1 | #!/bin/sh -e |
---|
2 | |
---|
3 | ### BEGIN INIT INFO |
---|
4 | # Provides: setfilter |
---|
5 | # Required-Start: ufw |
---|
6 | # Required-Stop: |
---|
7 | # Default-Start: S |
---|
8 | # Default-Stop: |
---|
9 | # Short-Description: set network filters with iptables |
---|
10 | ### END INIT INFO |
---|
11 | |
---|
12 | PATH="/sbin:/bin:/usr/sbin:/usr/bin" |
---|
13 | |
---|
14 | . /lib/lsb/init-functions |
---|
15 | |
---|
16 | if [ -s /etc/ufw/ufw.conf ]; then |
---|
17 | . /etc/ufw/ufw.conf |
---|
18 | else |
---|
19 | log_failure_msg "Could not find /etc/ufw/ufw.conf (aborting)" |
---|
20 | exit 1 |
---|
21 | fi |
---|
22 | |
---|
23 | RULES_PATH="/etc/ufw" |
---|
24 | |
---|
25 | case "$1" in |
---|
26 | start) |
---|
27 | if iptables -L LOG_ICMP -t raw -n >/dev/null 2>&1 ; then |
---|
28 | # if firewall loaded, tell to reload instead |
---|
29 | log_action_msg "Network filter already started, use 'force-reload'" |
---|
30 | exit 0 |
---|
31 | fi |
---|
32 | if [ "$ENABLED" = "yes" ] || [ "$ENABLED" = "YES" ]; then |
---|
33 | log_action_begin_msg "Setting network filter" |
---|
34 | error="" |
---|
35 | |
---|
36 | tables="raw mangle nat" |
---|
37 | for table in $tables |
---|
38 | do |
---|
39 | RULES="$RULES_PATH/$table.rules" |
---|
40 | |
---|
41 | #flush the chains |
---|
42 | iptables -F -t $table || error="yes" |
---|
43 | iptables -X -t $table || error="yes" |
---|
44 | |
---|
45 | if [ -s "$RULES" ]; then |
---|
46 | if ! iptables-restore -n < $RULES ; then |
---|
47 | log_action_cont_msg "Problem running '$RULES'" |
---|
48 | error="yes" |
---|
49 | fi |
---|
50 | else |
---|
51 | log_action_cont_msg "Couldn't find '$RULES'" |
---|
52 | fi |
---|
53 | done |
---|
54 | |
---|
55 | if [ "$error" = "yes" ]; then |
---|
56 | log_action_end_msg 1 |
---|
57 | exit 1 |
---|
58 | else |
---|
59 | log_action_end_msg 0 |
---|
60 | fi |
---|
61 | else |
---|
62 | log_action_begin_msg "Skipping network filter (not enabled)" |
---|
63 | log_action_end_msg 0 |
---|
64 | fi |
---|
65 | ;; |
---|
66 | stop) |
---|
67 | if [ "$ENABLED" != "yes" ] && [ "$ENABLED" != "YES" ]; then |
---|
68 | log_action_begin_msg "Skipping network filter (not enabled)" |
---|
69 | log_action_end_msg 0 |
---|
70 | exit 0 |
---|
71 | fi |
---|
72 | |
---|
73 | log_action_begin_msg "Stopping network filter" |
---|
74 | error="" |
---|
75 | |
---|
76 | tables="raw mangle nat" |
---|
77 | for table in $tables |
---|
78 | do |
---|
79 | iptables -F -t $table || error="yes" |
---|
80 | iptables -X -t $table || error="yes" |
---|
81 | done |
---|
82 | |
---|
83 | if [ "$error" = "yes" ]; then |
---|
84 | log_action_end_msg 1 |
---|
85 | exit 1 |
---|
86 | else |
---|
87 | log_action_end_msg 0 |
---|
88 | fi |
---|
89 | ;; |
---|
90 | restart|force-reload) |
---|
91 | if [ "$ENABLED" = "yes" ] || [ "$ENABLED" = "YES" ]; then |
---|
92 | $0 stop |
---|
93 | $0 start |
---|
94 | else |
---|
95 | log_warning_msg "Skipping $1 (not enabled)" |
---|
96 | fi |
---|
97 | ;; |
---|
98 | *) |
---|
99 | echo "Usage: /etc/init.d/setfilter {start|stop|restart|force-reload}" |
---|
100 | exit 1 |
---|
101 | ;; |
---|
102 | esac |
---|
103 | |
---|
104 | exit 0 |
---|
105 | |
---|