Blame SOURCES/iptables.init

2b7d2b
#!/bin/bash
a2749a
#
a2749a
# iptables	Start iptables firewall
a2749a
#
a2749a
# chkconfig: 2345 08 92
a2749a
# description:	Starts, stops and saves iptables firewall
a2749a
#
a2749a
# config: /etc/sysconfig/iptables
a2749a
# config: /etc/sysconfig/iptables-config
a2749a
#
a2749a
### BEGIN INIT INFO
a2749a
# Provides: iptables
a2749a
# Required-Start:
a2749a
# Required-Stop:
a2749a
# Default-Start: 2 3 4 5
a2749a
# Default-Stop: 0 1 6
a2749a
# Short-Description: start and stop iptables firewall
a2749a
# Description: Start, stop and save iptables firewall
a2749a
### END INIT INFO
a2749a
a2749a
# Source function library.
a2749a
. /etc/init.d/functions
a2749a
a2749a
IPTABLES=iptables
a2749a
IPTABLES_DATA=/etc/sysconfig/$IPTABLES
ea7f4c
IPTABLES_FALLBACK_DATA=${IPTABLES_DATA}.fallback
a2749a
IPTABLES_CONFIG=/etc/sysconfig/${IPTABLES}-config
a2749a
IPV=${IPTABLES%tables} # ip for ipv4 | ip6 for ipv6
a2749a
[ "$IPV" = "ip" ] && _IPV="ipv4" || _IPV="ipv6"
a2749a
PROC_IPTABLES_NAMES=/proc/net/${IPV}_tables_names
a2749a
VAR_SUBSYS_IPTABLES=/var/lock/subsys/$IPTABLES
bc8ec3
RESTORECON=/bin/restorecon
bc8ec3
[ ! -x "$RESTORECON" ] && RESTORECON=/bin/true
a2749a
ea7f4c
# only usable for root
2b7d2b
if [ $EUID != 0 ]; then
2b7d2b
    echo -n $"${IPTABLES}: Only usable by root."; warning; echo
2b7d2b
    exit 4
2b7d2b
fi
ea7f4c
a2749a
if [ ! -x /sbin/$IPTABLES ]; then
a2749a
    echo -n $"${IPTABLES}: /sbin/$IPTABLES does not exist."; warning; echo
a2749a
    exit 5
a2749a
fi
a2749a
a2749a
# Old or new modutils
bc8ec3
/sbin/modprobe --version 2>&1 | grep -q 'kmod version' \
a2749a
    && NEW_MODUTILS=1 \
a2749a
    || NEW_MODUTILS=0
a2749a
a2749a
# Default firewall configuration:
a2749a
IPTABLES_MODULES=""
a2749a
IPTABLES_MODULES_UNLOAD="yes"
a2749a
IPTABLES_SAVE_ON_STOP="no"
a2749a
IPTABLES_SAVE_ON_RESTART="no"
a2749a
IPTABLES_SAVE_COUNTER="no"
a2749a
IPTABLES_STATUS_NUMERIC="yes"
a2749a
IPTABLES_STATUS_VERBOSE="no"
a2749a
IPTABLES_STATUS_LINENUMBERS="yes"
ea7f4c
IPTABLES_SYSCTL_LOAD_LIST=""
a2749a
a2749a
# Load firewall configuration.
a2749a
[ -f "$IPTABLES_CONFIG" ] && . "$IPTABLES_CONFIG"
a2749a
a2749a
# Netfilter modules
a2749a
NF_MODULES=($(lsmod | awk "/^${IPV}table_/ {print \$1}") ${IPV}_tables)
a2749a
NF_MODULES_COMMON=(x_tables nf_nat nf_conntrack) # Used by netfilter v4 and v6
a2749a
a2749a
# Get active tables
a2749a
NF_TABLES=$(cat "$PROC_IPTABLES_NAMES" 2>/dev/null)
a2749a
a2749a
a2749a
rmmod_r() {
a2749a
    # Unload module with all referring modules.
a2749a
    # At first all referring modules will be unloaded, then the module itself.
a2749a
    local mod=$1
a2749a
    local ret=0
a2749a
    local ref=
a2749a
a2749a
    # Get referring modules.
a2749a
    # New modutils have another output format.
a2749a
    [ $NEW_MODUTILS = 1 ] \
a2749a
	&& ref=$(lsmod | awk "/^${mod}/ { print \$4; }" | tr ',' ' ') \
a2749a
	|| ref=$(lsmod | grep ^${mod} | cut -d "[" -s -f 2 | cut -d "]" -s -f 1)
a2749a
a2749a
    # recursive call for all referring modules
a2749a
    for i in $ref; do
a2749a
	rmmod_r $i
a2749a
	let ret+=$?;
a2749a
    done
a2749a
a2749a
    # Unload module.
a2749a
    # The extra test is for 2.6: The module might have autocleaned,
a2749a
    # after all referring modules are unloaded.
a2749a
    if grep -q "^${mod}" /proc/modules ; then
a2749a
	modprobe -r $mod > /dev/null 2>&1
a2749a
	res=$?
a2749a
	[ $res -eq 0 ] || echo -n " $mod"
a2749a
	let ret+=$res;
a2749a
    fi
a2749a
a2749a
    return $ret
a2749a
}
a2749a
a2749a
flush_n_delete() {
a2749a
    # Flush firewall rules and delete chains.
a2749a
    [ ! -e "$PROC_IPTABLES_NAMES" ] && return 0
a2749a
a2749a
    # Check if firewall is configured (has tables)
a2749a
    [ -z "$NF_TABLES" ] && return 1
a2749a
a2749a
    echo -n $"${IPTABLES}: Flushing firewall rules: "
a2749a
    ret=0
a2749a
    # For all tables
a2749a
    for i in $NF_TABLES; do
a2749a
        # Flush firewall rules.
a2749a
	$IPTABLES -t $i -F;
a2749a
	let ret+=$?;
a2749a
a2749a
        # Delete firewall chains.
a2749a
	$IPTABLES -t $i -X;
a2749a
	let ret+=$?;
a2749a
a2749a
	# Set counter to zero.
a2749a
	$IPTABLES -t $i -Z;
a2749a
	let ret+=$?;
a2749a
    done
a2749a
a2749a
    [ $ret -eq 0 ] && success || failure
a2749a
    echo
a2749a
    return $ret
a2749a
}
a2749a
a2749a
set_policy() {
a2749a
    # Set policy for configured tables.
a2749a
    policy=$1
a2749a
a2749a
    # Check if iptable module is loaded
a2749a
    [ ! -e "$PROC_IPTABLES_NAMES" ] && return 0
a2749a
a2749a
    # Check if firewall is configured (has tables)
a2749a
    tables=$(cat "$PROC_IPTABLES_NAMES" 2>/dev/null)
a2749a
    [ -z "$tables" ] && return 1
a2749a
a2749a
    echo -n $"${IPTABLES}: Setting chains to policy $policy: "
a2749a
    ret=0
a2749a
    for i in $tables; do
a2749a
	echo -n "$i "
a2749a
	case "$i" in
a2749a
	    raw)
a2749a
		$IPTABLES -t raw -P PREROUTING $policy \
a2749a
		    && $IPTABLES -t raw -P OUTPUT $policy \
a2749a
		    || let ret+=1
a2749a
		;;
a2749a
	    filter)
a2749a
                $IPTABLES -t filter -P INPUT $policy \
a2749a
		    && $IPTABLES -t filter -P OUTPUT $policy \
a2749a
		    && $IPTABLES -t filter -P FORWARD $policy \
a2749a
		    || let ret+=1
a2749a
		;;
a2749a
	    nat)
a2749a
		$IPTABLES -t nat -P PREROUTING $policy \
a2749a
		    && $IPTABLES -t nat -P POSTROUTING $policy \
a2749a
		    && $IPTABLES -t nat -P OUTPUT $policy \
a2749a
		    || let ret+=1
a2749a
		;;
a2749a
	    mangle)
a2749a
	        $IPTABLES -t mangle -P PREROUTING $policy \
a2749a
		    && $IPTABLES -t mangle -P POSTROUTING $policy \
a2749a
		    && $IPTABLES -t mangle -P INPUT $policy \
a2749a
		    && $IPTABLES -t mangle -P OUTPUT $policy \
a2749a
		    && $IPTABLES -t mangle -P FORWARD $policy \
a2749a
		    || let ret+=1
a2749a
		;;
a2749a
	    *)
a2749a
	        let ret+=1
a2749a
		;;
a2749a
        esac
a2749a
    done
a2749a
a2749a
    [ $ret -eq 0 ] && success || failure
a2749a
    echo
a2749a
    return $ret
a2749a
}
a2749a
ea7f4c
load_sysctl() {
ea7f4c
    # load matched sysctl values
ea7f4c
    if [ -n "$IPTABLES_SYSCTL_LOAD_LIST" ]; then
ea7f4c
        echo -n $"Loading sysctl settings: "
ea7f4c
        ret=0
ea7f4c
        for item in $IPTABLES_SYSCTL_LOAD_LIST; do
ea7f4c
            fgrep $item /etc/sysctl.conf | sysctl -p - >/dev/null
ea7f4c
            let ret+=$?;
ea7f4c
        done
ea7f4c
        [ $ret -eq 0 ] && success || failure
ea7f4c
        echo
ea7f4c
    fi
ea7f4c
    return $ret
ea7f4c
}
ea7f4c
a2749a
start() {
a2749a
    # Do not start if there is no config file.
2b7d2b
    if [ ! -f "$IPTABLES_DATA" ]; then
2b7d2b
	echo -n $"${IPTABLES}: No config file."; warning; echo
2b7d2b
	return 6
2b7d2b
    fi
a2749a
a2749a
    # check if ipv6 module load is deactivated
a2749a
    if [ "${_IPV}" = "ipv6" ] \
a2749a
	&& grep -qIsE "^install[[:space:]]+${_IPV}[[:space:]]+/bin/(true|false)" /etc/modprobe.conf /etc/modprobe.d/* ; then
a2749a
	echo $"${IPTABLES}: ${_IPV} is disabled."
a2749a
	return 150
a2749a
    fi
a2749a
a2749a
    echo -n $"${IPTABLES}: Applying firewall rules: "
a2749a
a2749a
    OPT=
a2749a
    [ "x$IPTABLES_SAVE_COUNTER" = "xyes" ] && OPT="-c"
a2749a
a2749a
    $IPTABLES-restore $OPT $IPTABLES_DATA
a2749a
    if [ $? -eq 0 ]; then
a2749a
	success; echo
a2749a
    else
ea7f4c
	failure; echo;
ea7f4c
	if [ -f "$IPTABLES_FALLBACK_DATA" ]; then
ea7f4c
	    echo -n $"${IPTABLES}: Applying firewall fallback rules: "
ea7f4c
	    $IPTABLES-restore $OPT $IPTABLES_FALLBACK_DATA
ea7f4c
	    if [ $? -eq 0 ]; then
ea7f4c
		success; echo
ea7f4c
	    else
ea7f4c
		failure; echo; return 1
ea7f4c
	    fi
ea7f4c
	else
ea7f4c
	    return 1
ea7f4c
	fi
a2749a
    fi
a2749a
    
a2749a
    # Load additional modules (helpers)
a2749a
    if [ -n "$IPTABLES_MODULES" ]; then
a2749a
	echo -n $"${IPTABLES}: Loading additional modules: "
a2749a
	ret=0
a2749a
	for mod in $IPTABLES_MODULES; do
a2749a
	    echo -n "$mod "
a2749a
	    modprobe $mod > /dev/null 2>&1
a2749a
	    let ret+=$?;
a2749a
	done
a2749a
	[ $ret -eq 0 ] && success || failure
a2749a
	echo
a2749a
    fi
a2749a
    
ea7f4c
    # Load sysctl settings
ea7f4c
    load_sysctl
ea7f4c
a2749a
    touch $VAR_SUBSYS_IPTABLES
a2749a
    return $ret
a2749a
}
a2749a
a2749a
stop() {
a2749a
    # Do not stop if iptables module is not loaded.
a2749a
    [ ! -e "$PROC_IPTABLES_NAMES" ] && return 0
a2749a
ea7f4c
    # Set default chain policy to ACCEPT, in order to not break shutdown
ea7f4c
    # on systems where the default policy is DROP and root device is
ea7f4c
    # network-based (i.e.: iSCSI, NFS)
a2749a
    set_policy ACCEPT
ea7f4c
    # And then, flush the rules and delete chains
ea7f4c
    flush_n_delete
a2749a
    
a2749a
    if [ "x$IPTABLES_MODULES_UNLOAD" = "xyes" ]; then
a2749a
	echo -n $"${IPTABLES}: Unloading modules: "
a2749a
	ret=0
a2749a
	for mod in ${NF_MODULES[*]}; do
a2749a
	    rmmod_r $mod
a2749a
	    let ret+=$?;
a2749a
	done
a2749a
	# try to unload remaining netfilter modules used by ipv4 and ipv6 
a2749a
	# netfilter
a2749a
	for mod in ${NF_MODULES_COMMON[*]}; do
a2749a
	    rmmod_r $mod >/dev/null
a2749a
	done
a2749a
	[ $ret -eq 0 ] && success || failure
a2749a
	echo
a2749a
    fi
a2749a
    
a2749a
    rm -f $VAR_SUBSYS_IPTABLES
a2749a
    return $ret
a2749a
}
a2749a
a2749a
save() {
a2749a
    # Check if iptable module is loaded
2b7d2b
    if [ ! -e "$PROC_IPTABLES_NAMES" ]; then
2b7d2b
	echo -n $"${IPTABLES}: Nothing to save."; warning; echo
2b7d2b
	return 0
2b7d2b
    fi
a2749a
a2749a
    # Check if firewall is configured (has tables)
2b7d2b
    if [ -z "$NF_TABLES" ]; then
2b7d2b
	echo -n $"${IPTABLES}: Nothing to save."; warning; echo
2b7d2b
	return 6
2b7d2b
    fi
a2749a
a2749a
    echo -n $"${IPTABLES}: Saving firewall rules to $IPTABLES_DATA: "
a2749a
a2749a
    OPT=
a2749a
    [ "x$IPTABLES_SAVE_COUNTER" = "xyes" ] && OPT="-c"
a2749a
a2749a
    ret=0
ea7f4c
    TMP_FILE=$(/bin/mktemp -q $IPTABLES_DATA.XXXXXX) \
a2749a
	&& chmod 600 "$TMP_FILE" \
a2749a
	&& $IPTABLES-save $OPT > $TMP_FILE 2>/dev/null \
a2749a
	&& size=$(stat -c '%s' $TMP_FILE) && [ $size -gt 0 ] \
a2749a
	|| ret=1
a2749a
    if [ $ret -eq 0 ]; then
a2749a
	if [ -e $IPTABLES_DATA ]; then
a2749a
	    cp -f $IPTABLES_DATA $IPTABLES_DATA.save \
a2749a
		&& chmod 600 $IPTABLES_DATA.save \
bc8ec3
		&& $RESTORECON $IPTABLES_DATA.save \
a2749a
		|| ret=1
a2749a
	fi
a2749a
	if [ $ret -eq 0 ]; then
ea7f4c
	    mv -f $TMP_FILE $IPTABLES_DATA \
a2749a
		&& chmod 600 $IPTABLES_DATA \
bc8ec3
		&& $RESTORECON $IPTABLES_DATA \
a2749a
	        || ret=1
a2749a
	fi
a2749a
    fi
ea7f4c
    rm -f $TMP_FILE
a2749a
    [ $ret -eq 0 ] && success || failure
a2749a
    echo
a2749a
    return $ret
a2749a
}
a2749a
a2749a
status() {
a2749a
    if [ ! -f "$VAR_SUBSYS_IPTABLES" -a -z "$NF_TABLES" ]; then
a2749a
	echo $"${IPTABLES}: Firewall is not running."
a2749a
	return 3
a2749a
    fi
a2749a
a2749a
    # Do not print status if lockfile is missing and iptables modules are not 
a2749a
    # loaded.
a2749a
    # Check if iptable modules are loaded
a2749a
    if [ ! -e "$PROC_IPTABLES_NAMES" ]; then
a2749a
	echo $"${IPTABLES}: Firewall modules are not loaded."
a2749a
	return 3
a2749a
    fi
a2749a
a2749a
    # Check if firewall is configured (has tables)
a2749a
    if [ -z "$NF_TABLES" ]; then
a2749a
	echo $"${IPTABLES}: Firewall is not configured. "
a2749a
	return 3
a2749a
    fi
a2749a
a2749a
    NUM=
a2749a
    [ "x$IPTABLES_STATUS_NUMERIC" = "xyes" ] && NUM="-n"
a2749a
    VERBOSE= 
a2749a
    [ "x$IPTABLES_STATUS_VERBOSE" = "xyes" ] && VERBOSE="--verbose"
a2749a
    COUNT=
a2749a
    [ "x$IPTABLES_STATUS_LINENUMBERS" = "xyes" ] && COUNT="--line-numbers"
a2749a
a2749a
    for table in $NF_TABLES; do
a2749a
	echo $"Table: $table"
a2749a
	$IPTABLES -t $table --list $NUM $VERBOSE $COUNT && echo
a2749a
    done
a2749a
a2749a
    return 0
a2749a
}
a2749a
ea7f4c
reload() {
ea7f4c
    # Do not reload if there is no config file.
2b7d2b
    if [ ! -f "$IPTABLES_DATA" ]; then
2b7d2b
	echo -n $"${IPTABLES}: No config file."; warning; echo
2b7d2b
	return 6
2b7d2b
    fi
ea7f4c
ea7f4c
    # check if ipv6 module load is deactivated
ea7f4c
    if [ "${_IPV}" = "ipv6" ] \
ea7f4c
	&& grep -qIsE "^install[[:space:]]+${_IPV}[[:space:]]+/bin/(true|false)" /etc/modprobe.conf /etc/modprobe.d/* ; then
ea7f4c
	echo $"${IPTABLES}: ${_IPV} is disabled."
ea7f4c
	return 150
ea7f4c
    fi
ea7f4c
ea7f4c
    echo -n $"${IPTABLES}: Trying to reload firewall rules: "
ea7f4c
ea7f4c
    OPT=
ea7f4c
    [ "x$IPTABLES_SAVE_COUNTER" = "xyes" ] && OPT="-c"
ea7f4c
ea7f4c
    $IPTABLES-restore $OPT $IPTABLES_DATA
ea7f4c
    if [ $? -eq 0 ]; then
ea7f4c
	success; echo
ea7f4c
    else
ea7f4c
	failure; echo; echo "Firewall rules are not changed."; return 1
ea7f4c
    fi
ea7f4c
ea7f4c
    # Load additional modules (helpers)
ea7f4c
    if [ -n "$IPTABLES_MODULES" ]; then
ea7f4c
	echo -n $"${IPTABLES}: Loading additional modules: "
ea7f4c
	ret=0
ea7f4c
	for mod in $IPTABLES_MODULES; do
ea7f4c
	    echo -n "$mod "
ea7f4c
	    modprobe $mod > /dev/null 2>&1
ea7f4c
	    let ret+=$?;
ea7f4c
	done
ea7f4c
	[ $ret -eq 0 ] && success || failure
ea7f4c
	echo
ea7f4c
    fi
ea7f4c
ea7f4c
    # Load sysctl settings
ea7f4c
    load_sysctl
ea7f4c
ea7f4c
    return $ret
ea7f4c
}
ea7f4c
a2749a
restart() {
a2749a
    [ "x$IPTABLES_SAVE_ON_RESTART" = "xyes" ] && save
a2749a
    stop
a2749a
    start
a2749a
}
a2749a
a2749a
a2749a
case "$1" in
a2749a
    start)
a2749a
	[ -f "$VAR_SUBSYS_IPTABLES" ] && exit 0
a2749a
	start
a2749a
	RETVAL=$?
a2749a
	;;
a2749a
    stop)
a2749a
	[ "x$IPTABLES_SAVE_ON_STOP" = "xyes" ] && save
a2749a
	stop
a2749a
	RETVAL=$?
a2749a
	;;
a2749a
    restart|force-reload)
a2749a
	restart
a2749a
	RETVAL=$?
a2749a
	;;
ea7f4c
    reload)
ea7f4c
	[ -e "$VAR_SUBSYS_IPTABLES" ] && reload
ea7f4c
	RETVAL=$?
ea7f4c
	;;      
a2749a
    condrestart|try-restart)
a2749a
	[ ! -e "$VAR_SUBSYS_IPTABLES" ] && exit 0
a2749a
	restart
a2749a
	RETVAL=$?
a2749a
	;;
a2749a
    status)
a2749a
	status
a2749a
	RETVAL=$?
a2749a
	;;
a2749a
    panic)
a2749a
	set_policy DROP
a2749a
	RETVAL=$?
a2749a
        ;;
a2749a
    save)
a2749a
	save
a2749a
	RETVAL=$?
a2749a
	;;
a2749a
    *)
ea7f4c
	echo $"Usage: ${IPTABLES} {start|stop|reload|restart|condrestart|status|panic|save}"
a2749a
	RETVAL=2
a2749a
	;;
a2749a
esac
a2749a
a2749a
exit $RETVAL