#
# config: /etc/sysconfig/iptables
# config: /etc/sysconfig/iptables-config
+#
+### BEGIN INIT INFO
+# Provides: iptables
+# Required-Start:
+# Required-Stop:
+# Default-Start: 2 3 4 5
+# Default-Stop: 0 1 6
+# Short-Description: start and stop iptables firewall
+# Description: Start, stop and save iptables firewall
+### END INIT INFO
# Source function library.
. /etc/init.d/functions
IPTABLES_DATA=/etc/sysconfig/$IPTABLES
IPTABLES_CONFIG=/etc/sysconfig/${IPTABLES}-config
IPV=${IPTABLES%tables} # ip for ipv4 | ip6 for ipv6
+[ "$IPV" = "ip" ] && _IPV="ipv4" || _IPV="ipv6"
PROC_IPTABLES_NAMES=/proc/net/${IPV}_tables_names
VAR_SUBSYS_IPTABLES=/var/lock/subsys/$IPTABLES
if [ ! -x /sbin/$IPTABLES ]; then
- echo -n $"/sbin/$IPTABLES does not exist."; warning; echo
- exit 0
-fi
-
-if lsmod 2>/dev/null | grep -q ipchains ; then
- echo -n $"ipchains and $IPTABLES can not be used together."; warning; echo
- exit 0
+ echo -n $"${IPTABLES}: /sbin/$IPTABLES does not exist."; warning; echo
+ exit 5
fi
# Old or new modutils
IPTABLES_SAVE_ON_STOP="no"
IPTABLES_SAVE_ON_RESTART="no"
IPTABLES_SAVE_COUNTER="no"
-IPTABLES_STATUS_NUMERIC="no"
+IPTABLES_STATUS_NUMERIC="yes"
+IPTABLES_STATUS_VERBOSE="no"
+IPTABLES_STATUS_LINENUMBERS="yes"
# Load firewall configuration.
[ -f "$IPTABLES_CONFIG" ] && . "$IPTABLES_CONFIG"
+# Netfilter modules
+NF_MODULES=($(lsmod | awk "/^${IPV}table_/ {print \$1}") ${IPV}_tables)
+NF_MODULES_COMMON=(x_tables nf_nat nf_conntrack) # Used by netfilter v4 and v6
+
+# Get active tables
+NF_TABLES=$(cat "$PROC_IPTABLES_NAMES" 2>/dev/null)
+
+
rmmod_r() {
# Unload module with all referring modules.
# At first all referring modules will be unloaded, then the module itself.
# Get referring modules.
# New modutils have another output format.
[ $NEW_MODUTILS = 1 ] \
- && ref=`lsmod | awk "/^${mod}/ { print \\\$4; }" | tr ',' ' '` \
- || ref=`lsmod | grep ^${mod} | cut -d "[" -s -f 2 | cut -d "]" -s -f 1`
+ && ref=$(lsmod | awk "/^${mod}/ { print \$4; }" | tr ',' ' ') \
+ || ref=$(lsmod | grep ^${mod} | cut -d "[" -s -f 2 | cut -d "]" -s -f 1)
# recursive call for all referring modules
for i in $ref; do
# after all referring modules are unloaded.
if grep -q "^${mod}" /proc/modules ; then
modprobe -r $mod > /dev/null 2>&1
- let ret+=$?;
+ res=$?
+ [ $res -eq 0 ] || echo -n " $mod"
+ let ret+=$res;
fi
return $ret
flush_n_delete() {
# Flush firewall rules and delete chains.
- [ -e "$PROC_IPTABLES_NAMES" ] || return 1
+ [ ! -e "$PROC_IPTABLES_NAMES" ] && return 0
# Check if firewall is configured (has tables)
- tables=`cat $PROC_IPTABLES_NAMES 2>/dev/null`
- [ -z "$tables" ] && return 1
+ [ -z "$NF_TABLES" ] && return 1
- echo -n $"Flushing firewall rules: "
+ echo -n $"${IPTABLES}: Flushing firewall rules: "
ret=0
# For all tables
- for i in $tables; do
+ for i in $NF_TABLES; do
# Flush firewall rules.
$IPTABLES -t $i -F;
let ret+=$?;
policy=$1
# Check if iptable module is loaded
- [ ! -e "$PROC_IPTABLES_NAMES" ] && return 1
+ [ ! -e "$PROC_IPTABLES_NAMES" ] && return 0
# Check if firewall is configured (has tables)
- tables=`cat $PROC_IPTABLES_NAMES 2>/dev/null`
+ tables=$(cat "$PROC_IPTABLES_NAMES" 2>/dev/null)
[ -z "$tables" ] && return 1
- echo -n $"Setting chains to policy $policy: "
+ echo -n $"${IPTABLES}: Setting chains to policy $policy: "
ret=0
for i in $tables; do
echo -n "$i "
case "$i" in
+ raw)
+ $IPTABLES -t raw -P PREROUTING $policy \
+ && $IPTABLES -t raw -P OUTPUT $policy \
+ || let ret+=1
+ ;;
filter)
$IPTABLES -t filter -P INPUT $policy \
&& $IPTABLES -t filter -P OUTPUT $policy \
start() {
# Do not start if there is no config file.
- [ -f "$IPTABLES_DATA" ] || return 1
+ [ ! -f "$IPTABLES_DATA" ] && return 6
+
+ # check if ipv6 module load is deactivated
+ if [ "${_IPV}" = "ipv6" ] \
+ && grep -qIsE "^install[[:space:]]+${_IPV}[[:space:]]+/bin/(true|false)" /etc/modprobe.conf /etc/modprobe.d/* ; then
+ echo $"${IPTABLES}: ${_IPV} is disabled."
+ return 150
+ fi
- echo -n $"Applying $IPTABLES firewall rules: "
+ echo -n $"${IPTABLES}: Applying firewall rules: "
OPT=
[ "x$IPTABLES_SAVE_COUNTER" = "xyes" ] && OPT="-c"
failure; echo; return 1
fi
- # Tuntap initialization
-
- if [ -z "$taps" -a -r /etc/planetlab/node_id ] ; then
- # If this node is not "virtually multi-homed", just bring up
- # the tap interface with a PLB private address. The PLB
- # convention is to assign a unique 10.x.y.0/24 network to each
- # node where x.y is the PlanetLab node ID of the machine in
- # host order:
- #
- # x = (node_id / 256) % 256
- # y = node_id % 256
- #
- node_id=$(cat /etc/planetlab/node_id)
- taps="tap0"
- tap0=$(printf 10.%d.%d.1 $((($node_id / 256) % 256)) $(($node_id % 256)))
- tapmask=255.0.0.0
- fi
-
# Load additional modules (helpers)
if [ -n "$IPTABLES_MODULES" ]; then
- echo -n $"Loading additional $IPTABLES modules: "
+ echo -n $"${IPTABLES}: Loading additional modules: "
ret=0
for mod in $IPTABLES_MODULES; do
echo -n "$mod "
[ $ret -eq 0 ] && success || failure
echo
fi
-
- for tap in $taps ; do
- # Configuration for this tap (address/proxy)
- eval cfg=\$$tap
- addr=${cfg%/*}
- proxy=${cfg#*/}
-
- # Set MAC address to something predictable
- mac=$(printf 00:FF:%X:%X:%X:%X $(echo $addr | sed -e 's/\./ /g'))
-
- # Bring up this interface. Optimize the MTU for the PlanetLab
- # Backbone (1500/Ethernet - 4/GRE - 8/UDP - 20/IP = 1468).
- ifconfig $tap down && \
- ifconfig $tap hw ether $mac mtu 1468 && \
- ifconfig $tap $addr ${proxy:+pointopoint $proxy} netmask ${tapmask:=255.255.255.255} up
-
- # Stuffing the proxy for this address in the pointopoint field
- # creates a static route to the proxy that we do not want
- # present.
- if [ -n "$proxy" -a "$proxy" != "$addr" ] ; then
- ip route del $proxy
- fi
-
- # Enable route through this interface
- ip route add default dev $tap tab 1 && \
- ip rule add from $addr tab 1
- done
-
touch $VAR_SUBSYS_IPTABLES
return $ret
}
stop() {
-
- # Do not stop if iptables module is not loaded.
- [ -e "$PROC_IPTABLES_NAMES" ] || return 1
+ # Do not stop if iptables module is not loaded.
+ [ ! -e "$PROC_IPTABLES_NAMES" ] && return 0
flush_n_delete
set_policy ACCEPT
if [ "x$IPTABLES_MODULES_UNLOAD" = "xyes" ]; then
- echo -n $"Unloading $IPTABLES modules: "
+ echo -n $"${IPTABLES}: Unloading modules: "
ret=0
- rmmod_r ${IPV}_tables
- let ret+=$?;
- rmmod_r ${IPV}_conntrack
- let ret+=$?;
+ for mod in ${NF_MODULES[*]}; do
+ rmmod_r $mod
+ let ret+=$?;
+ done
+ # try to unload remaining netfilter modules used by ipv4 and ipv6
+ # netfilter
+ for mod in ${NF_MODULES_COMMON[*]}; do
+ rmmod_r $mod >/dev/null
+ done
[ $ret -eq 0 ] && success || failure
echo
fi
-
- # Take down vnet interfaces
- for dev in $taps tap0 ; do
- action $"Shutting down interface $dev: " \
- ifconfig $dev 0.0.0.0 down
- done
-
+
rm -f $VAR_SUBSYS_IPTABLES
return $ret
}
save() {
# Check if iptable module is loaded
- [ ! -e "$PROC_IPTABLES_NAMES" ] && return 1
+ [ ! -e "$PROC_IPTABLES_NAMES" ] && return 0
# Check if firewall is configured (has tables)
- tables=`cat $PROC_IPTABLES_NAMES 2>/dev/null`
- [ -z "$tables" ] && return 1
+ [ -z "$NF_TABLES" ] && return 6
- echo -n $"Saving firewall rules to $IPTABLES_DATA: "
+ echo -n $"${IPTABLES}: Saving firewall rules to $IPTABLES_DATA: "
OPT=
[ "x$IPTABLES_SAVE_COUNTER" = "xyes" ] && OPT="-c"
ret=0
- TMP_FILE=`/bin/mktemp -q /tmp/$IPTABLES.XXXXXX` \
+ TMP_FILE=$(/bin/mktemp -q /tmp/$IPTABLES.XXXXXX) \
&& chmod 600 "$TMP_FILE" \
&& $IPTABLES-save $OPT > $TMP_FILE 2>/dev/null \
- && size=`stat -c '%s' $TMP_FILE` && [ $size -gt 0 ] \
+ && size=$(stat -c '%s' $TMP_FILE) && [ $size -gt 0 ] \
|| ret=1
if [ $ret -eq 0 ]; then
if [ -e $IPTABLES_DATA ]; then
}
status() {
+ if [ ! -f "$VAR_SUBSYS_IPTABLES" -a -z "$NF_TABLES" ]; then
+ echo $"${IPTABLES}: Firewall is not running."
+ return 3
+ fi
+
# Do not print status if lockfile is missing and iptables modules are not
# loaded.
- # Check if iptable module is loaded
- if [ ! -f "$VAR_SUBSYS_IPTABLES" ]; then
- echo $"Firewall is stopped."
- return 1
+ # Check if iptable modules are loaded
+ if [ ! -e "$PROC_IPTABLES_NAMES" ]; then
+ echo $"${IPTABLES}: Firewall modules are not loaded."
+ return 3
fi
# Check if firewall is configured (has tables)
- if [ ! -e "$PROC_IPTABLES_NAMES" ]; then
- echo $"Firewall is not configured. "
- return 1
- fi
- tables=`cat $PROC_IPTABLES_NAMES 2>/dev/null`
- if [ -z "$tables" ]; then
- echo $"Firewall is not configured. "
- return 1
+ if [ -z "$NF_TABLES" ]; then
+ echo $"${IPTABLES}: Firewall is not configured. "
+ return 3
fi
NUM=
[ "x$IPTABLES_STATUS_NUMERIC" = "xyes" ] && NUM="-n"
+ VERBOSE=
+ [ "x$IPTABLES_STATUS_VERBOSE" = "xyes" ] && VERBOSE="--verbose"
+ COUNT=
+ [ "x$IPTABLES_STATUS_LINENUMBERS" = "xyes" ] && COUNT="--line-numbers"
- for table in $tables; do
+ for table in $NF_TABLES; do
echo $"Table: $table"
- $IPTABLES -t $table --list $NUM && echo
+ $IPTABLES -t $table --list $NUM $VERBOSE $COUNT && echo
done
return 0
start
}
+
case "$1" in
start)
- stop
+ [ -f "$VAR_SUBSYS_IPTABLES" ] && exit 0
start
RETVAL=$?
;;
stop
RETVAL=$?
;;
- restart)
+ restart|force-reload)
restart
RETVAL=$?
;;
- condrestart)
- [ -e "$VAR_SUBSYS_IPTABLES" ] && restart
+ condrestart|try-restart)
+ [ ! -e "$VAR_SUBSYS_IPTABLES" ] && exit 0
+ restart
+ RETVAL=$?
;;
status)
status
RETVAL=$?
;;
*)
- echo $"Usage: $0 {start|stop|restart|condrestart|status|panic|save}"
- exit 1
+ echo $"Usage: ${IPTABLES} {start|stop|restart|condrestart|status|panic|save}"
+ RETVAL=2
;;
esac
git://git.onelab.eu / iptables.git / blobdiff