#!/bin/sh
# rc.netfilter: start/stop/restart the Linux firewall (netfilter)
#
#
# Customize the activate_rules() function according to your needs and restart the service
# with command "rc.netfilter restart"
# Every allowed traffic should be specified, default policy is "DROP every protocol" but
# you can change it at your own risks
#
#########################################################
# HERE YOU MAY DEFINE YOUR POLICY IF NEEDED ( DROP | ACCEPT )
POLICY='DROP'
# HERE YOU MAY DEFINE YOUR RULES AS IPTABLES COMMANDS
activate_rules() {
iptables -t filter -A INPUT -p tcp --dport 22 -j ACCEPT # ssh
iptables -t filter -A OUTPUT -j ACCEPT
}
#########################################################
netfilter_start() {
# If netfilter is not running, start it:
/sbin/modprobe ip_tables
/sbin/modprobe iptable_filter
/sbin/modprobe iptable_nat
/sbin/modprobe ip_conntrack
/sbin/modprobe ipt_state
/sbin/modprobe ip_conntrack_ftp
for TABLE in filter nat mangle; do
iptables -t $TABLE -F 1>&2 2>/dev/null
iptables -t $TABLE -X 1>&2 2>/dev/null
done
for CHAIN in INPUT OUTPUT FORWARD; do
iptables -t filter -P $CHAIN $POLICY 1>&2 2>/dev/null
done
iptables -t filter -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -t filter -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -t filter -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -t filter -A INPUT -i lo -j ACCEPT
iptables -t filter -A OUTPUT -o lo -j ACCEPT
activate_rules
}
netfilter_stop() {
for TABLE in filter nat mangle; do
iptables -t $TABLE -F 1>&2 2>/dev/null
iptables -t $TABLE -X 1>&2 2>/dev/null
done
for CHAIN in INPUT OUTPUT FORWARD; do
iptables -t filter -P $CHAIN ACCEPT 1>&2 2>/dev/null
done
}
netfilter_restart() {
netfilter_start
}
case "$1" in
'start')
netfilter_start
;;
'stop')
netfilter_stop
;;
'restart')
netfilter_restart
;;
*)
echo "usage $0 start|stop|restart"
esac
# Copyright Jean-Philippe Guillemin. This program is free software; you can redistribute
# it and/or modify it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or (at your option)
# any later version. Please take a look at http://www.gnu.org/copyleft/gpl.htm