/usr/libexec/iptables-systemd-helper.sh

iptables-systemd-helper.sh (text/plain), 1.60 KB, created by redneb on 2013-12-31 05:40:48 UTC

#!/bin/sh
set -e

case "$(basename $0)" in
	ip6*) VER="6";;
        *)    VER="";;
esac
action=$1

iptables_save="/var/lib/ip${VER}tables/rules-save"
iptables_bin="/sbin/ip${VER}tables"
iptables_proc="/proc/net/ip${VER}_tables_names"

checkkernel() {
	if [ ! -e "${iptables_proc}" ] ; then
		echo "Your kernel lacks ip${VER}tables support, please load appropriate modules and try again." >&2
		return 1
	fi
}

get_built_in_chains() {
	local table=$1
	case ${table} in
		nat)    echo "PREROUTING POSTROUTING OUTPUT";;
		mangle) echo "PREROUTING INPUT FORWARD OUTPUT POSTROUTING";;
		filter) echo "INPUT FORWARD OUTPUT";;
	esac
}

# make sure that ${iptables_save} exists and has the right permissions
check_save_file() {
	if [ ! -e "${iptables_save}" ]; then
		touch "${iptables_save}"
		chmod 0600 "${iptables_save}"
	fi
}

# generate an empty set of rules but only if the save file does not exist
init() {
	[ -e "${iptables_save}" ] && return 0
	check_save_file

	echo "Creating an empty set of rules"
	(
		local table
		for table in $(cat ${iptables_proc}); do
			echo "*${table}"
			local chain
			for chain in $(get_built_in_chains ${table}); do
				echo ":${chain} ACCEPT [0:0]"
			done
			echo "COMMIT"
		done
	) > "${iptables_save}"
}

# flush all tables, delete non-build-in chains, set all policies to ACCEPT
flush() {
	local table
	for table in $(cat ${iptables_proc}); do
		local chain
		for chain in $(get_built_in_chains ${table}); do
			${iptables_bin} -t ${table} -P ${chain} ACCEPT
		done
		${iptables_bin} -F -t $table
		${iptables_bin} -X -t $table
	done
}

checkkernel
case ${action} in
	init)  init;;
	flush) flush;;
esac