[39eda0b] | 1 | #!/bin/sh -e |
---|
| 2 | |
---|
| 3 | ### BEGIN INIT INFO |
---|
| 4 | # Provides: setfilter |
---|
| 5 | # Required-Start: ufw |
---|
| 6 | # Required-Stop: |
---|
| 7 | # Default-Start: S |
---|
| 8 | # Default-Stop: |
---|
| 9 | # Short-Description: set network filters with iptables |
---|
| 10 | ### END INIT INFO |
---|
| 11 | |
---|
| 12 | PATH="/sbin:/bin:/usr/sbin:/usr/bin" |
---|
| 13 | |
---|
| 14 | . /lib/lsb/init-functions |
---|
| 15 | |
---|
| 16 | if [ -s /etc/ufw/ufw.conf ]; then |
---|
| 17 | . /etc/ufw/ufw.conf |
---|
| 18 | else |
---|
| 19 | log_failure_msg "Could not find /etc/ufw/ufw.conf (aborting)" |
---|
| 20 | exit 1 |
---|
| 21 | fi |
---|
| 22 | |
---|
| 23 | RULES_PATH="/etc/ufw" |
---|
| 24 | |
---|
| 25 | case "$1" in |
---|
| 26 | start) |
---|
| 27 | if iptables -L LOG_ICMP -t raw -n >/dev/null 2>&1 ; then |
---|
| 28 | # if firewall loaded, tell to reload instead |
---|
| 29 | log_action_msg "Network filter already started, use 'force-reload'" |
---|
| 30 | exit 0 |
---|
| 31 | fi |
---|
| 32 | if [ "$ENABLED" = "yes" ] || [ "$ENABLED" = "YES" ]; then |
---|
| 33 | log_action_begin_msg "Setting network filter" |
---|
| 34 | error="" |
---|
| 35 | |
---|
[71b798c] | 36 | tables="raw mangle nat" |
---|
[39eda0b] | 37 | for table in $tables |
---|
| 38 | do |
---|
| 39 | RULES="$RULES_PATH/$table.rules" |
---|
| 40 | |
---|
| 41 | #flush the chains |
---|
| 42 | iptables -F -t $table || error="yes" |
---|
| 43 | iptables -X -t $table || error="yes" |
---|
| 44 | |
---|
| 45 | if [ -s "$RULES" ]; then |
---|
| 46 | if ! iptables-restore -n < $RULES ; then |
---|
| 47 | log_action_cont_msg "Problem running '$RULES'" |
---|
| 48 | error="yes" |
---|
| 49 | fi |
---|
| 50 | else |
---|
| 51 | log_action_cont_msg "Couldn't find '$RULES'" |
---|
| 52 | fi |
---|
| 53 | done |
---|
| 54 | |
---|
| 55 | if [ "$error" = "yes" ]; then |
---|
| 56 | log_action_end_msg 1 |
---|
| 57 | exit 1 |
---|
| 58 | else |
---|
| 59 | log_action_end_msg 0 |
---|
| 60 | fi |
---|
| 61 | else |
---|
| 62 | log_action_begin_msg "Skipping network filter (not enabled)" |
---|
| 63 | log_action_end_msg 0 |
---|
| 64 | fi |
---|
| 65 | ;; |
---|
| 66 | stop) |
---|
| 67 | if [ "$ENABLED" != "yes" ] && [ "$ENABLED" != "YES" ]; then |
---|
| 68 | log_action_begin_msg "Skipping network filter (not enabled)" |
---|
| 69 | log_action_end_msg 0 |
---|
| 70 | exit 0 |
---|
| 71 | fi |
---|
| 72 | |
---|
| 73 | log_action_begin_msg "Stopping network filter" |
---|
| 74 | error="" |
---|
| 75 | |
---|
[71b798c] | 76 | tables="raw mangle nat" |
---|
[39eda0b] | 77 | for table in $tables |
---|
| 78 | do |
---|
| 79 | iptables -F -t $table || error="yes" |
---|
| 80 | iptables -X -t $table || error="yes" |
---|
| 81 | done |
---|
| 82 | |
---|
| 83 | if [ "$error" = "yes" ]; then |
---|
| 84 | log_action_end_msg 1 |
---|
| 85 | exit 1 |
---|
| 86 | else |
---|
| 87 | log_action_end_msg 0 |
---|
| 88 | fi |
---|
| 89 | ;; |
---|
| 90 | restart|force-reload) |
---|
| 91 | if [ "$ENABLED" = "yes" ] || [ "$ENABLED" = "YES" ]; then |
---|
| 92 | $0 stop |
---|
| 93 | $0 start |
---|
| 94 | else |
---|
| 95 | log_warning_msg "Skipping $1 (not enabled)" |
---|
| 96 | fi |
---|
| 97 | ;; |
---|
| 98 | *) |
---|
| 99 | echo "Usage: /etc/init.d/setfilter {start|stop|restart|force-reload}" |
---|
| 100 | exit 1 |
---|
| 101 | ;; |
---|
| 102 | esac |
---|
| 103 | |
---|
| 104 | exit 0 |
---|
| 105 | |
---|