mirror of
https://github.com/fwbuilder/fwbuilder
synced 2026-03-19 17:57:22 +01:00
f366e2dc66
3178186 "Add ND/NS allow rules for the FORWARD chain". Rules that are added automatically to ipv6 Linux firewall to permit neighbor discovery packets should be also added to the FORWARD chain if the firewall is a bridge. see #2323
600 lines
17 KiB
Bash
Executable File
600 lines
17 KiB
Bash
Executable File
#!/bin/sh
|
|
#
|
|
# This is automatically generated file. DO NOT MODIFY !
|
|
#
|
|
# Firewall Builder fwb_ipt v4.2.0.3523
|
|
#
|
|
# Generated Sun Apr 10 17:52:30 2011 PDT by vadim
|
|
#
|
|
# files: * firewall35.fw /etc/fw/firewall35.fw
|
|
#
|
|
# Compiled for iptables (any version)
|
|
#
|
|
# testing AddressTable object
|
|
|
|
# like firewall34, but uses different script format
|
|
|
|
|
|
|
|
|
|
FWBDEBUG=""
|
|
|
|
PATH="/sbin:/usr/sbin:/bin:/usr/bin:${PATH}"
|
|
export PATH
|
|
|
|
|
|
|
|
LSMOD="/sbin/lsmod"
|
|
MODPROBE="/sbin/modprobe"
|
|
IPTABLES="/sbin/iptables"
|
|
IP6TABLES="/sbin/ip6tables"
|
|
IPTABLES_RESTORE="/sbin/iptables-restore"
|
|
IP6TABLES_RESTORE="/sbin/ip6tables-restore"
|
|
IP="/sbin/ip"
|
|
IFCONFIG="/sbin/ifconfig"
|
|
VCONFIG="/sbin/vconfig"
|
|
BRCTL="/sbin/brctl"
|
|
IFENSLAVE="/sbin/ifenslave"
|
|
IPSET="/usr/sbin/ipset"
|
|
LOGGER="/usr/bin/logger"
|
|
|
|
log() {
|
|
echo "$1"
|
|
command -v "$LOGGER" >/dev/null 2>&1 && $LOGGER -p info "$1"
|
|
}
|
|
|
|
getInterfaceVarName() {
|
|
echo $1 | sed 's/\./_/'
|
|
}
|
|
|
|
getaddr_internal() {
|
|
dev=$1
|
|
name=$2
|
|
af=$3
|
|
L=$($IP $af addr show dev $dev | sed -n '/inet/{s!.*inet6* !!;s!/.*!!p}' | sed 's/peer.*//')
|
|
test -z "$L" && {
|
|
eval "$name=''"
|
|
return
|
|
}
|
|
eval "${name}_list=\"$L\""
|
|
}
|
|
|
|
getaddr() {
|
|
getaddr_internal $1 $2 "-4"
|
|
}
|
|
|
|
getaddr6() {
|
|
getaddr_internal $1 $2 "-6"
|
|
}
|
|
|
|
# function getinterfaces is used to process wildcard interfaces
|
|
getinterfaces() {
|
|
NAME=$1
|
|
$IP link show | grep ": $NAME" | while read L; do
|
|
OIFS=$IFS
|
|
IFS=" :"
|
|
set $L
|
|
IFS=$OIFS
|
|
echo $2
|
|
done
|
|
}
|
|
|
|
diff_intf() {
|
|
func=$1
|
|
list1=$2
|
|
list2=$3
|
|
cmd=$4
|
|
for intf in $list1
|
|
do
|
|
echo $list2 | grep -q $intf || {
|
|
# $vlan is absent in list 2
|
|
$func $intf $cmd
|
|
}
|
|
done
|
|
}
|
|
|
|
find_program() {
|
|
PGM=$1
|
|
command -v $PGM >/dev/null 2>&1 || {
|
|
echo "$PGM not found"
|
|
exit 1
|
|
}
|
|
}
|
|
check_tools() {
|
|
find_program $IPTABLES
|
|
find_program $IPTABLES_RESTORE
|
|
find_program $IP
|
|
}
|
|
reset_iptables_v4() {
|
|
$IPTABLES -P OUTPUT DROP
|
|
$IPTABLES -P INPUT DROP
|
|
$IPTABLES -P FORWARD DROP
|
|
|
|
cat /proc/net/ip_tables_names | while read table; do
|
|
$IPTABLES -t $table -L -n | while read c chain rest; do
|
|
if test "X$c" = "XChain" ; then
|
|
$IPTABLES -t $table -F $chain
|
|
fi
|
|
done
|
|
$IPTABLES -t $table -X
|
|
done
|
|
}
|
|
|
|
reset_iptables_v6() {
|
|
$IP6TABLES -P OUTPUT DROP
|
|
$IP6TABLES -P INPUT DROP
|
|
$IP6TABLES -P FORWARD DROP
|
|
|
|
cat /proc/net/ip6_tables_names | while read table; do
|
|
$IP6TABLES -t $table -L -n | while read c chain rest; do
|
|
if test "X$c" = "XChain" ; then
|
|
$IP6TABLES -t $table -F $chain
|
|
fi
|
|
done
|
|
$IP6TABLES -t $table -X
|
|
done
|
|
}
|
|
|
|
|
|
P2P_INTERFACE_WARNING=""
|
|
|
|
missing_address() {
|
|
address=$1
|
|
cmd=$2
|
|
|
|
oldIFS=$IFS
|
|
IFS="@"
|
|
set $address
|
|
addr=$1
|
|
interface=$2
|
|
IFS=$oldIFS
|
|
|
|
|
|
|
|
$IP addr show dev $interface | grep -q POINTOPOINT && {
|
|
test -z "$P2P_INTERFACE_WARNING" && echo "Warning: Can not update address of interface $interface. fwbuilder can not manage addresses of point-to-point interfaces yet"
|
|
P2P_INTERFACE_WARNING="yes"
|
|
return
|
|
}
|
|
|
|
test "$cmd" = "add" && {
|
|
echo "# Adding ip address: $interface $addr"
|
|
echo $addr | grep -q ':' && {
|
|
$FWBDEBUG $IP addr $cmd $addr dev $interface
|
|
} || {
|
|
$FWBDEBUG $IP addr $cmd $addr broadcast + dev $interface
|
|
}
|
|
}
|
|
|
|
test "$cmd" = "del" && {
|
|
echo "# Removing ip address: $interface $addr"
|
|
$FWBDEBUG $IP addr $cmd $addr dev $interface || exit 1
|
|
}
|
|
|
|
$FWBDEBUG $IP link set $interface up
|
|
}
|
|
|
|
list_addresses_by_scope() {
|
|
interface=$1
|
|
scope=$2
|
|
ignore_list=$3
|
|
$IP addr ls dev $interface | \
|
|
awk -v IGNORED="$ignore_list" -v SCOPE="$scope" \
|
|
'BEGIN {
|
|
split(IGNORED,ignored_arr);
|
|
for (a in ignored_arr) {ignored_dict[ignored_arr[a]]=1;}
|
|
}
|
|
(/inet |inet6 / && $0 ~ SCOPE && !($2 in ignored_dict)) {print $2;}' | \
|
|
while read addr; do
|
|
echo "${addr}@$interface"
|
|
done | sort
|
|
}
|
|
|
|
|
|
update_addresses_of_interface() {
|
|
ignore_list=$2
|
|
set $1
|
|
interface=$1
|
|
shift
|
|
|
|
FWB_ADDRS=$(
|
|
for addr in $*; do
|
|
echo "${addr}@$interface"
|
|
done | sort
|
|
)
|
|
|
|
CURRENT_ADDRS_ALL_SCOPES=""
|
|
CURRENT_ADDRS_GLOBAL_SCOPE=""
|
|
|
|
$IP link show dev $interface >/dev/null 2>&1 && {
|
|
CURRENT_ADDRS_ALL_SCOPES=$(list_addresses_by_scope $interface 'scope .*' "$ignore_list")
|
|
CURRENT_ADDRS_GLOBAL_SCOPE=$(list_addresses_by_scope $interface 'scope global' "$ignore_list")
|
|
} || {
|
|
echo "# Interface $interface does not exist"
|
|
# Stop the script if we are not in test mode
|
|
test -z "$FWBDEBUG" && exit 1
|
|
}
|
|
|
|
diff_intf missing_address "$FWB_ADDRS" "$CURRENT_ADDRS_ALL_SCOPES" add
|
|
diff_intf missing_address "$CURRENT_ADDRS_GLOBAL_SCOPE" "$FWB_ADDRS" del
|
|
}
|
|
|
|
clear_addresses_except_known_interfaces() {
|
|
$IP link show | sed 's/://g' | awk -v IGNORED="$*" \
|
|
'BEGIN {
|
|
split(IGNORED,ignored_arr);
|
|
for (a in ignored_arr) {ignored_dict[ignored_arr[a]]=1;}
|
|
}
|
|
(/state/ && !($2 in ignored_dict)) {print $2;}' | \
|
|
while read intf; do
|
|
echo "# Removing addresses not configured in fwbuilder from interface $intf"
|
|
$FWBDEBUG $IP addr flush dev $intf scope global
|
|
$FWBDEBUG $IP link set $intf down
|
|
done
|
|
}
|
|
|
|
check_file() {
|
|
test -r "$2" || {
|
|
echo "Can not find file $2 referenced by address table object $1"
|
|
exit 1
|
|
}
|
|
}
|
|
|
|
check_run_time_address_table_files() {
|
|
:
|
|
check_file "block_these" "block-hosts.tbl"
|
|
}
|
|
|
|
load_modules() {
|
|
:
|
|
|
|
}
|
|
|
|
verify_interfaces() {
|
|
:
|
|
|
|
}
|
|
|
|
prolog_commands() {
|
|
echo "Running prolog script"
|
|
|
|
}
|
|
|
|
epilog_commands() {
|
|
echo "Running epilog script"
|
|
|
|
}
|
|
|
|
run_epilog_and_exit() {
|
|
epilog_commands
|
|
exit $1
|
|
}
|
|
|
|
configure_interfaces() {
|
|
:
|
|
# Configure interfaces
|
|
update_addresses_of_interface "lo 127.0.0.1/8" ""
|
|
update_addresses_of_interface "eth1 192.168.1.100/24" ""
|
|
getaddr eth0.100 i_eth0_100
|
|
getaddr6 eth0.100 i_eth0_100_v6
|
|
}
|
|
|
|
script_body() {
|
|
echo 30 > /proc/sys/net/ipv4/tcp_fin_timeout
|
|
echo 1800 > /proc/sys/net/ipv4/tcp_keepalive_intvl
|
|
|
|
|
|
# ================ IPv4
|
|
|
|
|
|
|
|
(
|
|
|
|
echo '*filter'
|
|
# ================ Table 'filter', automatic rules
|
|
echo :INPUT DROP [0:0]
|
|
echo :FORWARD DROP [0:0]
|
|
echo :OUTPUT DROP [0:0]
|
|
echo "-A FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu"
|
|
|
|
# accept established sessions
|
|
echo "-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT "
|
|
echo "-A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT "
|
|
echo "-A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT "
|
|
# ================ Table 'filter', rule set block_local_bcast
|
|
#
|
|
# Rule block_local_bcast 0 (global)
|
|
# an attempt to build rule blocking local broadcast packets on the subnet where firewall has dynamic interface
|
|
echo ":block_local_bcast - [0:0]"
|
|
echo "-A block_local_bcast -d 192.168.222.255 -j DROP "
|
|
#
|
|
# ================ Table 'filter', rule set Policy
|
|
#
|
|
# Rule 0 (global)
|
|
echo "-A OUTPUT -d 192.168.1.1 -m state --state NEW -j ACCEPT "
|
|
echo "-A OUTPUT -d 192.168.1.2 -m state --state NEW -j ACCEPT "
|
|
echo "-A OUTPUT -d 192.168.1.3/30 -m state --state NEW -j ACCEPT "
|
|
echo "-A OUTPUT -d 192.168.1.200 -m state --state NEW -j ACCEPT "
|
|
echo "-A OUTPUT -d 192.168.1.201 -m state --state NEW -j ACCEPT "
|
|
echo "-A OUTPUT -d 192.168.2.128/25 -m state --state NEW -j ACCEPT "
|
|
echo "-A INPUT -d 192.168.1.1 -m state --state NEW -j ACCEPT "
|
|
echo "-A INPUT -d 192.168.1.2 -m state --state NEW -j ACCEPT "
|
|
echo "-A INPUT -d 192.168.1.3/30 -m state --state NEW -j ACCEPT "
|
|
echo "-A INPUT -d 192.168.1.200 -m state --state NEW -j ACCEPT "
|
|
echo "-A INPUT -d 192.168.1.201 -m state --state NEW -j ACCEPT "
|
|
echo "-A INPUT -d 192.168.2.128/25 -m state --state NEW -j ACCEPT "
|
|
echo "-A FORWARD -d 192.168.1.1 -m state --state NEW -j ACCEPT "
|
|
echo "-A FORWARD -d 192.168.1.2 -m state --state NEW -j ACCEPT "
|
|
echo "-A FORWARD -d 192.168.1.3/30 -m state --state NEW -j ACCEPT "
|
|
echo "-A FORWARD -d 192.168.1.200 -m state --state NEW -j ACCEPT "
|
|
echo "-A FORWARD -d 192.168.1.201 -m state --state NEW -j ACCEPT "
|
|
echo "-A FORWARD -d 192.168.2.128/25 -m state --state NEW -j ACCEPT "
|
|
#
|
|
# Rule 1 (global)
|
|
echo ":RULE_1 - [0:0]"
|
|
grep -Ev '^#|^;|^\s*$' block-hosts.tbl | while read L ; do
|
|
set $L; at_block_these=$1; echo "-A OUTPUT -d $at_block_these -j RULE_1 "
|
|
done
|
|
grep -Ev '^#|^;|^\s*$' block-hosts.tbl | while read L ; do
|
|
set $L; at_block_these=$1; echo "-A FORWARD -d $at_block_these -j RULE_1 "
|
|
done
|
|
echo "-A RULE_1 -j LOG --log-level debug --log-prefix \"RULE 1 -- DENY on global \""
|
|
echo "-A RULE_1 -j DROP "
|
|
#
|
|
# Rule 2 (global)
|
|
echo ":RULE_2 - [0:0]"
|
|
grep -Ev '^#|^;|^\s*$' block-hosts.tbl | while read L ; do
|
|
set $L; at_block_these=$1; echo "-A OUTPUT -d $at_block_these -j RULE_2 "
|
|
done
|
|
echo "-A OUTPUT -d 61.150.47.112 -j RULE_2 "
|
|
grep -Ev '^#|^;|^\s*$' block-hosts.tbl | while read L ; do
|
|
set $L; at_block_these=$1; echo "-A FORWARD -d $at_block_these -j RULE_2 "
|
|
done
|
|
echo "-A FORWARD -d 61.150.47.112 -j RULE_2 "
|
|
echo "-A RULE_2 -j LOG --log-level debug --log-prefix \"RULE 2 -- DENY on global \""
|
|
echo "-A RULE_2 -j DROP "
|
|
#
|
|
# Rule 3 (global)
|
|
grep -Ev '^#|^;|^\s*$' block-hosts.tbl | while read L ; do
|
|
set $L; at_block_these=$1; echo "-A OUTPUT -p tcp -m tcp -d $at_block_these --dport 25 -j DROP "
|
|
done
|
|
echo "-A OUTPUT -p tcp -m tcp -d 61.150.47.112 --dport 25 -j DROP "
|
|
grep -Ev '^#|^;|^\s*$' block-hosts.tbl | while read L ; do
|
|
set $L; at_block_these=$1; echo "-A FORWARD -p tcp -m tcp -d $at_block_these --dport 25 -j DROP "
|
|
done
|
|
echo "-A FORWARD -p tcp -m tcp -d 61.150.47.112 --dport 25 -j DROP "
|
|
#
|
|
# Rule 4 (global)
|
|
for i_eth0_100 in $i_eth0_100_list
|
|
do
|
|
test -n "$i_eth0_100" && {
|
|
grep -Ev '^#|^;|^\s*$' block-hosts.tbl | while read L ; do
|
|
set $L; at_block_these=$1; echo "-A OUTPUT -p tcp -m tcp -s $i_eth0_100 -d $at_block_these --dport 25 -j DROP "
|
|
done
|
|
}
|
|
done
|
|
for i_eth0_100 in $i_eth0_100_list
|
|
do
|
|
test -n "$i_eth0_100" && echo "-A OUTPUT -p tcp -m tcp -s $i_eth0_100 -d 61.150.47.112 --dport 25 -j DROP "
|
|
done
|
|
#
|
|
# Rule 5 (global)
|
|
# test rule for the discussion
|
|
# https://sourceforge.net/projects/fwbuilder/forums/forum/16372/topic/3733964/index/page/1
|
|
echo "-A INPUT -j block_local_bcast "
|
|
#
|
|
# Rule 6 (global)
|
|
echo ":RULE_6 - [0:0]"
|
|
grep -Ev '^#|^;|^\s*$' block-hosts.tbl | while read L ; do
|
|
set $L; at_block_these=$1; echo "-A INPUT -s $at_block_these -j RULE_6 "
|
|
done
|
|
grep -Ev '^#|^;|^\s*$' block-hosts.tbl | while read L ; do
|
|
set $L; at_block_these=$1; echo "-A FORWARD -s $at_block_these -j RULE_6 "
|
|
done
|
|
echo "-A RULE_6 -j LOG --log-level debug --log-prefix \"RULE 6 -- DENY on global \""
|
|
echo "-A RULE_6 -j DROP "
|
|
#
|
|
# Rule 7 (global)
|
|
echo ":RULE_7 - [0:0]"
|
|
grep -Ev '^#|^;|^\s*$' block-hosts.tbl | while read L ; do
|
|
set $L; at_block_these=$1; echo "-A INPUT -s $at_block_these -j RULE_7 "
|
|
done
|
|
echo "-A INPUT -s 61.150.47.112 -j RULE_7 "
|
|
grep -Ev '^#|^;|^\s*$' block-hosts.tbl | while read L ; do
|
|
set $L; at_block_these=$1; echo "-A FORWARD -s $at_block_these -j RULE_7 "
|
|
done
|
|
echo "-A FORWARD -s 61.150.47.112 -j RULE_7 "
|
|
echo "-A RULE_7 -j LOG --log-level debug --log-prefix \"RULE 7 -- DENY on global \""
|
|
echo "-A RULE_7 -j DROP "
|
|
#
|
|
# Rule 8 (global)
|
|
echo ":Cid4392555025682.0 - [0:0]"
|
|
echo "-A OUTPUT -m state --state NEW -j Cid4392555025682.0 "
|
|
echo "-A INPUT -m state --state NEW -j Cid4392555025682.0 "
|
|
echo "-A FORWARD -m state --state NEW -j Cid4392555025682.0 "
|
|
grep -Ev '^#|^;|^\s*$' block-hosts.tbl | while read L ; do
|
|
set $L; at_block_these=$1; echo "-A Cid4392555025682.0 -s $at_block_these -j RETURN "
|
|
done
|
|
echo "-A Cid4392555025682.0 -s 61.150.47.112 -j RETURN "
|
|
echo "-A Cid4392555025682.0 -j ACCEPT "
|
|
#
|
|
# Rule 9 (global)
|
|
echo ":Cid4392555D25682.0 - [0:0]"
|
|
for i_eth0_100 in $i_eth0_100_list
|
|
do
|
|
test -n "$i_eth0_100" && echo "-A INPUT -s $i_eth0_100 -m state --state NEW -j Cid4392555D25682.0 "
|
|
done
|
|
for i_eth0_100 in $i_eth0_100_list
|
|
do
|
|
test -n "$i_eth0_100" && echo "-A OUTPUT -s $i_eth0_100 -m state --state NEW -j Cid4392555D25682.0 "
|
|
done
|
|
grep -Ev '^#|^;|^\s*$' block-hosts.tbl | while read L ; do
|
|
set $L; at_block_these=$1; echo "-A Cid4392555D25682.0 -d $at_block_these -j RETURN "
|
|
done
|
|
echo "-A Cid4392555D25682.0 -d 61.150.47.112 -j RETURN "
|
|
echo "-A Cid4392555D25682.0 -j ACCEPT "
|
|
#
|
|
# Rule 10 (global)
|
|
echo "-A OUTPUT -p tcp -m tcp -d 192.168.1.10 --dport 25 -m state --state NEW -j ACCEPT "
|
|
echo "-A FORWARD -p tcp -m tcp -d 192.168.1.10 --dport 25 -m state --state NEW -j ACCEPT "
|
|
#
|
|
# Rule 11 (global)
|
|
echo "-A INPUT -s 192.168.1.0/24 -m state --state NEW -j ACCEPT "
|
|
echo "-A OUTPUT -s 192.168.1.0/24 -m state --state NEW -j ACCEPT "
|
|
echo "-A FORWARD -s 192.168.1.0/24 -m state --state NEW -j ACCEPT "
|
|
#
|
|
# Rule 12 (global)
|
|
echo ":RULE_12 - [0:0]"
|
|
echo "-A OUTPUT -j RULE_12 "
|
|
echo "-A INPUT -j RULE_12 "
|
|
echo "-A FORWARD -j RULE_12 "
|
|
echo "-A RULE_12 -j LOG --log-level debug --log-prefix \"RULE 12 -- DENY on global \""
|
|
echo "-A RULE_12 -j DROP "
|
|
#
|
|
echo COMMIT
|
|
|
|
|
|
|
|
echo '*nat'
|
|
# ================ Table 'nat', rule set NAT
|
|
echo :PREROUTING ACCEPT [0:0]
|
|
echo :POSTROUTING ACCEPT [0:0]
|
|
echo :OUTPUT ACCEPT [0:0]
|
|
#
|
|
# Rule 0 (NAT)
|
|
echo ":Cid4392558F25682.0 - [0:0]"
|
|
for i_eth0_100 in $i_eth0_100_list
|
|
do
|
|
test -n "$i_eth0_100" && echo "-A PREROUTING -p tcp -m tcp -d $i_eth0_100 --dport 25 -j Cid4392558F25682.0 "
|
|
done
|
|
grep -Ev '^#|^;|^\s*$' block-hosts.tbl | while read L ; do
|
|
set $L; at_block_these=$1; echo "-A Cid4392558F25682.0 -s $at_block_these -j RETURN "
|
|
done
|
|
echo "-A Cid4392558F25682.0 -p tcp -m tcp --dport 25 -j DNAT --to-destination 192.168.1.10 "
|
|
#
|
|
# Rule 1 (NAT)
|
|
echo ":Cid4392559D25682.0 - [0:0]"
|
|
echo "-A POSTROUTING -o eth0.100 -s 192.168.1.0/24 -j Cid4392559D25682.0 "
|
|
grep -Ev '^#|^;|^\s*$' block-hosts.tbl | while read L ; do
|
|
set $L; at_block_these=$1; echo "-A Cid4392559D25682.0 -d $at_block_these -j RETURN "
|
|
done
|
|
echo "-A Cid4392559D25682.0 -j MASQUERADE "
|
|
#
|
|
echo COMMIT
|
|
|
|
|
|
) | $IPTABLES_RESTORE; IPTABLES_RESTORE_RES=$?
|
|
test $IPTABLES_RESTORE_RES != 0 && run_epilog_and_exit $IPTABLES_RESTORE_RES
|
|
}
|
|
|
|
ip_forward() {
|
|
:
|
|
|
|
}
|
|
|
|
reset_all() {
|
|
:
|
|
reset_iptables_v4
|
|
}
|
|
|
|
block_action() {
|
|
reset_all
|
|
}
|
|
|
|
stop_action() {
|
|
reset_all
|
|
$IPTABLES -P OUTPUT ACCEPT
|
|
$IPTABLES -P INPUT ACCEPT
|
|
$IPTABLES -P FORWARD ACCEPT
|
|
}
|
|
|
|
check_iptables() {
|
|
IP_TABLES="$1"
|
|
[ ! -e $IP_TABLES ] && return 151
|
|
NF_TABLES=$(cat $IP_TABLES 2>/dev/null)
|
|
[ -z "$NF_TABLES" ] && return 152
|
|
return 0
|
|
}
|
|
status_action() {
|
|
check_iptables "/proc/net/ip_tables_names"
|
|
ret_ipv4=$?
|
|
check_iptables "/proc/net/ip6_tables_names"
|
|
ret_ipv6=$?
|
|
[ $ret_ipv4 -eq 0 -o $ret_ipv6 -eq 0 ] && return 0
|
|
[ $ret_ipv4 -eq 151 -o $ret_ipv6 -eq 151 ] && {
|
|
echo "iptables modules are not loaded"
|
|
}
|
|
[ $ret_ipv4 -eq 152 -o $ret_ipv6 -eq 152 ] && {
|
|
echo "Firewall is not configured"
|
|
}
|
|
exit 3
|
|
}
|
|
|
|
# See how we were called.
|
|
# For backwards compatibility missing argument is equivalent to 'start'
|
|
|
|
cmd=$1
|
|
test -z "$cmd" && {
|
|
cmd="start"
|
|
}
|
|
|
|
case "$cmd" in
|
|
start)
|
|
log "Activating firewall script generated Sun Apr 10 17:52:30 2011 by vadim"
|
|
check_tools
|
|
prolog_commands
|
|
check_run_time_address_table_files
|
|
|
|
load_modules "nat "
|
|
configure_interfaces
|
|
verify_interfaces
|
|
|
|
|
|
|
|
script_body
|
|
ip_forward
|
|
epilog_commands
|
|
RETVAL=$?
|
|
;;
|
|
|
|
stop)
|
|
stop_action
|
|
RETVAL=$?
|
|
;;
|
|
|
|
status)
|
|
status_action
|
|
RETVAL=$?
|
|
;;
|
|
|
|
block)
|
|
block_action
|
|
RETVAL=$?
|
|
;;
|
|
|
|
reload)
|
|
$0 stop
|
|
$0 start
|
|
RETVAL=$?
|
|
;;
|
|
|
|
interfaces)
|
|
configure_interfaces
|
|
RETVAL=$?
|
|
;;
|
|
|
|
test_interfaces)
|
|
FWBDEBUG="echo"
|
|
configure_interfaces
|
|
RETVAL=$?
|
|
;;
|
|
|
|
|
|
|
|
*)
|
|
echo "Usage $0 [start|stop|status|block|reload|interfaces|test_interfaces]"
|
|
;;
|
|
|
|
esac
|
|
|
|
exit $RETVAL |