    flush_n_delete
8cce6c
    
8cce6c
    rm -f $VAR_SUBSYS_IPTABLES
8cce6c
    return $ret
8cce6c
}
8cce6c
8cce6c
save() {
8cce6c
    echo -n $"${IPTABLES}: Saving firewall rules to $IPTABLES_DATA: "
8cce6c
8cce6c
    OPT=
8cce6c
    [ "x$IPTABLES_SAVE_COUNTER" = "xyes" ] && OPT="-c"
8cce6c
8cce6c
    ret=0
8cce6c
    TMP_FILE=$(/bin/mktemp -q $IPTABLES_DATA.XXXXXX) \
8cce6c
	&& chmod 600 "$TMP_FILE" \
8cce6c
	&& $IPTABLES-save $OPT > $TMP_FILE 2>/dev/null \
8cce6c
	&& size=$(stat -c '%s' $TMP_FILE) && [ $size -gt 0 ] \
8cce6c
	|| ret=1
8cce6c
    if [ $ret -eq 0 ]; then
8cce6c
	if [ -e $IPTABLES_DATA ]; then
8cce6c
	    cp -f $IPTABLES_DATA $IPTABLES_DATA.save \
8cce6c
		&& chmod 600 $IPTABLES_DATA.save \
8cce6c
		&& restorecon $IPTABLES_DATA.save \
8cce6c
		|| ret=1
8cce6c
	fi
8cce6c
	if [ $ret -eq 0 ]; then
8cce6c
	    mv -f $TMP_FILE $IPTABLES_DATA \
8cce6c
		&& chmod 600 $IPTABLES_DATA \
8cce6c
		&& restorecon $IPTABLES_DATA \
8cce6c
	        || ret=1
8cce6c
	fi
8cce6c
    fi
8cce6c
    rm -f $TMP_FILE
8cce6c
    [ $ret -eq 0 ] && success || failure
8cce6c
    echo
8cce6c
    return $ret
8cce6c
}
8cce6c
8cce6c
status() {
8cce6c
    if [ ! -f "$VAR_SUBSYS_IPTABLES" ]; then
8cce6c
	echo $"${IPTABLES}: Firewall is not running."
8cce6c
	return 3
8cce6c
    fi
8cce6c
8cce6c
    NUM=
8cce6c
    [ "x$IPTABLES_STATUS_NUMERIC" = "xyes" ] && NUM="-n"
8cce6c
    VERBOSE= 
8cce6c
    [ "x$IPTABLES_STATUS_VERBOSE" = "xyes" ] && VERBOSE="--verbose"
8cce6c
    COUNT=
8cce6c
    [ "x$IPTABLES_STATUS_LINENUMBERS" = "xyes" ] && COUNT="--line-numbers"
8cce6c
8cce6c
    for table in $NF_TABLES; do
8cce6c
	echo $"Table: $table"
8cce6c
	$IPTABLES -t $table --list $NUM $VERBOSE $COUNT && echo
8cce6c
    done
8cce6c
8cce6c
    return 0
8cce6c
}
8cce6c
8cce6c
reload() {
8cce6c
    # Do not reload if there is no config file.
8cce6c
    if [ ! -f "$IPTABLES_DATA" ]; then
8cce6c
	echo -n $"${IPTABLES}: No config file."; warning; echo
8cce6c
	return 6
8cce6c
    fi
8cce6c
8cce6c
    # check if ipv6 module load is deactivated
8cce6c
    if [ "${_IPV}" = "ipv6" ] \
8cce6c
	&& grep -qIsE "^install[[:space:]]+${_IPV}[[:space:]]+/bin/(true|false)" /etc/modprobe.conf /etc/modprobe.d/* ; then
8cce6c
	echo $"${IPTABLES}: ${_IPV} is disabled."
8cce6c
	return 150
8cce6c
    fi
8cce6c
8cce6c
    echo -n $"${IPTABLES}: Trying to reload firewall rules: "
8cce6c
8cce6c
    OPT=
8cce6c
    [ "x$IPTABLES_SAVE_COUNTER" = "xyes" ] && OPT="-c"
8cce6c
    if [ $IPTABLES_RESTORE_WAIT -ne 0 ]; then
8cce6c
       OPT="${OPT} --wait ${IPTABLES_RESTORE_WAIT}"
8cce6c
       if [ $IPTABLES_RESTORE_WAIT_INTERVAL -lt 1000000 ]; then
8cce6c
           OPT="${OPT} --wait-interval ${IPTABLES_RESTORE_WAIT_INTERVAL}"
8cce6c
       fi
8cce6c
    fi
8cce6c
8cce6c
    $IPTABLES-restore $OPT $IPTABLES_DATA
8cce6c
    if [ $? -eq 0 ]; then
8cce6c
	success; echo
8cce6c
    else
8cce6c
	failure; echo; echo "Firewall rules are not changed."; return 1
8cce6c
    fi
8cce6c
8cce6c
    # Load additional modules (helpers)
8cce6c
    if [ -n "$IPTABLES_MODULES" ]; then
8cce6c
	echo -n $"${IPTABLES}: Loading additional modules: "
8cce6c
	ret=0
8cce6c
	for mod in $IPTABLES_MODULES; do
8cce6c
	    echo -n "$mod "
8cce6c
	    modprobe $mod > /dev/null 2>&1
8cce6c
	    let ret+=$?;
8cce6c
	done
8cce6c
	[ $ret -eq 0 ] && success || failure
8cce6c
	echo
8cce6c
    fi
8cce6c
8cce6c
    # Load sysctl settings
8cce6c
    load_sysctl
8cce6c
8cce6c
    return $ret
8cce6c
}
8cce6c
8cce6c
restart() {
8cce6c
    [ "x$IPTABLES_SAVE_ON_RESTART" = "xyes" ] && save
8cce6c
    stop
8cce6c
    start
8cce6c
}
8cce6c
8cce6c
8cce6c
case "$1" in
8cce6c
    start)
8cce6c
	[ -f "$VAR_SUBSYS_IPTABLES" ] && exit 0
8cce6c
	start
8cce6c
	RETVAL=$?
8cce6c
	;;
8cce6c
    stop)
8cce6c
	[ "x$IPTABLES_SAVE_ON_STOP" = "xyes" ] && save
8cce6c
	stop
8cce6c
	RETVAL=$?
8cce6c
	;;
8cce6c
    restart|force-reload)
8cce6c
	restart
8cce6c
	RETVAL=$?
8cce6c
	;;
8cce6c
    reload)
8cce6c
	[ -e "$VAR_SUBSYS_IPTABLES" ] && reload
8cce6c
	RETVAL=$?
8cce6c
	;;      
8cce6c
    condrestart|try-restart)
8cce6c
	[ ! -e "$VAR_SUBSYS_IPTABLES" ] && exit 0
8cce6c
	restart
8cce6c
	RETVAL=$?
8cce6c
	;;
8cce6c
    status)
8cce6c
	status
8cce6c
	RETVAL=$?
8cce6c
	;;
8cce6c
    panic)
8cce6c
	set_policy DROP
8cce6c
	RETVAL=$?
8cce6c
        ;;
8cce6c
    save)
8cce6c
	save
8cce6c
	RETVAL=$?
8cce6c
	;;
8cce6c
    *)
8cce6c
	echo $"Usage: ${IPTABLES} {start|stop|reload|restart|condrestart|status|panic|save}"
8cce6c
	RETVAL=2
8cce6c
	;;
8cce6c
esac
8cce6c
8cce6c
exit $RETVAL