1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
|
#!/bin/sh
# This file is part of netfilter-persistent
# (was iptables-persistent)
# Copyright (C) 2009, Simon Richter <sjr@debian.org>
# Copyright (C) 2010, 2014 Jonathan Wiltshire <jmw@debian.org>
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of the GNU General Public License
# as published by the Free Software Foundation, either version 3
# of the License, or (at your option) any later version.
set -e
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
# Source configuration
if [ -f "/etc/default/netfilter-persistent" ]; then
. /etc/default/netfilter-persistent
fi
load_rules()
{
#load IPv4 rules
if [ ! -f /etc/iptables/rules.v4 ]; then
echo "Warning: skipping IPv4 (no rules to load)"
else
iptables-restore < /etc/iptables/rules.v4
fi
}
save_rules()
{
if [ ! "${IPTABLES_SKIP_SAVE}x" = "yesx" ]; then
touch /etc/iptables/rules.v4
chmod 0640 /etc/iptables/rules.v4
iptables-save > /etc/iptables/rules.v4
fi
}
flush_rules()
{
TABLES=$(iptables-save | sed -E -n 's/^\*//p')
for table in $TABLES
do
CHAINS=$(iptables-save -t $table | sed -E -n 's/^:([A-Z]+).*/\1/p')
for chain in $CHAINS
do
# policy can't be set on user-defined chains
iptables -t $table -P $chain ACCEPT || true
done
iptables -t $table -F
iptables -t $table -Z
iptables -t $table -X
done
}
case "$1" in
start|restart|reload|force-reload)
load_rules
;;
save)
save_rules
;;
stop)
# Why? because if stop is used, the firewall gets flushed for a variable
# amount of time during package upgrades, leaving the machine vulnerable
# It's also not always desirable to flush during purge
echo "Automatic flushing disabled, use \"flush\" instead of \"stop\""
;;
flush)
flush_rules
;;
*)
echo "Usage: $0 {start|restart|reload|force-reload|save|flush}" >&2
exit 1
;;
esac
|
