1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78
|
#!/bin/sh
# This file is part of netfilter-persistent
# (was iptables-persistent)
# Copyright (C) 2009, Simon Richter <sjr@debian.org>
# Copyright (C) 2010, 2014 Jonathan Wiltshire <jmw@debian.org>
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of the GNU General Public License
# as published by the Free Software Foundation, either version 3
# of the License, or (at your option) any later version.
set -e
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
# Source configuration
if [ -f "/etc/default/netfilter-persistent" ]; then
. /etc/default/netfilter-persistent
fi
load_rules()
{
#load IPv4 rules
if [ ! -f /etc/iptables/rules.v4 ]; then
echo "Warning: skipping IPv4 (no rules to load)"
else
iptables-restore < /etc/iptables/rules.v4
fi
}
save_rules()
{
if [ ! "${IPTABLES_SKIP_SAVE}x" = "yesx" ]; then
touch /etc/iptables/rules.v4
chmod 0640 /etc/iptables/rules.v4
iptables-save > /etc/iptables/rules.v4
fi
}
flush_rules()
{
TABLES=$(iptables-save | sed -E -n 's/^\*//p')
for table in $TABLES
do
CHAINS=$(iptables-save -t $table | sed -E -n 's/^:([A-Z]+).*/\1/p')
for chain in $CHAINS
do
# policy can't be set on user-defined chains
iptables -t $table -P $chain ACCEPT || true
done
iptables -t $table -F
iptables -t $table -Z
iptables -t $table -X
done
}
case "$1" in
start|restart|reload|force-reload)
load_rules
;;
save)
save_rules
;;
stop)
# Why? because if stop is used, the firewall gets flushed for a variable
# amount of time during package upgrades, leaving the machine vulnerable
# It's also not always desirable to flush during purge
echo "Automatic flushing disabled, use \"flush\" instead of \"stop\""
;;
flush)
flush_rules
;;
*)
echo "Usage: $0 {start|restart|reload|force-reload|save|flush}" >&2
exit 1
;;
esac
|