#!/bin/sh
# example SysV init script for iptables
#

########################################################################
# Date                 : 27 Feb 2002
# copyright            : (C) 2002 by Arthur Clune
# email                : arthur@clune.org
#
#  This program is free software; you can redistribute it and/or modify  
#  it under the terms of the GNU General Public License as published by  
#  the Free Software Foundation; either version 2 of the License, or     
#  (at your option) any later version.                                   
########################################################################

# This code based upon the RedHat iptables start up script 
# by bero@redhat.com, based on the ipchains script:
# Script Author:        Joshua Jensen <joshua@redhat.com>
#   -- hacked up by gafton with help from notting
# modified by Anton Altaparmakov <aia21@cam.ac.uk>:
# modified by Nils Philippsen <nils@redhat.de>


#
# chkconfig: 2345 05 91
# description: Start/stop firewall

IPTABLES_CONFIG=/etc/sysconfig/firewall

if [ ! -x /sbin/iptables ]; then
        exit 0
fi

# an aliases for iptable that only does things if the specified chain exists
iftable() {
        if fgrep -qsx $1 /proc/net/ip_tables_names; then
                iptables -t "$@"
        fi
}

start(){
    echo "Starting firewall"

    if [ ! -x $IPTABLES_CONFIG ]; then
	# ditch any old rules, including deleting any user-defined chains
	iptables -F 
	iptables -X
	chains=`cat /proc/net/ip_tables_names 2>/dev/null`
	for i in $chains; do iptables -t $i -F; done && \
	  echo $"Flushing all current rules and user defined chains" || \
	  echo $"Failure flushing all current rules and user defined chains"
	for i in $chains; do iptables -t $i -X; done && \
                echo $"Clearing all current rules and user defined chains" || \
                echo $"Failure clearing all current rules and user defined chains"
              
	# zero all counters
              for i in $chains; do iptables -t $i -Z; done

	# source new firewall rules 
              # could use iptables-restore here, but I prefer to have all FW config
              # (including /proc settings) in $IPTABLES_CONFIG, which means we have to
              # execute it
	/bin/sh $IPTABLES_CONFIG && \
	  echo $"Applying iptables firewall rules" || \
	  echo $"Failure applying iptables firewall rules"

	return 0
    fi	
}

stop(){
        chains=`cat /proc/net/ip_tables_names 2>/dev/null`
        for i in $chains; do iptables -t $i -F; done && \
                echo $"Flushing all chains" || \
                echo $"Failure flushing all chains"
        for i in $chains; do iptables -t $i -X; done && \
                echo $"Removing user defined chains" || \
                echo $"Failure removing user defined chains"
        iftable   filter -P INPUT ACCEPT && \
           iftable   filter -P OUTPUT ACCEPT && \
           iftable   filter -P FORWARD ACCEPT && \
           iftable   nat -P PREROUTING ACCEPT && \
           iftable   nat -P POSTROUTING ACCEPT && \
           iftable   nat -P OUTPUT ACCEPT && \
           iftable   mangle -P PREROUTING ACCEPT && \
           iftable   mangle -P OUTPUT ACCEPT && \
           echo $"Resetting built-in chains to the default ACCEPT policy" || \
           echo $"Failure resetting built-in chains to the default ACCEPT policy"
    return 0
}

panic(){
        echo -n $"Changing target policies to DROP: "
        iftable filter -P INPUT DROP && \
            iftable filter -P FORWARD DROP && \
            iftable filter -P OUTPUT DROP && \
            iftable nat -P PREROUTING DROP && \
            iftable nat -P POSTROUTING DROP && \
            iftable nat -P OUTPUT DROP && \
            iftable mangle -P PREROUTING DROP && \
            iftable mangle -P OUTPUT DROP && \
            echo $"Changing target policies to DROP" || \
            echo $"Failure changing target policies to DROP"
        echo
        iftable filter -F INPUT && \
                iftable filter -F FORWARD && \
                iftable filter -F OUTPUT && \
                iftable nat -F PREROUTING && \
                iftable nat -F POSTROUTING && \
                iftable nat -F OUTPUT && \
                iftable mangle -F PREROUTING && \
                iftable mangle -F OUTPUT && \
                echo $"Flushing all chains" || \
                echo $"Failure flushing all chains"
        iftable filter -X INPUT && \
                iftable filter -X FORWARD && \
                iftable filter -X OUTPUT && \
                iftable nat -X PREROUTING && \
                iftable nat -X POSTROUTING && \
                iftable nat -X OUTPUT && \
                iftable mangle -X PREROUTING && \
                iftable mangle -X OUTPUT && \
                echo $"Removing user defined chains" || \
                echo $"Failure removing user defined chains"
}

case "$1" in
    start)
	start
    ;;
    stop)
	stop
    ;;
    restart)
	# not a deamon, so nothing to kill, just re-start
	start
    ;;
    panic)
	panic
    ;;
   status)
        tables=`cat /proc/net/ip_tables_names 2>/dev/null`
        for table in $tables; do
                echo $"Table: $table"
                iptables -t $table --list
        done
        ;;
    *)
        echo "Usage: netfilter {start|stop|restart|panic|status}"
	exit 1
esac
 
exit 0