#!/bin/bash # # firwall : Bring up/down the firewall # # chkconfig: 2345 08 92 # description: Activate/Deactivate the firewall. # # this script should be in /etc/init.d # # greetz, # harry SN=`basename $0` IPTABLES=/sbin/iptables case $1 in start) [ -f /etc/firewall.global ] || exit 0; . /etc/firewall.global; # Get the subsys in place for redhat if [ -e /etc/redhat-release ] ; then touch /var/lock/subsys/$SN fi ;; stop) echo "Clearing firewall rules and setting default policies to ACCEPT"; $IPTABLES -F; $IPTABLES -X; $IPTABLES -F -t nat; $IPTABLES -X -t nat; $IPTABLES -F -t mangle; $IPTABLES -X -t mangle; $IPTABLES -P INPUT ACCEPT; $IPTABLES -P OUTPUT ACCEPT; $IPTABLES -P FORWARD ACCEPT; # Remove the subsys in place for redhat if [ -e /etc/redhat-release ] ; then rm -f /var/lock/subsys/$SN fi ;; restart|reload) $0 stop; $0 start; ;; pause) ($IPTABLES -I OUTPUT -j ACCEPT;\ sleep 5s;\ $IPTABLES -D OUTPUT -j ACCEPT)& ;; panic|shutdown) echo 0 > /proc/sys/net/ipv4/ip_forward $IPTABLES -F; $IPTABLES -X; $IPTABLES -F -t nat; $IPTABLES -X -t nat; $IPTABLES -F -t mangle; $IPTABLES -X -t mangle; $IPTABLES -P INPUT -j DROP; $IPTABLES -P OUTPUT -j DROP; $IPTABLES -P FORWARD -j DROP; echo "PANIC: default policy now DROP and all rules flushed"; ;; *) echo "Usage: $0 start|stop|restart|reload|panic|pause|shutdown"; ;; esac