Главная   Изменения   Спек   Патчи   Исходники   Загрузить   Gear   Bugs and FR  Repocop 

#!/bin/sh
#
# firewall      This shell script takes care of starting and stopping
#               the fwbuilder firewall.
#
# chkconfig: 2345 12 89
# description: fwbuilder firewall

# Source function library.
. /etc/rc.d/init.d/functions

# Source networking configuration.
	. /etc/sysconfig/network

# Check that networking is up.
[ $NETWORKING = "no" ] && exit 0

[ -d /etc/firewall/ ] || exit 0

RETVAL=0
prog="firewall"
FWSCRIPT=/etc/firewall/`hostname -s`.fw
LOCKFILE=/var/lock/subsys/firewall

[ -f $FWSCRIPTS ] || exit 0

iftable() {
	if fgrep -qsx $1 /proc/net/ip_tables_names; then
		iptables -t "$@"
	fi
}

start() {
	echo -n $"Starting $prog: "
	daemon $FWSCRIPT
	RETVAL=$?
	echo
	[ $RETVAL -eq 0 ] && touch $LOCKFILE
	return $RETVAL
}

stop() {
	echo -n $"Shutting down $prog: "

        iptables -F
	iptables -X
	
	iftable filter -P INPUT ACCEPT && \
	   iftable filter -P OUTPUT ACCEPT && \
	   iftable filter -P FORWARD ACCEPT && \
	   iftable nat -P PREROUTING ACCEPT && \
	   iftable nat -P POSTROUTING ACCEPT && \
	   iftable nat -P OUTPUT ACCEPT && \
	   iftable mangle -P PREROUTING ACCEPT && \
	   iftable mangle -P OUTPUT ACCEPT && \
	   success $"Resetting built-in chains to the default ACCEPT policy" || \
	   failure $"Resetting built-in chains to the default ACCEPT policy"

	RETVAL=$?
	echo
	[ $RETVAL -eq 0 ] && rm -f $LOCKFILE
	return $RETVAL
}

panic() {
	echo -n $"Changing target policies to DROP: "	
	iftable filter -P INPUT DROP && \
	    iftable filter -P FORWARD DROP && \
	    iftable filter -P OUTPUT DROP && \
	    iftable nat -P PREROUTING DROP && \
	    iftable nat -P POSTROUTING DROP && \
	    iftable nat -P OUTPUT DROP && \
	    iftable mangle -P PREROUTING DROP && \
	    iftable mangle -P OUTPUT DROP && \
	    success $"Changing target policies to DROP" || \
	    failure $"Changing target policies to DROP"
	echo
        iftable filter -F INPUT && \
                iftable filter -F FORWARD && \
                iftable filter -F OUTPUT && \
                iftable nat -F PREROUTING && \
                iftable nat -F POSTROUTING && \
                iftable nat -F OUTPUT && \
                iftable mangle -F PREROUTING && \
                iftable mangle -F OUTPUT && \
                success $"Flushing all chains:" || \
                failure $"Flushing all chains:"
        iftable filter -X INPUT && \
                iftable filter -X FORWARD && \
                iftable filter -X OUTPUT && \
                iftable nat -X PREROUTING && \
                iftable nat -X POSTROUTING && \
                iftable nat -X OUTPUT && \
                iftable mangle -X PREROUTING && \
                iftable mangle -X OUTPUT && \
                success $"Removing user defined chains:" || \
                failure $"Removing user defined chains:"
}

# See how we were called.
case "$1" in
  start)
	start
	;;
  stop)
	stop
	;;
  restart|reload)
	stop
	start
	RETVAL=$?
	;;
  condrestart)
	if [ -f $LOCKFILE ]; then
	    stop
	    start
	    RETVAL=$?
	fi
	;;
  status)
        tables=`cat /proc/net/ip_tables_names 2>/dev/null`
        for table in $tables; do
            echo $"Table: $table"
            iptables -t $table --list
        done
        ;;
  panic)
	panic
	;;
  *)
	echo $"Usage: $0 {start|stop|restart|condrestart|status}"
	exit 1
esac

exit 0