#
# config: /etc/sysconfig/iptables
# config: /etc/sysconfig/iptables-config
+#
+### BEGIN INIT INFO
+# Provides: iptables
+# Default-Start: 2 3 4 5
+# Default-Stop: 0 1 6
+# Short-Description: start and stop iptables firewall
+# Description: Start, stop and save iptables firewall
+### END INIT INFO
+
+# from http://fr2.rpmfind.net/linux/fedora/releases/10/Everything/source/SRPMS/iptables-1.4.1.1-2.fc10.src.rpm
# Source function library.
. /etc/init.d/functions
IPTABLES_DATA=/etc/sysconfig/$IPTABLES
IPTABLES_CONFIG=/etc/sysconfig/${IPTABLES}-config
IPV=${IPTABLES%tables} # ip for ipv4 | ip6 for ipv6
+[ "$IPV" = "ip" ] && _IPV="ipv4" || _IPV="ipv6"
PROC_IPTABLES_NAMES=/proc/net/${IPV}_tables_names
VAR_SUBSYS_IPTABLES=/var/lock/subsys/$IPTABLES
if [ ! -x /sbin/$IPTABLES ]; then
- echo -n $"/sbin/$IPTABLES does not exist."; warning; echo
- exit 0
-fi
-
-if lsmod 2>/dev/null | grep -q ipchains ; then
- echo -n $"ipchains and $IPTABLES can not be used together."; warning; echo
- exit 0
+ echo -n $"${IPTABLES}: /sbin/$IPTABLES does not exist."; warning; echo
+ exit 5
fi
# Old or new modutils
IPTABLES_SAVE_ON_STOP="no"
IPTABLES_SAVE_ON_RESTART="no"
IPTABLES_SAVE_COUNTER="no"
-IPTABLES_STATUS_NUMERIC="no"
+IPTABLES_STATUS_NUMERIC="yes"
# Load firewall configuration.
[ -f "$IPTABLES_CONFIG" ] && . "$IPTABLES_CONFIG"
+# Netfilter modules
+NF_MODULES=($(lsmod | awk "/^${IPV}table_/ {print \$1}") ${IPV}_tables)
+NF_MODULES_COMMON=(x_tables nf_nat nf_conntrack) # Used by netfilter v4 and v6
+
+# Get active tables
+NF_TABLES=$(cat "$PROC_IPTABLES_NAMES" 2>/dev/null)
+
+
rmmod_r() {
# Unload module with all referring modules.
# At first all referring modules will be unloaded, then the module itself.
# Get referring modules.
# New modutils have another output format.
[ $NEW_MODUTILS = 1 ] \
- && ref=`lsmod | awk "/^${mod}/ { print \\\$4; }" | tr ',' ' '` \
- || ref=`lsmod | grep ^${mod} | cut -d "[" -s -f 2 | cut -d "]" -s -f 1`
+ && ref=$(lsmod | awk "/^${mod}/ { print \$4; }" | tr ',' ' ') \
+ || ref=$(lsmod | grep ^${mod} | cut -d "[" -s -f 2 | cut -d "]" -s -f 1)
# recursive call for all referring modules
for i in $ref; do
# after all referring modules are unloaded.
if grep -q "^${mod}" /proc/modules ; then
modprobe -r $mod > /dev/null 2>&1
- let ret+=$?;
+ res=$?
+ [ $res -eq 0 ] || echo -n " $mod"
+ let ret+=$res;
fi
return $ret
flush_n_delete() {
# Flush firewall rules and delete chains.
- [ -e "$PROC_IPTABLES_NAMES" ] || return 1
+ [ ! -e "$PROC_IPTABLES_NAMES" ] && return 0
# Check if firewall is configured (has tables)
- tables=`cat $PROC_IPTABLES_NAMES 2>/dev/null`
- [ -z "$tables" ] && return 1
+ [ -z "$NF_TABLES" ] && return 1
- echo -n $"Flushing firewall rules: "
+ echo -n $"${IPTABLES}: Flushing firewall rules: "
ret=0
# For all tables
- for i in $tables; do
+ for i in $NF_TABLES; do
# Flush firewall rules.
$IPTABLES -t $i -F;
let ret+=$?;
policy=$1
# Check if iptable module is loaded
- [ ! -e "$PROC_IPTABLES_NAMES" ] && return 1
+ [ ! -e "$PROC_IPTABLES_NAMES" ] && return 0
# Check if firewall is configured (has tables)
- tables=`cat $PROC_IPTABLES_NAMES 2>/dev/null`
+ tables=$(cat "$PROC_IPTABLES_NAMES" 2>/dev/null)
[ -z "$tables" ] && return 1
- echo -n $"Setting chains to policy $policy: "
+ echo -n $"${IPTABLES}: Setting chains to policy $policy: "
ret=0
for i in $tables; do
echo -n "$i "
case "$i" in
+ raw)
+ $IPTABLES -t raw -P PREROUTING $policy \
+ && $IPTABLES -t raw -P OUTPUT $policy \
+ || let ret+=1
+ ;;
filter)
$IPTABLES -t filter -P INPUT $policy \
&& $IPTABLES -t filter -P OUTPUT $policy \
start() {
# Do not start if there is no config file.
- [ -f "$IPTABLES_DATA" ] || return 1
+ [ ! -f "$IPTABLES_DATA" ] && return 6
- echo -n $"Applying $IPTABLES firewall rules: "
+ # check if ipv6 module load is deactivated
+ if [ "${_IPV}" = "ipv6" ] \
+ && grep -qIsE "^install[[:space:]]+${_IPV}[[:space:]]+/bin/(true|false)" /etc/modprobe.conf /etc/modprobe.d/* ; then
+ echo $"${IPTABLES}: ${_IPV} is disabled."
+ return 150
+ fi
+
+ echo -n $"${IPTABLES}: Applying firewall rules: "
OPT=
[ "x$IPTABLES_SAVE_COUNTER" = "xyes" ] && OPT="-c"
# Load additional modules (helpers)
if [ -n "$IPTABLES_MODULES" ]; then
- echo -n $"Loading additional $IPTABLES modules: "
+ echo -n $"${IPTABLES}: Loading additional modules: "
ret=0
for mod in $IPTABLES_MODULES; do
echo -n "$mod "
}
stop() {
-
- # Do not stop if iptables module is not loaded.
- [ -e "$PROC_IPTABLES_NAMES" ] || return 1
+ # Do not stop if iptables module is not loaded.
+ [ ! -e "$PROC_IPTABLES_NAMES" ] && return 0
flush_n_delete
set_policy ACCEPT
if [ "x$IPTABLES_MODULES_UNLOAD" = "xyes" ]; then
- echo -n $"Unloading $IPTABLES modules: "
+ echo -n $"${IPTABLES}: Unloading modules: "
ret=0
- rmmod_r ${IPV}_tables
- let ret+=$?;
- rmmod_r ${IPV}_conntrack
- let ret+=$?;
+ for mod in ${NF_MODULES[*]}; do
+ rmmod_r $mod
+ let ret+=$?;
+ done
+ # try to unload remaining netfilter modules used by ipv4 and ipv6
+ # netfilter
+ for mod in ${NF_MODULES_COMMON[*]}; do
+ rmmod_r $mod >/dev/null
+ done
[ $ret -eq 0 ] && success || failure
echo
fi
save() {
# Check if iptable module is loaded
- [ ! -e "$PROC_IPTABLES_NAMES" ] && return 1
+ [ ! -e "$PROC_IPTABLES_NAMES" ] && return 0
# Check if firewall is configured (has tables)
- tables=`cat $PROC_IPTABLES_NAMES 2>/dev/null`
- [ -z "$tables" ] && return 1
+ [ -z "$NF_TABLES" ] && return 6
- echo -n $"Saving firewall rules to $IPTABLES_DATA: "
+ echo -n $"${IPTABLES}: Saving firewall rules to $IPTABLES_DATA: "
OPT=
[ "x$IPTABLES_SAVE_COUNTER" = "xyes" ] && OPT="-c"
ret=0
- TMP_FILE=`/bin/mktemp -q /tmp/$IPTABLES.XXXXXX` \
+ TMP_FILE=$(/bin/mktemp -q /tmp/$IPTABLES.XXXXXX) \
&& chmod 600 "$TMP_FILE" \
&& $IPTABLES-save $OPT > $TMP_FILE 2>/dev/null \
- && size=`stat -c '%s' $TMP_FILE` && [ $size -gt 0 ] \
+ && size=$(stat -c '%s' $TMP_FILE) && [ $size -gt 0 ] \
|| ret=1
if [ $ret -eq 0 ]; then
if [ -e $IPTABLES_DATA ]; then
}
status() {
+ if [ ! -f "$VAR_SUBSYS_IPTABLES" -a -z "$NF_TABLES" ]; then
+ echo $"${IPTABLES}: Firewall is not running."
+ return 3
+ fi
+
# Do not print status if lockfile is missing and iptables modules are not
# loaded.
- # Check if iptable module is loaded
- if [ ! -f "$VAR_SUBSYS_IPTABLES" ]; then
- echo $"Firewall is stopped."
- return 1
+ # Check if iptable modules are loaded
+ if [ ! -e "$PROC_IPTABLES_NAMES" ]; then
+ echo $"${IPTABLES}: Firewall modules are not loaded."
+ return 3
fi
# Check if firewall is configured (has tables)
- if [ ! -e "$PROC_IPTABLES_NAMES" ]; then
- echo $"Firewall is not configured. "
- return 1
- fi
- tables=`cat $PROC_IPTABLES_NAMES 2>/dev/null`
- if [ -z "$tables" ]; then
- echo $"Firewall is not configured. "
- return 1
+ if [ -z "$NF_TABLES" ]; then
+ echo $"${IPTABLES}: Firewall is not configured. "
+ return 3
fi
NUM=
[ "x$IPTABLES_STATUS_NUMERIC" = "xyes" ] && NUM="-n"
+ VERBOSE=
+ [ "x$IPTABLES_STATUS_VERBOSE" = "xyes" ] && VERBOSE="--verbose"
+ COUNT=
+ [ "x$IPTABLES_STATUS_LINENUMBERS" = "xyes" ] && COUNT="--line-numbers"
- for table in $tables; do
+ for table in $NF_TABLES; do
echo $"Table: $table"
- $IPTABLES -t $table --list $NUM && echo
+ $IPTABLES -t $table --list $NUM $VERBOSE $COUNT && echo
done
return 0
start
}
+
case "$1" in
start)
- stop
+ [ -f "$VAR_SUBSYS_IPTABLES" ] && exit 0
start
RETVAL=$?
;;
stop
RETVAL=$?
;;
- restart)
+ restart|force-reload)
restart
RETVAL=$?
;;
- condrestart)
- [ -e "$VAR_SUBSYS_IPTABLES" ] && restart
+ condrestart|try-restart)
+ [ ! -e "$VAR_SUBSYS_IPTABLES" ] && exit 0
+ restart
+ RETVAL=$?
;;
status)
status
RETVAL=$?
;;
*)
- echo $"Usage: $0 {start|stop|restart|condrestart|status|panic|save}"
- exit 1
+ echo $"Usage: ${IPTABLES} {start|stop|restart|condrestart|status|panic|save}"
+ RETVAL=2
;;
esac
git://git.onelab.eu / iptables.git / blobdiff