blob: ddecde17a6c72acd44766ba6e4021f22275844eb (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
|
#!/sbin/openrc-run
# Copyright 1999-2011 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
# $Header: /var/cvsroot/gentoo-x86/net-firewall/iptables/files/iptables-1.4.11.init,v 1.2 2011/12/04 10:15:59 swegener Exp $
description="IPv4/IPv6 packet filtering and NAT"
description_save="Save firewall state"
description_panic="Drop all packets"
description_reload="Reload configuration"
extra_commands="save panic"
extra_started_commands="reload"
iptables_name=${SVCNAME}
if [ "${iptables_name}" != "iptables" -a "${iptables_name}" != "ip6tables" ] ; then
iptables_name="iptables"
fi
iptables_bin="/sbin/${iptables_name}"
case ${iptables_name} in
iptables)
#shellcheck disable=SC2153
iptables_save="${IPTABLES_SAVE}"
sysctl_ipfwd=net.ipv4.ip_forward
;;
ip6tables)
iptables_save="${IP6TABLES_SAVE}"
sysctl_ipfwd=net.ipv6.conf.all.forwarding
;;
esac
# Add ip netns if configured to run in a netns namespace
if [ -n "$netns" ]; then
test -e /run/netns/$netns || ip netns add $netns
iptables_bin="ip netns exec $netns $iptables_bin"
fi
depend() {
before net
after sysctl
use logger
provide firewall
}
set_table_policy() {
local chains table=$1 policy=$2
case ${table} in
nat) chains="PREROUTING POSTROUTING OUTPUT";;
mangle) chains="PREROUTING INPUT FORWARD OUTPUT POSTROUTING";;
filter) chains="INPUT FORWARD OUTPUT";;
*) chains="";;
esac
local chain
for chain in ${chains} ; do
${iptables_bin} -w 5 -t ${table} -P ${chain} ${policy}
done
}
get_tables() {
# shellcheck disable=SC2086
${iptables_bin}-save | /bin/sed -n 's/^\*//p'
}
checkconfig() {
if [ ! -f ${iptables_save} ] ; then
eerror "Not starting ${iptables_name}. First create some rules then run:"
eerror "/etc/init.d/${iptables_name} save"
return 1
fi
return 0
}
start() {
checkconfig || return 1
ebegin "Loading ${iptables_name} state and starting firewall"
${iptables_bin}-restore ${SAVE_RESTORE_OPTIONS} < "${iptables_save}"
eend $?
if yesno "${IPFORWARD}"; then
ebegin "Enabling forwarding"
/sbin/sysctl -w ${sysctl_ipfwd}=1 > /dev/null
eend $?
fi
}
stop() {
if yesno "${IPFORWARD}"; then
ebegin "Disabling forwarding"
/sbin/sysctl -w ${sysctl_ipfwd}=0 > /dev/null
eend $?
fi
if yesno "${SAVE_ON_STOP}"; then
save || return 1
fi
ebegin "Stopping firewall"
local a
for a in $(get_tables) ; do
set_table_policy $a ACCEPT
${iptables_bin} -w 5 -F -t $a
${iptables_bin} -w 5 -X -t $a
done
eend $?
}
reload() {
ebegin "Flushing firewall"
local a
for a in $(get_tables) ; do
${iptables_bin} -w 5 -F -t $a
${iptables_bin} -w 5 -X -t $a
done
eend $?
start
}
save() {
ebegin "Saving ${iptables_name} state"
checkpath -fm 0600 "${iptables_save}"
local exitcode tmp
tmp="$(mktemp)"
${iptables_bin}-save ${SAVE_RESTORE_OPTIONS} > "${tmp}"
exitcode=$?
if [ "$exitcode" -eq 0 ]; then
# command succeeded, so overwrite
mv "${tmp}" "${iptables_save}"
else
ewarn "${iptables_bin}-save failed!"
rm -f "${tmp}"
fi
eend $exitcode
}
panic() {
if service_started ${iptables_name}; then
rc-service ${iptables_name} stop
fi
local a
ebegin "Dropping all packets"
for a in $(get_tables) ; do
${iptables_bin} -w 5 -F -t $a
${iptables_bin} -w 5 -X -t $a
set_table_policy $a DROP
done
eend $?
}
|
