Contents of /trunk/iptables/iptables.rc
Parent Directory
| 
Revision Log
Revision 1427 -
(show annotations)
(download)
Mon Jul 18 18:33:25 2011 UTC (13 years, 3 months ago) by niro
File size: 2661 byte(s)
Mon Jul 18 18:33:25 2011 UTC (13 years, 3 months ago) by niro
File size: 2661 byte(s)
-use rc_echo() and rc_print()
| 1 | #!/bin/sh |
| 2 | # $Header: /root/magellan-cvs/src/iptables/iptables.rc,v 1.2 2008-03-27 10:40:32 niro Exp $ |
| 3 | |
| 4 | #%rlevels: 2:s 3:s 4:s 5:s 0:k 1:k 6:k |
| 5 | #%start: 15 |
| 6 | #%stop: 55 |
| 7 | |
| 8 | #deps |
| 9 | #%needs: |
| 10 | #%before: |
| 11 | #%after: |
| 12 | |
| 13 | source /etc/sysconfig/rc |
| 14 | source $rc_functions |
| 15 | |
| 16 | # default cmds |
| 17 | SVC_NAME=iptables |
| 18 | IPTABLES=/sbin/iptables |
| 19 | IPTABLES_SAVE=/sbin/iptables-save |
| 20 | IPTABLES_RESTORE=/sbin/iptables-restore |
| 21 | IPTABLES_PROC=/proc/net/ip_tables_names |
| 22 | |
| 23 | # read config |
| 24 | source /etc/conf.d/${SVC_NAME} |
| 25 | |
| 26 | checkconfig() |
| 27 | { |
| 28 | if [[ ! -f ${IPTABLES_SAVE_PATH} ]] |
| 29 | then |
| 30 | rc_echo -e ${COLRED} "Not starting ${SVC_NAME}. First create some rules then run:" |
| 31 | rc_echo -e ${COLRED} "/etc/init.d/${SVC_NAME} save" |
| 32 | exit 1 |
| 33 | fi |
| 34 | return 0 |
| 35 | } |
| 36 | |
| 37 | set_table_policy() |
| 38 | { |
| 39 | local chains |
| 40 | local chain |
| 41 | |
| 42 | table=$1 |
| 43 | policy=$2 |
| 44 | |
| 45 | # select correct rules from corresponding chains |
| 46 | case ${table} in |
| 47 | nat) chains="PREROUTING POSTROUTING OUTPUT";; |
| 48 | mangle) chains="PREROUTING INPUT FORWARD OUTPUT POSTROUTING";; |
| 49 | filter) chains="INPUT FORWARD OUTPUT";; |
| 50 | *) chains="";; |
| 51 | esac |
| 52 | |
| 53 | # set rules to given policy |
| 54 | for chain in ${chains} |
| 55 | do |
| 56 | ${IPTABLES} -t ${table} -P ${chain} ${policy} |
| 57 | done |
| 58 | } |
| 59 | |
| 60 | case "$1" in |
| 61 | start) |
| 62 | checkconfig |
| 63 | rc_print "Loading ${SVC_NAME} ruleset ..." |
| 64 | |
| 65 | ${IPTABLES_RESTORE} ${SAVE_RESTORE_OPTIONS} < "${IPTABLES_SAVE_PATH}" |
| 66 | evaluate_retval |
| 67 | |
| 68 | update_svcstatus $1 |
| 69 | splash svc_started "$(basename $0)" 0 |
| 70 | ;; |
| 71 | |
| 72 | stop) |
| 73 | if [[ ${SAVE_ON_STOP} = yes ]] |
| 74 | then |
| 75 | $0 save |
| 76 | fi |
| 77 | |
| 78 | rc_print "Stopping ${SVC_NAME} and reseting ruleset ..." |
| 79 | |
| 80 | for rule in $(<${IPTABLES_PROC}) |
| 81 | do |
| 82 | # flush rules |
| 83 | ${IPTABLES} -F -t ${rule} |
| 84 | |
| 85 | # delete chains |
| 86 | ${IPTABLES} -X -t ${rule} |
| 87 | |
| 88 | # set all policies to ACCEPT |
| 89 | set_table_policy ${rule} ACCEPT |
| 90 | done |
| 91 | evaluate_retval |
| 92 | |
| 93 | update_svcstatus $1 |
| 94 | splash svc_stopped "$(basename $0)" 0 |
| 95 | ;; |
| 96 | |
| 97 | reload) |
| 98 | rc_print "Flushing ${SVC_NAME} ruleset ..." |
| 99 | for rule in $(<${IPTABLES_PROC}) |
| 100 | do |
| 101 | # flush rules |
| 102 | ${IPTABLES} -F -t ${rule} |
| 103 | |
| 104 | # delete chains |
| 105 | ${IPTABLES} -X -t ${rule} |
| 106 | done |
| 107 | $0 start |
| 108 | ;; |
| 109 | |
| 110 | save) |
| 111 | rc_print "Saving ${SVC_NAME} ruleset ..." |
| 112 | [ ! -d $(dirname ${IPTABLES_SAVE_PATH}) ] && |
| 113 | install -d $(dirname ${IPTABLES_SAVE_PATH}) |
| 114 | touch "${IPTABLES_SAVE_PATH}" |
| 115 | chmod 0600 "${IPTABLES_SAVE_PATH}" |
| 116 | ${IPTABLES_SAVE} ${SAVE_RESTORE_OPTIONS} > "${IPTABLES_SAVE_PATH}" |
| 117 | ;; |
| 118 | |
| 119 | panic) |
| 120 | rc_print "Enabled Panic-Mode for ${SVC_NAME} (DROP ALL) ..." |
| 121 | for rule in $(<${IPTABLES_PROC}) |
| 122 | do |
| 123 | ${IPTABLES} -F -t ${rule} |
| 124 | ${IPTABLES} -X -t ${rule} |
| 125 | |
| 126 | set_table_policy ${rule} DROP |
| 127 | done |
| 128 | evaluate_retval |
| 129 | ;; |
| 130 | |
| 131 | restart) |
| 132 | $0 stop |
| 133 | sleep 1 |
| 134 | $0 start |
| 135 | ;; |
| 136 | |
| 137 | *) |
| 138 | rc_echo "Usage: $0 {start|stop|reload|save|panic|restart}" |
| 139 | exit 1 |
| 140 | ;; |
| 141 | esac |